systemd 257.13-6: fix render/systemd-journal group regressions and repair the STIG build variant

[dcasota]

Problem

SPECS/systemd (257.13, subrelease 91 and later) has five defects:

Defect	Affected builds	Symptom
dangling accel udev rule	every install	50-udev-default.rules:56 Unknown group 'render', ignoring. on each boot
emptied systemd-journal sysusers snippet	every install	five Failed to resolve group 'systemd-journal' from inside the initrd on each boot
unpinned journal GID	any build once the snippet is restored	systemd-sysusers would allocate an arbitrary GID in the initrd
missing harden-tmpfs-mount-options.patch	STIG_HARDEN=1	build fails on a missing source
duplicate Patch4:	STIG_HARDEN=1	error: patch 4 defined multiple times, no %prep

The last two go unnoticed because %define STIG_HARDEN 0 in the spec body wins over rpmbuild -D, so the STIG variant is never parsed, built or tested.

render. 0004-Remove-unused-default-groups-rules-and-tmpfiles.patch deletes the render group from sysusers.d/basic.conf.in and the drm/kfd rules, but keeps SUBSYSTEM=="accel", GROUP="render", ... as a context line.

systemd-journal. The group exists on the installed system (GID 23, from filesystem's group file) but not in the initrd. dracut 109 builds the initrd's /etc/group by running systemd-sysusers against the shipped snippets (11systemd-journald installs systemd-journal.conf, 78systemd-sysusers runs systemd-sysusers --root=$initdir). Patch 0004 empties that snippet, while 11systemd-tmpfiles still installs tmpfiles.d/systemd.conf, whose five /run/log/journal and /var/log/journal lines reference the group.

tmp.mount. harden-tmpfs-mount-options.patch (adds noexec to units/tmp.mount) is referenced by the STIG conditional but exists only in SPECS/90/systemd/. tmp.mount is owned by this package and not marked as a config file, which is why photon-os-installer skips the equivalent ansible control PHTN-50-000245 (stigenable.py): an install-time edit would show as permanent rpm -V drift and be reverted by the next systemd upgrade. With the spec side unreachable, neither side delivers the control; /tmp is mounted rw,nosuid,nodev without noexec on an installed 5.0 guest.

Change

SPECS/systemd/systemd.spec 257.13-5 -> 257.13-6:

• 0004 patch: the deletion hunk also removes the accel/render rule, and the hunk that emptied sysusers.d/systemd-journal.conf.in is dropped, so g systemd-journal {{SYSTEMD_JOURNAL_GID}} - is shipped.
• -Dsystemd-journal-gid=23: required with the restored snippet. meson_options.txt:320 defaults the option to 0 and meson.build:964 is conf.set(name, val > 0 ? val : '-'), so without the pin the GID would be dynamic and /run/log/journal mis-owned across switch-root. 23 matches filesystem.
• STIG_HARDEN: %define STIG_HARDEN 0 -> %{!?STIG_HARDEN: %global STIG_HARDEN 0}, so the flag can be set from pkg_build_options.json / -D. Default stays off.
• harden-tmpfs-mount-options.patch is added to this directory (same patch as in SPECS/90/systemd/), with a spec comment explaining why the control belongs here and not in the installer.
• Patch list is unnumbered Patch:, so rpm assigns indices in order and a conditional patch cannot collide with an unconditional one.

One %changelog entry.

Testing

• rpmspec -P at subrelease 91 and 92, STIG_HARDEN unset / 0 / 1: all parse without warnings; Source2 is 50-security-hardening.conf for unset/0 and 50-security-hardening.stig.conf for 1, and the tmpfs patch is listed only for 1. The unchanged base spec with STIG_HARDEN set to 1 in its body fails with error: patch 4 defined multiple times.
• Non-STIG builds are unchanged: the expanded %prep at subrelease 91 and 92 is identical to the base spec's (apart from the source directory path).
• Against systemd-257.13.tar.gz (sha512 matches config.yaml), all six patches apply in rpm's order with patch -p1 --fuzz=0. Result: no GROUP="render" left in rules.d/50-udev-default.rules.in, the systemd-journal sysusers entry present, and units/tmp.mount has Options=mode=1777,strictatime,nosuid,noexec,nodev,....
• check_spec.py --mainline 93 exits 0 at subrelease 91 and 92.

🤖 Generated with Claude Code