Am 24.07.2016 um 14:12 schrieb Michael Biebl: > Package: release.debian.org > Severity: normal > Tags: jessie > User: release.debian....@packages.debian.org > Usertags: pu > > Dear release team, > > for the upcoming jessie stable release, I'd like to update the systemd > package with the following fixes:
[..] > The complete debdiff is attached as well. I would like to include one more fix. The request for that came up just today, see [1]. Sorry for the bad timing. It's an upstream commit [2] which is part of v230 and ensures correct shutdown order and kills the user sessions before the network stack is stopped. This is needed for open SSH connections to be terminated cleanly. For this commit to apply cleanly, it also requires upstream commit [3], which seems like a reasonable change as well. An updated debdiff is attached. Please let me know if you are ok with this updated debdiff. Regards, Michael [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832155#50 [2] https://github.com/systemd/systemd/commit/8c856804780681e135d98ca94d08afe247557770 [3] https://github.com/systemd/systemd/commit/efb3e19be9c568974b221990b9e84fb5304c5537 -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
diff --git a/debian/changelog b/debian/changelog
index 974bbb0..3f0f176 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+systemd (215-17+deb8u5) stable; urgency=medium
+
+ * Use the right timeout for stop processes we fork. This ensures that
+ services are properly killed after a given timeout. (Closes: #813702)
+ * Re-enable fsck -l. This avoids that systemd-fsck runs fsck in parallel for
+ file systems on the same disk. Parallel fsck can lead to suboptimal
+ behaviour on rotational hard disks. This requires util-linux 2.25, so bump
+ the dependency accordingly. (Closes: #824963)
+ * Don't reset log level to NOTICE if we get quiet on the kernel cmdline.
+ (Closes: #828006)
+ * Fix prepare priority queue comparison function in sd-event.
+ Otherwise a disabled event source can get swapped with an enabled one
+ and cause a severe sd-event malfunction, breaking the event loop.
+ (Closes: #789796)
+ * Update links to kernel.org cgroup documentation.
+ The systemd.resource-control man page had references to /cgroups/ which
+ moved to /cgroup-v1/. (Closes: #819970)
+ * Don't start console-getty.service when /dev/console is missing.
+ Avoids repeated unsuccessful start attempts of agetty inside (docker)
+ containers. (Closes: #829537)
+ * Order systemd-user-sessions.service after nss-user-lookup.target. We
+ should not allow logins before NIS/LDAP users are available.
+ * Order systemd-user-sessions.service after network.target. That way we can
+ be sure that local users are logged out and SSH sessions are ended cleanly
+ before the network is shut down when the system goes down.
+
+ -- Michael Biebl <bi...@debian.org> Sun, 24 Jul 2016 18:55:54 +0200
+
systemd (215-17+deb8u4) stable; urgency=medium
[ Martin Pitt ]
diff --git a/debian/control b/debian/control
index aa02024..cdcc5a4 100644
--- a/debian/control
+++ b/debian/control
@@ -51,7 +51,7 @@ Pre-Depends: ${shlibs:Pre-Depends},
Depends: ${shlibs:Depends},
${misc:Depends},
libsystemd0 (= ${binary:Version}),
- util-linux (>= 2.19.1-2),
+ util-linux (>= 2.25),
mount (>= 2.21),
initscripts (>= 2.88dsf-53.2),
sysv-rc,
diff --git a/debian/extra/getty-static.service
b/debian/extra/getty-static.service
index 8636be5..0a1203f 100644
--- a/debian/extra/getty-static.service
+++ b/debian/extra/getty-static.service
@@ -1,6 +1,6 @@
[Unit]
Description=getty on tty2-tty6 if dbus and logind are not available
-ConditionPathExists=/dev/tty2
+ConditionPathExists=/dev/tty0
ConditionPathExists=!/lib/systemd/system/dbus.service
[Service]
diff --git
a/debian/patches/console-getty.service-don-t-start-when-dev-console-is-mis.patch
b/debian/patches/console-getty.service-don-t-start-when-dev-console-is-mis.patch
new file mode 100644
index 0000000..02eb1ca
--- /dev/null
+++
b/debian/patches/console-getty.service-don-t-start-when-dev-console-is-mis.patch
@@ -0,0 +1,49 @@
+From: Jan Pazdziora <jpazdzi...@redhat.com>
+Date: Fri, 13 Mar 2015 12:57:18 +0100
+Subject: console-getty.service: don't start when /dev/console is missing
+
+Create minimal image which runs systemd
+
+ FROM rhel7.1
+ RUN yum install -y /usr/bin/ps
+ ENV container docker
+ CMD [ "/usr/sbin/init" ]
+
+When you run the container without -t, the process
+
+ /sbin/agetty --noclear --keep-baud console 115200 38400 9600
+
+is not happy and checking the journal in the container, there is a stream of
+
+Mar 13 04:50:15 11bf07f59fff agetty[66]: /dev/console: No such file or
directory
+Mar 13 04:50:25 11bf07f59fff systemd[1]: console-getty.service holdoff time
over, scheduling restart.
+Mar 13 04:50:25 11bf07f59fff systemd[1]: Stopping Console Getty...
+Mar 13 04:50:25 11bf07f59fff systemd[1]: Starting Console Getty...
+Mar 13 04:50:25 11bf07f59fff systemd[1]: Started Console Getty.
+Mar 13 04:50:25 11bf07f59fff agetty[67]: /dev/console: No such file or
directory
+Mar 13 04:50:35 11bf07f59fff systemd[1]: console-getty.service holdoff time
over, scheduling restart.
+Mar 13 04:50:35 11bf07f59fff systemd[1]: Stopping Console Getty...
+Mar 13 04:50:35 11bf07f59fff systemd[1]: Starting Console Getty...
+Mar 13 04:50:35 11bf07f59fff systemd[1]: Started Console Getty.
+Mar 13 04:50:35 11bf07f59fff agetty[74]: /dev/console: No such file or
directory
+Mar 13 04:50:45 11bf07f59fff systemd[1]: console-getty.service holdoff time
over, scheduling restart.
+Mar 13 04:50:45 11bf07f59fff systemd[1]: Stopping Console Getty...
+Mar 13 04:50:45 11bf07f59fff systemd[1]: Starting Console Getty...
+
+(cherry-picked from commit 1b41981d9a62443d566df6bcabc1b5024e9f5e4a)
+---
+ units/console-getty.service.m4.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/units/console-getty.service.m4.in
b/units/console-getty.service.m4.in
+index 8ac51a4..413d940 100644
+--- a/units/console-getty.service.m4.in
++++ b/units/console-getty.service.m4.in
+@@ -9,6 +9,7 @@
+ Description=Console Getty
+ Documentation=man:agetty(8)
+ After=systemd-user-sessions.service plymouth-quit-wait.service
++ConditionPathExists=/dev/console
+ m4_ifdef(`HAVE_SYSV_COMPAT',
+ After=rc-local.service
+ )m4_dnl
diff --git
a/debian/patches/core-don-t-reset-log-level-to-NOTICE-if-we-get-quiet-on-t.patch
b/debian/patches/core-don-t-reset-log-level-to-NOTICE-if-we-get-quiet-on-t.patch
new file mode 100644
index 0000000..551d8c5
--- /dev/null
+++
b/debian/patches/core-don-t-reset-log-level-to-NOTICE-if-we-get-quiet-on-t.patch
@@ -0,0 +1,40 @@
+From: Lennart Poettering <lenn...@poettering.net>
+Date: Wed, 4 Feb 2015 01:42:49 +0100
+Subject: core: don't reset log level to NOTICE if we get quiet on the kernel
+ cmdline
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+quiet should really just have an effect on the stuff we dump on the
+console, not what we log elsewhere.
+
+Hence:
+
+ debug on kernel cmdline → interpreted by every tool, turns up
+ log levels to "debug" everywhere.
+
+ quiet on kernel cmdline → interpreted only by PID 1 (and
+ obviously the kernel) no alteration of the max log level, but
+ turns off status output.
+
+http://lists.freedesktop.org/archives/systemd-devel/2014-December/026271.html
+
+(cherry-picked from commit 5e07a79e84ab8b045b9df1a2719f14fc84471a1d)
+---
+ src/core/main.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/core/main.c b/src/core/main.c
+index 904cdb8..7ad4bb0 100644
+--- a/src/core/main.c
++++ b/src/core/main.c
+@@ -377,8 +377,6 @@ static int parse_proc_cmdline_item(const char *key, const
char *value) {
+
+ } else if (streq(key, "quiet") && !value) {
+
+- log_set_max_level(LOG_NOTICE);
+-
+ if (arg_show_status == _SHOW_STATUS_UNSET)
+ arg_show_status = SHOW_STATUS_AUTO;
+
diff --git a/debian/patches/fsck-re-enable-fsck-l.patch
b/debian/patches/fsck-re-enable-fsck-l.patch
new file mode 100644
index 0000000..5097620
--- /dev/null
+++ b/debian/patches/fsck-re-enable-fsck-l.patch
@@ -0,0 +1,55 @@
+From: Karel Zak <k...@redhat.com>
+Date: Wed, 22 Oct 2014 10:28:42 +0200
+Subject: fsck: re-enable fsck -l
+
+The -l (lock) has been temporary disabled due to conflict with
+udev (https://bugs.freedesktop.org/show_bug.cgi?id=79576)
+
+The problem is fixed since util-linux v2.25 (Jul 2014).
+
+(cherry-picked from commit 48d3e8d07f2978f001cc85b2dddb7f8ec9d07006)
+---
+ README | 3 ++-
+ src/fsck/fsck.c | 13 ++++---------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/README b/README
+index b554562..36c8c56 100644
+--- a/README
++++ b/README
+@@ -128,8 +128,9 @@ REQUIREMENTS:
+ During runtime, you need the following additional
+ dependencies:
+
+- util-linux >= v2.19 (requires fsck -l, agetty -s),
++ util-linux >= v2.19 required for agetty -s
+ v2.21 required for tests in test/
++ v2.25 required for fsck -l
+ dbus >= 1.4.0 (strictly speaking optional, but recommended)
+ sulogin (from util-linux >= 2.22 or sysvinit-tools, optional but
recommended,
+ required for tests in test/)
+diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
+index e8596d9..e677e09 100644
+--- a/src/fsck/fsck.c
++++ b/src/fsck/fsck.c
+@@ -320,16 +320,11 @@ int main(int argc, char *argv[]) {
+ cmdline[i++] = "-T";
+
+ /*
+- * Disable locking which conflict with udev's event
+- * ownershipi, until util-linux moves the flock
+- * synchronization file which prevents multiple fsck running
+- * on the same rotationg media, from the disk device
+- * node to a privately owned regular file.
+- *
+- * https://bugs.freedesktop.org/show_bug.cgi?id=79576#c5
+- *
+- * cmdline[i++] = "-l";
++ * Since util-linux v2.25 fsck uses /run/fsck/<diskname>.lock files.
++ * The previous versions use flock for the device and conflict with
++ * udevd, see https://bugs.freedesktop.org/show_bug.cgi?id=79576#c5
+ */
++ cmdline[i++] = "-l";
+
+ if (!root_directory)
+ cmdline[i++] = "-M";
diff --git
a/debian/patches/man-update-links-to-kernel.org-cgroup-documentation.patch
b/debian/patches/man-update-links-to-kernel.org-cgroup-documentation.patch
new file mode 100644
index 0000000..4d106ff
--- /dev/null
+++ b/debian/patches/man-update-links-to-kernel.org-cgroup-documentation.patch
@@ -0,0 +1,77 @@
+From: Martin Pitt <martin.p...@ubuntu.com>
+Date: Tue, 5 Apr 2016 10:48:06 +0200
+Subject: man: update links to kernel.org cgroup documentation
+
+This recently moved from /cgroups/ to /cgroup-v1/.
+
+Fixes #2958
+
+(cherry-picked from commit c51fa94772d85f2a2442d6bcecb5efc4c102ff34)
+---
+ man/systemd.resource-control.xml | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/man/systemd.resource-control.xml
b/man/systemd.resource-control.xml
+index e91c260..19c6d85 100644
+--- a/man/systemd.resource-control.xml
++++ b/man/systemd.resource-control.xml
+@@ -191,7 +191,7 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+ <literal>memory.limit_in_bytes</literal> control group
+ attribute. For details about this control group attribute,
+ see <ulink
+-
url="https://www.kernel.org/doc/Documentation/cgroups/memory.txt";>memory.txt</ulink>.</para>
++
url="https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt";>memory.txt</ulink>.</para>
+
+ <para>Implies <literal>MemoryAccounting=true</literal>.</para>
+ </listitem>
+@@ -222,7 +222,7 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+ the <literal>blkio.weight</literal> control group attribute,
+ which defaults to 1000. For details about this control group
+ attribute, see <ulink
+-
url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt";>blkio-controller.txt</ulink>.
++
url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt";>blkio-controller.txt</ulink>.
+ The available IO bandwidth is split up among all units within
+ one slice relative to their block IO weight.</para>
+
+@@ -254,7 +254,7 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+ attribute, which defaults to 1000. Use this option multiple
+ times to set weights for multiple devices. For details about
+ this control group attribute, see <ulink
+-
url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt";>blkio-controller.txt</ulink>.</para>
++
url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt";>blkio-controller.txt</ulink>.</para>
+
+ <para>Implies
+ <literal>BlockIOAccounting=true</literal>.</para>
+@@ -282,7 +282,7 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+ attributes. Use this option multiple times to set bandwidth
+ limits for multiple devices. For details about these control
+ group attributes, see <ulink
+-
url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt";>blkio-controller.txt</ulink>.
++
url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt";>blkio-controller.txt</ulink>.
+ </para>
+
+ <para>Implies
+@@ -306,7 +306,7 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+ <literal>devices.deny</literal> control group
+ attributes. For details about these control group
+ attributes, see <ulink
+-
url="https://www.kernel.org/doc/Documentation/cgroups/devices.txt";>devices.txt</ulink>.</para>
++
url="https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt";>devices.txt</ulink>.</para>
+
+ <para>The device node specifier is either a path to a device
+ node in the file system, starting with
+@@ -411,10 +411,10 @@ along with systemd; If not, see
<http://www.gnu.org/licenses/>.
+
<citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
+
<citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
+ The documentation for control groups and specific controllers in the
Linux kernel:
+- <ulink
url="https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt";>cgroups.txt</ulink>,
+- <ulink
url="https://www.kernel.org/doc/Documentation/cgroups/cpuacct.txt";>cpuacct.txt</ulink>,
+- <ulink
url="https://www.kernel.org/doc/Documentation/cgroups/memory.txt";>memory.txt</ulink>,
+- <ulink
url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt";>blkio-controller.txt</ulink>.
++ <ulink
url="https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt";>cgroups.txt</ulink>,
++ <ulink
url="https://www.kernel.org/doc/Documentation/cgroup-v1/cpuacct.txt";>cpuacct.txt</ulink>,
++ <ulink
url="https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt";>memory.txt</ulink>,
++ <ulink
url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt";>blkio-controller.txt</ulink>.
+ </para>
+ </refsect1>
+ </refentry>
diff --git
a/debian/patches/sd-event-fix-prepare-priority-queue-comparison-function.patch
b/debian/patches/sd-event-fix-prepare-priority-queue-comparison-function.patch
new file mode 100644
index 0000000..102dd41
--- /dev/null
+++
b/debian/patches/sd-event-fix-prepare-priority-queue-comparison-function.patch
@@ -0,0 +1,44 @@
+From: Krzysztof Kotlenga <k.kotle...@sims.pl>
+Date: Thu, 24 Sep 2015 00:34:51 +0200
+Subject: sd-event: fix prepare priority queue comparison function
+
+Otherwise a disabled event source can get swapped with an enabled one
+and cause a severe sd-event malfunction.
+
+http://lists.freedesktop.org/archives/systemd-devel/2015-September/034356.html
+
+(cherry-picked from commit 8046c4576a68977a1089d2585866bfab8152661b)
+---
+ src/libsystemd/sd-event/sd-event.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/libsystemd/sd-event/sd-event.c
b/src/libsystemd/sd-event/sd-event.c
+index ecab8f0..fd17439 100644
+--- a/src/libsystemd/sd-event/sd-event.c
++++ b/src/libsystemd/sd-event/sd-event.c
+@@ -228,6 +228,12 @@ static int prepare_prioq_compare(const void *a, const
void *b) {
+ assert(x->prepare);
+ assert(y->prepare);
+
++ /* Enabled ones first */
++ if (x->enabled != SD_EVENT_OFF && y->enabled == SD_EVENT_OFF)
++ return -1;
++ if (x->enabled == SD_EVENT_OFF && y->enabled != SD_EVENT_OFF)
++ return 1;
++
+ /* Move most recently prepared ones last, so that we can stop
+ * preparing as soon as we hit one that has already been
+ * prepared in the current iteration */
+@@ -236,12 +242,6 @@ static int prepare_prioq_compare(const void *a, const
void *b) {
+ if (x->prepare_iteration > y->prepare_iteration)
+ return 1;
+
+- /* Enabled ones first */
+- if (x->enabled != SD_EVENT_OFF && y->enabled == SD_EVENT_OFF)
+- return -1;
+- if (x->enabled == SD_EVENT_OFF && y->enabled != SD_EVENT_OFF)
+- return 1;
+-
+ /* Lower priority values first */
+ if (x->priority < y->priority)
+ return -1;
diff --git a/debian/patches/series b/debian/patches/series
index 3d80328..1e8f761 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -158,6 +158,14 @@ delta-Fix-broken-separator-support.patch
sd-dhcp-client-make-request-broadcasts-configurable.patch
make-sure-all-swap-units-are-ordered-before-the-swap-targ.patch
nspawn-fix-network-interface.patch
+service-use-the-right-timeout-for-stop-processes-we-fork.patch
+fsck-re-enable-fsck-l.patch
+core-don-t-reset-log-level-to-NOTICE-if-we-get-quiet-on-t.patch
+sd-event-fix-prepare-priority-queue-comparison-function.patch
+man-update-links-to-kernel.org-cgroup-documentation.patch
+console-getty.service-don-t-start-when-dev-console-is-mis.patch
+units-explicitly-order-systemd-user-sessions.service-afte.patch
+units-order-systemd-user-sessions.service-after-network.t.patch
## Debian specific patches:
Add-back-support-for-Debian-specific-config-files.patch
diff --git
a/debian/patches/service-use-the-right-timeout-for-stop-processes-we-fork.patch
b/debian/patches/service-use-the-right-timeout-for-stop-processes-we-fork.patch
new file mode 100644
index 0000000..b3eddac
--- /dev/null
+++
b/debian/patches/service-use-the-right-timeout-for-stop-processes-we-fork.patch
@@ -0,0 +1,106 @@
+From: Lennart Poettering <lenn...@poettering.net>
+Date: Thu, 21 Aug 2014 18:01:22 +0200
+Subject: service: use the right timeout for stop processes we fork
+
+(cherry-picked from commit 21b2ce39d4038cd6176394836fdcfb7fba63f424)
+---
+ src/core/service.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/src/core/service.c b/src/core/service.c
+index 73a0e84..e60757b 100644
+--- a/src/core/service.c
++++ b/src/core/service.c
+@@ -875,7 +875,7 @@ fail:
+ static int service_spawn(
+ Service *s,
+ ExecCommand *c,
+- bool timeout,
++ usec_t timeout,
+ bool pass_fds,
+ bool apply_permissions,
+ bool apply_chroot,
+@@ -920,8 +920,8 @@ static int service_spawn(
+ }
+ }
+
+- if (timeout && s->timeout_start_usec > 0) {
+- r = service_arm_timer(s, s->timeout_start_usec);
++ if (timeout > 0) {
++ r = service_arm_timer(s, timeout);
+ if (r < 0)
+ goto fail;
+ } else
+@@ -1123,7 +1123,7 @@ static void service_enter_stop_post(Service *s,
ServiceResult f) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ s->timeout_stop_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1214,7 +1214,7 @@ static void service_enter_stop(Service *s, ServiceResult
f) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ s->timeout_stop_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1269,7 +1269,7 @@ static void service_enter_start_post(Service *s) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ s->timeout_start_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1334,8 +1334,7 @@ static void service_enter_start(Service *s) {
+
+ r = service_spawn(s,
+ c,
+- s->type == SERVICE_FORKING || s->type ==
SERVICE_DBUS ||
+- s->type == SERVICE_NOTIFY || s->type ==
SERVICE_ONESHOT,
++ IN_SET(s->type, SERVICE_FORKING, SERVICE_DBUS,
SERVICE_NOTIFY, SERVICE_ONESHOT) ? s->timeout_start_usec : 0,
+ true,
+ true,
+ true,
+@@ -1402,7 +1401,7 @@ static void service_enter_start_pre(Service *s) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ s->timeout_start_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1476,7 +1475,7 @@ static void service_enter_reload(Service *s) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ s->timeout_start_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1515,7 +1514,7 @@ static void service_run_next_control(Service *s) {
+
+ r = service_spawn(s,
+ s->control_command,
+- true,
++ IN_SET(s->state, SERVICE_START_PRE, SERVICE_START,
SERVICE_START_POST, SERVICE_RUNNING, SERVICE_RELOAD) ? s->timeout_start_usec :
s->timeout_stop_usec,
+ false,
+ !s->permissions_start_only,
+ !s->root_directory_start_only,
+@@ -1561,7 +1560,7 @@ static void service_run_next_main(Service *s) {
+
+ r = service_spawn(s,
+ s->main_command,
+- true,
++ s->timeout_start_usec,
+ true,
+ true,
+ true,
diff --git
a/debian/patches/units-explicitly-order-systemd-user-sessions.service-afte.patch
b/debian/patches/units-explicitly-order-systemd-user-sessions.service-afte.patch
new file mode 100644
index 0000000..0a53aac
--- /dev/null
+++
b/debian/patches/units-explicitly-order-systemd-user-sessions.service-afte.patch
@@ -0,0 +1,25 @@
+From: Lennart Poettering <lenn...@poettering.net>
+Date: Fri, 3 Apr 2015 14:31:35 +0200
+Subject: units: explicitly order systemd-user-sessions.service after
+ nss-user-lookup.target
+
+We should not allow logins before NIS/LDAP users are available.
+
+(cherry-picked from commit efb3e19be9c568974b221990b9e84fb5304c5537)
+---
+ units/systemd-user-sessions.service.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/units/systemd-user-sessions.service.in
b/units/systemd-user-sessions.service.in
+index 0869e73..c09c05d 100644
+--- a/units/systemd-user-sessions.service.in
++++ b/units/systemd-user-sessions.service.in
+@@ -8,7 +8,7 @@
+ [Unit]
+ Description=Permit User Sessions
+ Documentation=man:systemd-user-sessions.service(8)
+-After=remote-fs.target
++After=remote-fs.target nss-user-lookup.target
+
+ [Service]
+ Type=oneshot
diff --git
a/debian/patches/units-order-systemd-user-sessions.service-after-network.t.patch
b/debian/patches/units-order-systemd-user-sessions.service-after-network.t.patch
new file mode 100644
index 0000000..a5fe1f2
--- /dev/null
+++
b/debian/patches/units-order-systemd-user-sessions.service-after-network.t.patch
@@ -0,0 +1,28 @@
+From: Lennart Poettering <lenn...@poettering.net>
+Date: Wed, 20 Apr 2016 20:12:14 +0200
+Subject: units: order systemd-user-sessions.service after network.target
+
+That way we can be sure that local users are logged out before the network is
+shut down when the system goes down, so that SSH session should be ending
+cleanly before the system goes down.
+
+Fixes: #2390
+
+(cherry-picked from commit 8c856804780681e135d98ca94d08afe247557770)
+---
+ units/systemd-user-sessions.service.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/units/systemd-user-sessions.service.in
b/units/systemd-user-sessions.service.in
+index c09c05d..b4ea5a1 100644
+--- a/units/systemd-user-sessions.service.in
++++ b/units/systemd-user-sessions.service.in
+@@ -8,7 +8,7 @@
+ [Unit]
+ Description=Permit User Sessions
+ Documentation=man:systemd-user-sessions.service(8)
+-After=remote-fs.target nss-user-lookup.target
++After=remote-fs.target nss-user-lookup.target network.target
+
+ [Service]
+ Type=oneshot
signature.asc
Description: OpenPGP digital signature
