systemd中文文档 - 启动: http://systemd.cn/docs/Booting/ - 自动启动评估: http://systemd.cn/docs/Booting/AUTOMATIC_BOOT_ASSESSMENT/ - 启动组件和根文件系统探测: http://systemd.cn/docs/Booting/ROOTFS_DISCOVERY/ - 引导加载程序接口: http://systemd.cn/docs/Booting/BOOT_LOADER_INTERFACE/ - 恢复出厂设置: http://systemd.cn/docs/Booting/FACTORY_RESET/ - 挂载点可用性要求: http://systemd.cn/docs/Booting/MOUNT_REQUIREMENTS/ - TPM2 PCR测量: http://systemd.cn/docs/Booting/TPM2_PCR_MEASUREMENTS/ - Boot Loader Specification: http://systemd.cn/docs/BOOT_LOADER_SPECIFICATION/ - Discoverable Partitions: http://systemd.cn/docs/DISCOVERABLE_PARTITIONS/ - Elf Dlopen Metadata: http://systemd.cn/docs/ELF_DLOPEN_METADATA/ - Osc Context: http://systemd.cn/docs/OSC_CONTEXT/ - Package Metadata for Executable Files: http://systemd.cn/docs/PACKAGE_METADATA_FOR_EXECUTABLE_FILES/ - API File Systems: http://systemd.cn/docs/API_FILE_SYSTEMS/ - Appstream Bundle: http://systemd.cn/docs/APPSTREAM_BUNDLE/ - Backports: http://systemd.cn/docs/BACKPORTS/ - Booting Without /usr is Broken: http://systemd.cn/docs/SEPARATE_USR_IS_BROKEN/ - Code Quality Tools: http://systemd.cn/docs/CODE_QUALITY/ - Coding Style: http://systemd.cn/docs/CODING_STYLE/ - Compatibility with SysV: http://systemd.cn/docs/INCOMPATIBILITIES/ - Container Interface: http://systemd.cn/docs/CONTAINER_INTERFACE/ - Contributing: http://systemd.cn/docs/CONTRIBUTING/ - Control Group APIs and Delegation: http://systemd.cn/docs/CGROUP_DELEGATION/ - Converting Existing Users to systemd-homed: http://systemd.cn/docs/CONVERTING_TO_HOMED/ - Credentials: http://systemd.cn/docs/CREDENTIALS/ - Desktop Environment Integration: http://systemd.cn/docs/DESKTOP_ENVIRONMENTS/ - Diagnosing Boot Problems: http://systemd.cn/docs/DEBUGGING/ - File Descriptor Store: http://systemd.cn/docs/FILE_DESCRIPTOR_STORE/ - Frequently Asked Questions: http://systemd.cn/docs/FAQ/ - Governance: http://systemd.cn/docs/GOVERNANCE/ - Hacking on systemd: http://systemd.cn/docs/HACKING/ - Home Directories: http://systemd.cn/docs/HOME_DIRECTORY/ - Inhibitor Locks: http://systemd.cn/docs/INHIBITOR_LOCKS/ - Initrd Interface: http://systemd.cn/docs/INITRD_INTERFACE/ - Journal Export Formats: http://systemd.cn/docs/JOURNAL_EXPORT_FORMATS/ - Journal File Format: http://systemd.cn/docs/JOURNAL_FILE_FORMAT/ - Journal Message Catalogs: http://systemd.cn/docs/CATALOG/ - JSON Group Records: http://systemd.cn/docs/GROUP_RECORD/ - JSON User Records: http://systemd.cn/docs/USER_RECORD/ - Known Environment Variables: http://systemd.cn/docs/ENVIRONMENT/ - Locking Block Device Access: http://systemd.cn/docs/BLOCK_DEVICE_LOCKING/ - Minimal Builds: http://systemd.cn/docs/MINIMAL_BUILDS/ - My Service Can't Get Realtime!: http://systemd.cn/docs/MY_SERVICE_CANT_GET_REALTIME/ - Native Journal Protocol: http://systemd.cn/docs/JOURNAL_NATIVE_PROTOCOL/ - New Control Group Interfaces: http://systemd.cn/docs/CONTROL_GROUP_INTERFACE/ - Notes for Translators: http://systemd.cn/docs/TRANSLATORS/ - Password Agents: http://systemd.cn/docs/PASSWORD_AGENTS/ - Pax Controla Groupiana: http://systemd.cn/docs/PAX_CONTROL_GROUPS/ - Portability and Stability: http://systemd.cn/docs/PORTABILITY_AND_STABILITY/ - Portable Services Introduction: http://systemd.cn/docs/PORTABLE_SERVICES/ - Porting systemd To New Distributions: http://systemd.cn/docs/DISTRO_PORTING/ - Porting to New Architectures: http://systemd.cn/docs/PORTING_TO_NEW_ARCHITECTURES/ - Predictable Network Interface Names: http://systemd.cn/docs/PREDICTABLE_INTERFACE_NAMES/ - Presets: http://systemd.cn/docs/PRESET/ - Project IDs for Disk Quotas on Exec Directories: http://systemd.cn/docs/DISK-QUOTAS-PROJECTIDS/ - Random Seeds: http://systemd.cn/docs/RANDOM_SEEDS/ - Reporting of Security Vulnerabilities: http://systemd.cn/docs/SECURITY/ - Resource Pressure Handling: http://systemd.cn/docs/PRESSURE/ - Running Services After the Network Is Up: http://systemd.cn/docs/NETWORK_ONLINE/ - Safely Building Images: http://systemd.cn/docs/BUILDING_IMAGES/ - Socket Activation with Popular Daemons: http://systemd.cn/docs/DAEMON_SOCKET_ACTIVATION/ - Steps to a Successful Release: http://systemd.cn/docs/RELEASE/ - Storage Daemons for the Root File System: http://systemd.cn/docs/ROOT_STORAGE_DAEMONS/ - systemd Community Conduct Guidelines: http://systemd.cn/docs/CODE_OF_CONDUCT/ - systemd Coredump Handling: http://systemd.cn/docs/COREDUMP/ - systemd File Hierarchy Requirements: http://systemd.cn/docs/SYSTEMD_FILE_HIERARCHY_REQUIREMENTS/ - systemd Optimizations: http://systemd.cn/docs/OPTIMIZATIONS/ - systemd Repository Architecture: http://systemd.cn/docs/ARCHITECTURE/ - systemd-boot UEFI Boot Manager: http://systemd.cn/docs/BOOT/ - systemd-homed and JSON User/Group Record Support in Desktop Environments: http://systemd.cn/docs/USERDB_AND_DESKTOPS/ - systemd-resolved and VPNs: http://systemd.cn/docs/RESOLVED-VPNS/ - Testing systemd Using Sanitizers: http://systemd.cn/docs/TESTING_WITH_SANITIZERS/ - The Case for the /usr Merge: http://systemd.cn/docs/THE_CASE_FOR_THE_USR_MERGE/ - Tips And Tricks: http://systemd.cn/docs/TIPS_AND_TRICKS/ - User Record Blob Directories: http://systemd.cn/docs/USER_RECORD_BLOB_DIRS/ - User/Group Name Syntax: http://systemd.cn/docs/USER_NAMES/ - User/Group Record Lookup API via Varlink: http://systemd.cn/docs/USER_GROUP_API/ - Users, Groups, UIDs and GIDs on systemd Systems: http://systemd.cn/docs/UIDS-GIDS/ - Using /tmp/ and /var/tmp/ Safely: http://systemd.cn/docs/TEMPORARY_DIRECTORIES/ - Varlink API Style: http://systemd.cn/docs/VARLINK/ - VM Interface: http://systemd.cn/docs/VM_INTERFACE/ - What Settings Are Currently Available For Transient Units?: http://systemd.cn/docs/TRANSIENT-SETTINGS/ - Writing Desktop Environments: http://systemd.cn/docs/WRITING_DESKTOP_ENVIRONMENTS/ - Writing Display Managers: http://systemd.cn/docs/WRITING_DISPLAY_MANAGERS/ - Writing Network Configuration Managers: http://systemd.cn/docs/WRITING_NETWORK_CONFIGURATION_MANAGERS/ - Writing Resolver Clients: http://systemd.cn/docs/WRITING_RESOLVER_CLIENTS/ - Writing syslog Daemons Which Cooperate Nicely With systemd: http://systemd.cn/docs/SYSLOG/ - Writing VM and Container Managers: http://systemd.cn/docs/WRITING_VM_AND_CONTAINER_MANAGERS/ # Converting Existing Users to systemd-homed managed Users Traditionally on most Linux distributions, regular (human) users are managed via entries in `/etc/passwd`, `/etc/shadow`, `/etc/group` and `/etc/gshadow`. With the advent of [`systemd-homed`](https://www.freedesktop.org/software/systemd/man/latest/systemd-homed.service.html) it might be desirable to convert an existing, traditional user account to a `systemd-homed` managed one. Below is a brief guide how to do that. Before continuing, please read up on these basic concepts: * [Home Directories](/HOME_DIRECTORY) * [JSON User Records](/USER_RECORD) * [JSON Group Records](/GROUP_RECORD) * [User/Group Record Lookup API via Varlink](/USER_GROUP_API) ## Caveat This is a manual process, and possibly a bit fragile. Hence, do this at your own risk, read up beforehand, and make a backup first. You know what's at stake: your own home directory, i.e. all your personal data. ## Step-By-Step Here's the step-by-step guide: 0. Preparations: make sure you run a distribution that has `systemd-homed` enabled and properly set up, including the necessary PAM and NSS configuration updates. Make sure you have enough disk space in `/home/` for a (temporary) second copy of your home directory. Make sure to backup your home directory. Make sure to log out of your user account fully. Then log in as root on the console. 1. Rename your existing home directory to something safe. Let's say your user ID is `foobar`. Then do: ``` mv /home/foobar /home/foobar.saved ``` 2. Have a look at your existing user record, as stored in `/etc/passwd` and related files. We want to use the same data for the new record, hence it's good looking at the old data. Use commands such as: ``` getent passwd foobar getent shadow foobar ``` This will tell you the `/etc/passwd` and `/etc/shadow` entries for your user. For details about the fields, see the respective man pages [passwd(5)](https://man7.org/linux/man-pages/man5/passwd.5.html) and [shadow(5)](https://man7.org/linux/man-pages/man5/shadow.5.html). The fourth field in the `getent passwd foobar` output tells you the GID of your user's main group. Depending on your distribution it's a group private to the user, or a group shared by most local, regular users. Let's say the GID reported is 1000, let's then query its details: ``` getent group 1000 ``` This will tell you the name of that group. If the name is the same as your user name your distribution apparently provided you with a private group for your user. If it doesn't match (and is something like `users`) it apparently didn't. Note that `systemd-homed` will always manage a private group for each user under the same name, hence if your distribution is one of the latter kind, then there's a (minor) mismatch in structure when converting. Save the information reported by these three commands somewhere, for later reference. 3. Now edit your `/etc/passwd` file and remove your existing record (i.e. delete a single line, the one of your user's account, leaving all other lines unmodified). Similar for `/etc/shadow`, `/etc/group` (in case you have a private group for your user) and `/etc/gshadow`. Most distributions provide you with a tool for that, that adds safe synchronization for these changes: `vipw`, `vipw -s`, `vigr` and `vigr -s`. 4. At this point the old user account vanished, while the home directory still exists safely under the `/home/foobar.saved` name. Let's now create a new account with `systemd-homed`, using the same username and UID as before: ```sh homectl create foobar --uid=$UID --real-name=$GECOS ``` In this command line, replace `$UID` by the UID you previously used, i.e. the third field of the `getent passwd foobar` output above. Similar, replace `$GECOS` by the GECOS field of your old account, i.e the fifth field of the old output. If your distribution traditionally does not assign a private group to regular user groups, then consider adding `--member-of=` with the group name to get a modicum of compatibility with the status quo ante: this way your new user account will still not have the old primary group as new primary group, but will have it as auxiliary group. Consider reading through the [homectl(1)](https://www.freedesktop.org/software/systemd/man/latest/homectl.html) manual page at this point, maybe there are a couple of other settings you want to set for your new account. In particular, look at `--storage=` and `--disk-size=`, in order to change how your home directory shall be stored (the default `luks` storage is recommended). 1. Your new user account exists now, but it has an empty home directory. Let's now migrate your old home directory into it. For that let's mount the new home directory temporarily and copy the data in. ``` homectl with foobar -- rsync -aHANUXv --remove-source-files /home/foobar.saved/ . ``` This mounts the home directory of the user, and then runs the specified `rsync` command which copies the contents of the old home directory into the new. The new home directory is the working directory of the invoked `rsync` process. We are invoking this command as root, hence the `rsync` runs as root too. When the `rsync` command completes the home directory is automatically unmounted again. Since we used `--remove-source-files` all files copied are removed from the old home directory as the copy progresses. After the command completes the old home directory should be empty. Let's remove it hence: ``` rmdir /home/foobar.saved ``` And that's it, we are done already. You can log out now and should be able to log in under your user account as usual, but now with `systemd-homed` managing your home directory.