systemd/postmarketos-base-systemd: add configuration for systemd-resolved

Installing systemd-resolved by default is still probably not a good idea (e.g. until #1430 is fixed, at least?), but this adds config for NM and sd-resolved to get the stub resolver set up automatically when systemd-resolved is installed manually by a user. Part-of: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/6250 [ci:skip-build]: already built successfully in CI
2025-05-06 10:19:38 -07:00
parent 187efa9fac
commit 7a9acf86ec
6 changed files with 38 additions and 4 deletions
@@ -2,8 +2,8 @@
 # Co-maintainer: Clayton Craft <clayton@craftyguy.net>
 # pmbootstrap installs this, if systemd is selected in "pmbootstrap init".
 pkgname=postmarketos-base-systemd
-pkgver=37
-pkgrel=2
+pkgver=38
+pkgrel=0
 pkgdesc="Meta package for running postmarketOS with systemd"
 url="https://postmarketos.org"
 arch="noarch"
@@ -45,16 +45,22 @@ install="
 	$pkgname.post-upgrade
 	$pkgname.pre-upgrade
 	"
+subpackages="
+	$pkgname-resolved
+	"

 _source644="
 	etc/motd.ansi
 	etc/profile.d/99motd.sh
 	etc/systemd/logind.conf
 	usr/share/mkinitfs/files-extra/01-initramfs-base-systemd.files
+	usr/lib/NetworkManager/conf.d/50-dns.conf
 	usr/lib/systemd/system-preset/90-base.preset
 	usr/lib/systemd/system/system.slice.d/10-oomd-defaults.conf
 	usr/lib/systemd/user-preset/90-base.preset
 	usr/lib/systemd/user/slice.d/10-oomd-defaults.conf
+	usr/lib/systemd/resolved.conf.d/disable-dnsovertls.conf
+	usr/lib/systemd/resolved.conf.d/disable-mdns.conf
 "

 _source755="
@@ -82,14 +88,26 @@ package() {
 	touch $pkgdir/etc/motd
 }

+resolved() {
+	install_if="$pkgname=$pkgver-r$pkgrel systemd-resolved"
+	install="$subpkgname.post-install"
+
+	amove usr/lib/systemd/resolved.conf.d/disable-dnsovertls.conf
+	amove usr/lib/systemd/resolved.conf.d/disable-mdns.conf
+	amove usr/lib/NetworkManager/conf.d/50-dns.conf
+}
+
 sha512sums="
 793ee54a0313a0a20664e8dd90561376b3d5f9b870d292a77ab8fc7507f7f5c6d648e7de6ee98916be3702fcdaac5ca8b3648b33503547e419d0fe683bf77baa  rootfs-etc-motd.ansi
 fbaa33425e507062a454f11bda48508f261c2144e5c23a20f567dc1cef14ce1dec57f8d934f418f5b6095509757f8503481aba9790a04c8f9f6995e65833d8c9  rootfs-etc-profile.d-99motd.sh
 2faac294bb632762e247b850f09ff4b544ccff6c462efd8d4faca71ba30bdfa9c460377a0dc88e92c5dbbe251017d164064a56ac0e0410f224b45d4f5f81866c  rootfs-etc-systemd-logind.conf
 15423bfda57c90ab62fe69865ca4072a0aeb83bf77d9c278257e346f4da81843d010b41003c91ae9f3fcb1c67447645e7c19078eea2bf11312051e6ad7523ad1  rootfs-usr-share-mkinitfs-files-extra-01-initramfs-base-systemd.files
-eeeaf2496fbab9591bba10c145939608166d20b742a9724f65b47abc3ac2880f2492be9c9369ca3d862f063fc6aadf77af3b8cea1ee682d58ef617cc83a22fdb  rootfs-usr-lib-systemd-system-preset-90-base.preset
+94063e3a3f983b7613d9de6bfc067096f79b12688f45667faf968f9a9bae194c4c8e554311f2ab5614edcc4d4499f6d30aa965a67b7417c26ce4d07edc847178  rootfs-usr-lib-NetworkManager-conf.d-50-dns.conf
+0b696053b243cf85464c4d27a428fa80359da768c60e64651027822544293198fcb7219109f38f92cfb50a9609e446b25503a3bdcf9a004dc1490300e1c5d100  rootfs-usr-lib-systemd-system-preset-90-base.preset
 1458d526e3d68c052126f648a33c3f22af10e3a4d479dded824c2b18b2022b43232ea6f8c2061f051927b2d612750017a2ecf7e1a19680b71ca2dc112d5bd3f6  rootfs-usr-lib-systemd-system-system.slice.d-10-oomd-defaults.conf
 9e8cdbe2b1d501f2026d81bd6e23ffe44a64cd46c4da1879c30cc1dc5871abec20e927caa1eb43bd37ede00152b8555ace0cfb0955dab49a9de077fc5de5d6cb  rootfs-usr-lib-systemd-user-preset-90-base.preset
 1458d526e3d68c052126f648a33c3f22af10e3a4d479dded824c2b18b2022b43232ea6f8c2061f051927b2d612750017a2ecf7e1a19680b71ca2dc112d5bd3f6  rootfs-usr-lib-systemd-user-slice.d-10-oomd-defaults.conf
+e49972d276441e9da284315bab5f70d8d25ccba5e43d7e7ec6607c34a3d4dfa512f7303d5ce41076819ef24f5dced5acc74001b4d569258269de34da27912466  rootfs-usr-lib-systemd-resolved.conf.d-disable-dnsovertls.conf
+93ab180810dbd2a1477f7ea0f0959be90f099272fe5840030a0772771c97a066b70068c476d32c6a4610b8f7b9fc5bfcf1d7a93f071cec026553ac6a3b8b5324  rootfs-usr-lib-systemd-resolved.conf.d-disable-mdns.conf
 605df1f004783d2e0ec5dd99a688bca27502c8c24bc05fb4dc26589b2070b0fbd1cf9bd56e6861d7cda2f8ac8147e7eb040acfd886185c01c8cf9de8b1ce2dcd  rootfs-usr-bin-setup-timezone
 "
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+[ "$(realpath /etc/resolv.conf)" == /run/systemd/resolve/stub-resolv.conf ] && exit 0
+rm -f /etc/resolv.conf
+ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
@@ -0,0 +1,3 @@
+[main]
+dns=systemd-resolved
+rc-manager=auto
@@ -0,0 +1,5 @@
+[Resolve]
+# This requires a DNS server that supports it. Disabling it instead of setting
+# to "opportunistic", since the latter can be defeated with a downgrade attack and
+# that gives a false sense of security.
+DNSOverTLS=no
@@ -0,0 +1,4 @@
+[Resolve]
+# CUPS doesn't work with systemd-resolved's mdns:
+# https://github.com/OpenPrinting/libcups/issues/81
+MulticastDNS=no
@@ -1,7 +1,6 @@
 # overrides for systemd
 disable systemd-network*
 disable systemd-homed*
-disable systemd-resolved*
 disable systemd-journald-audit.socket

 # starting multipathd on systems with no multipath hardware can soft-hang