[oe-core][PATCHv2] systemd: fix unmerged-bin tainted message

[oe-core][PATCHv2] systemd: fix unmerged-bin tainted message

[rs]

From: Randolph Sapp <rs@ti.com>

Systemd prefers both /bin and /sbin to link to /usr/bin. If this is not
the case it reports that the system is tainted in systemctl status.

Add a link from /usr/sbin to /usr/bin to prevent anything from being
excluded from the merged bin directory. This mimics the current merged
bin directory structure of Arch Linux [1].

Update the systemd recipe to prevent creating a duplicate link when
sbinmerge is enabled.

Override most sbin variables to point to their bin equivalent when
usermerge is enabled, with the exception being base_sbindir_native and
sbindir_native. There is no guarantee the host machine is using this
filesystem scheme.

This check was added to systemd back in 2024 [2].

[1] https://gitlab.archlinux.org/archlinux/packaging/packages/filesystem/-/blob/main/PKGBUILD
[2] https://github.com/systemd/systemd/commit/844863c61e7b501097da84a1e4d1e4a6aa6d9f0d

Signed-off-by: Randolph Sapp <rs@ti.com>
---

v2:
	- Use recommended replacement variable when usermerge is enabled
	- Apply replacement to other relevant variables in this file
	- Keep usrmerge distro feature separate as I believe there is still some
	  merit to mimicking a systemd filesystem in a non-systemd enabled
	  environment, and I didn't hear too much discussion previously

 meta/classes-recipe/populate_sdk_base.bbclass | 5 +++--
 meta/conf/bitbake.conf                        | 8 ++++----
 meta/recipes-core/systemd/systemd_259.5.bb    | 8 ++++++--
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/meta/classes-recipe/populate_sdk_base.bbclass b/meta/classes-recipe/populate_sdk_base.bbclass
index b427ff2761..15f393a3bb 100644
--- a/meta/classes-recipe/populate_sdk_base.bbclass
+++ b/meta/classes-recipe/populate_sdk_base.bbclass
@@ -186,9 +186,10 @@ POPULATE_SDK_POST_HOST_COMMAND:append:task-populate-sdk = " write_host_sdk_manif
 # Prepare the root links to point to the /usr counterparts.
 create_merged_usr_symlinks() {
     root="$1"
-    install -d $root${base_bindir} $root${base_sbindir} $root${base_libdir}
+    install -d $root${base_bindir} $root${base_libdir}
     ln -rs $root${base_bindir} $root/bin
-    ln -rs $root${base_sbindir} $root/sbin
+    ln -rs $root${base_bindir} $root/sbin
+    ln -rs $root${base_bindir} $root/usr/sbin
     ln -rs $root${base_libdir} $root/${baselib}
 
     if [ "${nonarch_base_libdir}" != "${base_libdir}" ]; then
diff --git a/meta/conf/bitbake.conf b/meta/conf/bitbake.conf
index 84450386d9..5d27e70b04 100644
--- a/meta/conf/bitbake.conf
+++ b/meta/conf/bitbake.conf
@@ -22,7 +22,7 @@ root_prefix = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '${exec_prefi
 
 # Base paths
 export base_bindir = "${root_prefix}/bin"
-export base_sbindir = "${root_prefix}/sbin"
+export base_sbindir = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '${base_bindir}', '${root_prefix}/sbin', d)}"
 export base_libdir = "${root_prefix}/${baselib}"
 export nonarch_base_libdir = "${root_prefix}/lib"
 
@@ -43,7 +43,7 @@ export systemd_user_unitdir = "${nonarch_libdir}/systemd/user"
 
 # Architecture dependent paths
 export bindir = "${exec_prefix}/bin"
-export sbindir = "${exec_prefix}/sbin"
+export sbindir = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '${bindir}', '${exec_prefix}/sbin', d)}"
 export libdir = "${exec_prefix}/${baselib}"
 export libexecdir = "${exec_prefix}/libexec"
 export includedir = "${exec_prefix}/include"
@@ -65,9 +65,9 @@ bindir_cross = "/bin"
 bindir_crossscripts = "${bindir}/crossscripts"
 prefix_nativesdk = "/usr"
 bindir_nativesdk = "${prefix_nativesdk}/bin"
-sbindir_nativesdk = "${prefix_nativesdk}/sbin"
+sbindir_nativesdk = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '${bindir_nativesdk}', '${prefix_nativesdk}/sbin', d)}"
 base_bindir_nativesdk = "/bin"
-base_sbindir_nativesdk = "/sbin"
+base_sbindir_nativesdk = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '${base_bindir_nativesdk}', '/sbin', d)}"
 includedir_nativesdk = "${prefix_nativesdk}/include"
 libdir_nativesdk = "${prefix_nativesdk}/lib"
 base_libdir_nativesdk = "/lib"
diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.5.bb
index c3cb605b4d..d84e38d7cd 100644
--- a/meta/recipes-core/systemd/systemd_259.5.bb
+++ b/meta/recipes-core/systemd/systemd_259.5.bb
@@ -69,6 +69,7 @@ PACKAGECONFIG ??= " \
     quotacheck \
     randomseed \
     resolved \
+    sbinmerge \
     serial-getty-generator \
     set-time-epoch \
     sysusers \
@@ -339,8 +340,11 @@ do_install() {
 		install -m 0644 ${UNPACKDIR}/org.freedesktop.hostname1_no_polkit.conf ${D}${datadir}/dbus-1/system.d/
 	fi
 
-	# create link for existing udev rules
-	ln -s ${base_bindir}/udevadm ${D}${base_sbindir}/udevadm
+	# create link for existing udev rules if sbinmerge is not enabled
+	if ${@bb.utils.contains('PACKAGECONFIG', 'sbinmerge', 'false', 'true', d)}
+	then
+		ln -s ${base_bindir}/udevadm ${D}${base_sbindir}/udevadm
+	fi
 
 	# install default policy for presets
 	# https://www.freedesktop.org/wiki/Software/systemd/Preset/#howto
-- 
2.53.0

Re: [oe-core][PATCHv2] systemd: fix unmerged-bin tainted message

[Jörg Sommer]

[-- Attachment #1: Type: text/plain, Size: 2336 bytes --]

rs@ti.com schrieb am Fr 10. Apr, 13:27 (-0500):
> From: Randolph Sapp <rs@ti.com>
> 
> Systemd prefers both /bin and /sbin to link to /usr/bin. If this is not
> the case it reports that the system is tainted in systemctl status.

With this patch net-tools fail to build, but it looks like a fault of
net-tools:

```
| for l in $langs; do \
|     install -c -m 755 -d /build/tmp/work/core2-64-poky-linux/net-tools/2.10/image/usr/share/locale/$l; \
|     install -c -m 755 -d /build/tmp/work/core2-64-poky-linux/net-tools/2.10/image/usr/share/locale/$l/LC_MESSAGES; \
|     install -c -m 644 $l.mo /build/tmp/work/core2-64-poky-linux/net-tools/2.10/image/usr/share/locale/$l/LC_MESSAGES/net-tools.mo; \
| done
| make[1]: Leaving directory '/build/tmp/work/core2-64-poky-linux/net-tools/2.10/sources/net-tools-2.10/po'
| mkdir: cannot create directory ‘/build/tmp/work/core2-64-poky-linux/net-tools/2.10/image//usr/bin’: File exists
| WARNING: exit code 1 from a shell command.
ERROR: Task (/build/../work/layers-3rdparty/oe-core/meta/recipes-extended/net-tools/net-tools_2.10.bb:do_install) failed with exit code '1'
```

do_install() {
…
        if [ "${base_sbindir}" != "/sbin" ]; then
                mkdir ${D}/${base_sbindir}
                mv ${D}/sbin/* ${D}/${base_sbindir}/
                rmdir ${D}/sbin
        fi
}


And atop has this code which does not work anymore:

do_install() {
…
    # remove atopacct related files
    rm -rf ${D}${sbindir} ${D}${mandir}/man8
}

ERROR: atop-2.12.1-r0 do_package: QA Issue: atop: Files/directories were installed but not shipped in any package:
  /usr/sbin/atopacctd
  /usr/sbin/atopgpud
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
atop: 2 installed and not shipped files. [installed-vs-shipped]
ERROR: atop-2.12.1-r0 do_package: Fatal QA errors were found, failing task.
ERROR: Logfile of failure stored in: /build/tmp/work/core2-64-poky-linux/atop/2.12.1/temp/log.do_package.1427030


-- 
Navimatix GmbH           T: 03641 - 327 99 0
Tatzendpromenade 2       F: 03641 - 526 306
07745 Jena               www.navimatix.de

Geschäftsführer: Steffen Späthe, Jan Rommeley
Registergericht: Amtsgericht Jena, HRB 501480

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5000 bytes --]

[PATCH] net-tools: Handle binmerge

[Jörg Sommer]

From: Jörg Sommer <joerg.sommer@navimatix.de>

If $base_sbindir = $base_bindir the sbindir already exists.

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
---
 meta/recipes-extended/net-tools/net-tools_2.10.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/net-tools/net-tools_2.10.bb b/meta/recipes-extended/net-tools/net-tools_2.10.bb
index 6c8297ba39..a21916fb26 100644
--- a/meta/recipes-extended/net-tools/net-tools_2.10.bb
+++ b/meta/recipes-extended/net-tools/net-tools_2.10.bb
@@ -73,7 +73,7 @@ do_install() {
 		rmdir ${D}/bin
 	fi
 	if [ "${base_sbindir}" != "/sbin" ]; then
-		mkdir ${D}/${base_sbindir}
+		mkdir -p ${D}${base_sbindir}
 		mv ${D}/sbin/* ${D}/${base_sbindir}/
 		rmdir ${D}/sbin
 	fi
-- 
2.53.0

Re: [oe-core][PATCHv2] systemd: fix unmerged-bin tainted message

[Mathieu Dubois-Briand]

On Fri Apr 10, 2026 at 8:27 PM CEST, rs wrote:
> From: Randolph Sapp <rs@ti.com>
>
> Systemd prefers both /bin and /sbin to link to /usr/bin. If this is not
> the case it reports that the system is tainted in systemctl status.
>
> Add a link from /usr/sbin to /usr/bin to prevent anything from being
> excluded from the merged bin directory. This mimics the current merged
> bin directory structure of Arch Linux [1].
>
> Update the systemd recipe to prevent creating a duplicate link when
> sbinmerge is enabled.
>
> Override most sbin variables to point to their bin equivalent when
> usermerge is enabled, with the exception being base_sbindir_native and
> sbindir_native. There is no guarantee the host machine is using this
> filesystem scheme.
>
> This check was added to systemd back in 2024 [2].
>
> [1] https://gitlab.archlinux.org/archlinux/packaging/packages/filesystem/-/blob/main/PKGBUILD
> [2] https://github.com/systemd/systemd/commit/844863c61e7b501097da84a1e4d1e4a6aa6d9f0d
>
> Signed-off-by: Randolph Sapp <rs@ti.com>
> ---

Hi Randolph,

Thanks for your patch. This triggering some issues because of missing
folders.

Jörg suggested a fix for net-tools, but we have other failures, at least
one with tcf-agent:

ERROR: tcf-agent-1.9.0-r0 do_package: QA Issue: tcf-agent: Files/directories were installed but not shipped in any package:
  /usr/sbin/tcf-client
  /usr/sbin/tcf-agent
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
tcf-agent: 2 installed and not shipped files. [installed-vs-shipped]

https://autobuilder.yoctoproject.org/valkyrie/#/builders/10/builds/3574
https://autobuilder.yoctoproject.org/valkyrie/#/builders/9/builds/3557

Can you have a look at the issue?

Thanks,
Mathieu


-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com