systemd 257.13-7: fix render/systemd-journal group regressions and repair the STIG build variant

[dcasota]

Five defects in SPECS/systemd, split across two release bumps because they affect different constellations.

Constellation map

Defect	Affected constellation	Symptom
dangling accel/render udev rule	every install, all arches, all ISO types	50-udev-default.rules:56 Unknown group 'render', ignoring. each boot
emptied systemd-journal sysusers snippet	every install on 5.0 since the dracut 109 bump	5x Failed to resolve group 'systemd-journal' from inside the initrd, each boot
unpinned journal GID	any build once the snippet is restored	systemd-sysusers allocates an arbitrary GID in the initrd
missing harden-tmpfs-mount-options.patch	STIG_HARDEN=1 only	build fails on a missing source
duplicate Patch4:	STIG_HARDEN=1 only	error: patch 4 defined multiple times, no %prep emitted

The last two are why nobody noticed: STIG_HARDEN is pinned to 0 by a spec-body define that beats -D, so that whole variant has never been parsed, built or tested.

257.13-6 — two group regressions

render. 0004-Remove-unused-default-groups-rules-and-tmpfiles.patch deletes the render group from sysusers.d/basic.conf.in and removes the drm/kfd rules, but left SUBSYSTEM=="accel", GROUP="render" as a context line. systemd 253 had no accel rule — the regression arrived with the 253→257 rebase. Upstream dev (255.10) already deletes it. Extended the deletion hunk.

systemd-journal. Not missing from the system — it exists at GID 23 from filesystem's group file. It is missing from the initrd, and only since dracut 109. dracut 109 builds the initrd's /etc/group by running systemd-sysusers against the shipped snippets (11systemd-journald → inst_sysusers systemd-journal.conf; 78systemd-sysusers → systemd-sysusers --root=$initdir). Patch 0004 empties that snippet, so it is a no-op — while 11systemd-tmpfiles still installs tmpfiles.d/systemd.conf, which references the group on lines 22, 23, 27, 28, 29. Exactly the five errors seen per boot. dracut 059 copied the group in explicitly, so this was harmless until the 109 bump.

Fixed at the root by restoring the sysusers entry, plus pinning -Dsystemd-journal-gid=23, which is required: meson.build:963 is conf.set(name, val > 0 ? val : '-') and meson_options.txt:320 defaults it to 0, so without the pin the GID would be dynamic and /run/log/journal would be mis-owned across switch-root.

257.13-7 — repair the STIG build variant

harden-tmpfs-mount-options.patch was referenced by the conditional but lived only in SPECS/90/systemd/; it was dropped from this directory in 17c93651f "systemd: upgrade to v257.13". Shipped here, and verified to apply cleanly to 257.13.

%define STIG_HARDEN 0 → %{!?STIG_HARDEN: %global STIG_HARDEN 0}, so the flag is settable from pkg_build_options.json / -D. Verified: a spec-body define beats --define, which is why the variant was unreachable.

Patch list converted to unnumbered Patch:. Two independent edits had both chosen index 4. Auto-numbering removes the collision class, not just this instance.

Why the tmpfs patch belongs here and not in ansible

/lib/systemd/system/tmp.mount is owned by this package and is not marked as a config file. An install-time edit would show as permanent rpm -V drift and be reverted by the next systemd upgrade. That is why photon-os-installer deliberately skips the equivalent ansible control PHTN-50-000245 (stigenable.py:17, since the feature landed in Dec 2023). This is the owning side of that split — a comment in the spec now says so, to stop someone "fixing" the skip.

Worth knowing: because the owning side was dead, neither side delivered the control. On a freshly installed 5.0 VM, /tmp is mounted rw,nosuid,nodev — no noexec.

Testing

Non-STIG builds are unchanged. Expanded %prep diffed before vs after at subrelease 91 and 92: byte-identical in both. The only preamble change is the Patch0:→Patch: spelling.

Parse matrix, all OK:

subrelease	STIG_HARDEN	parse	Source2 selected
91	unset	OK	50-security-hardening.conf
91	0	OK	50-security-hardening.conf
91	1	OK	50-security-hardening.stig.conf
92	unset / 0 / 1	OK	same pattern

Patch application against the real 257.13 tarball, in rpm's auto-numbered order — all six apply, no fuzz:

0001-enoX-uses-instance-number-for-vmware-hv.patch         OK
0002-Fetch-dns-servers-from-environment.patch              OK
0003-systemd-do-not-use-ftrivial-auto-var-init-zero.patch  OK
0004-Remove-unused-default-groups-rules-and-tmpfiles.patch OK
0005-default-conf-modifications.patch                      OK
harden-tmpfs-mount-options.patch                           OK

Post-application state: Options=mode=1777,strictatime,nosuid,noexec,nodev,... (control delivered), zero surviving GROUP="render", systemd-journal sysusers entry present.

support/spec-checker/check_spec.py exits 0.

Both group regressions are identical upstream on vmware/photon@5.0.