SUSE-RU-2024:0181-1: Recommended update for systemd
This update for systemd fixes the following issues: man: document that PAMName= and NotifyAccess=all don't mix well man: add brief documentation for the (sd-pam) processes created due to PAMName= service: accept the fact that the three xyzgood() functions return ints service: drop pure decorator on static function service: a cgroup empty notification isn't reason enough to go down (bsc#1212207) service: add explanatory comments to controlpidgood() and cgroupgood() service: fix mainpidgood() comment utmp-wtmp: handle EINTR gracefully when waiting to write to tty utmp-wtmp: fix error in case isatty() fails sd-netlink: handle EINTR from poll() gracefully, as success stdio-bridge: don't be bothered with EINTR sd-bus: handle -EINTR return from buspoll() (bsc#1215241) libsystemd: ignore both EINTR and EAGAIN errno-util: introduce ERRNOISTRANSIENT() man/systemd-fsck@.service: clarify passno and noauto combination in /etc/fstab (bsc#1211725) units/initrd-parse-etc.service: Conflict with emergency.target umount: /usr/ should never be unmounted regardless of HAVESPLITUSR or not (bsc#1211576) core/mount: Don't unmount initramfs mounts man: describe that changing Storage= does not move existing data
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/systemd-develto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libudev-develto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/systemd-debuginfoto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/systemd-debugsourceto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/udevto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/systemd-sysvinitto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libsystemd0-debuginfoto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/udev-debuginfoto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libudev1-debuginfoto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/systemd-bash-completionto a version that resolves this vulnerability.Fixed in 228-157.57.1 - Upgrade
Upgrade
suse/libudev1-debuginfoto a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade
suse/libsystemd0-debuginfoto a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade
suse/systemdto a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade
suse/systemd-debuginfoto a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade
suse/libsystemd0to a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade
suse/libudev1to a version that resolves this vulnerability.Fixed in 32bit-228-157.57.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-181=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-181=1
Event History
Frequently Asked Questions
Which packages are included in this update?
The update covers systemd, libsystemd0, libudev1, systemd-devel, libudev-devel, and the corresponding systemd-debuginfo, libsystemd0-debuginfo, and libudev1-debuginfo packages.
What operational issues does the update address besides documentation changes?
It includes fixes for interrupted system calls in utmp-wtmp, sd-netlink, stdio-bridge, and sd-bus; cgroup-empty notification handling; initramfs and /usr unmount behavior; and initrd parsing conflicts with emergency.target.
Are PAMName= and NotifyAccess=all expected to work well together?
No. The update documentation states that PAMName= and NotifyAccess=all do not mix well, and also documents sd-pam processes created when PAMName= is used.