Merge pull request #19611 from yuwata/network-dhcp-server-introduce-server-address

network: dhcp-server: introduce ServerAddress= setting

.github/workflows/build_test.sh

@@ -46,9 +46,9 @@ PACKAGES=(
     mount
     net-tools
     perl
-    python-lxml
     python3-evdev
     python3-lxml
+    python3-jinja2
     python3-pip
     python3-pyparsing
     python3-setuptools

.github/workflows/mkosi.yml

@@ -27,7 +27,7 @@ jobs:
     - uses: systemd/mkosi@v9
 
     - name: Install
-      run: sudo apt-get update && sudo apt-get install --no-install-recommends python3-pexpect
+      run: sudo apt-get update && sudo apt-get install --no-install-recommends python3-pexpect python3-jinja2
 
     - name: Symlink
       run: ln -s .mkosi/mkosi.${{ matrix.distro }} mkosi.default

.lgtm.yml

@@ -9,6 +9,7 @@ extraction:
         - libfdisk-dev
         - libp11-kit-dev
         - libssl-dev
+        - python3-jinja2
   python:
     python_setup:
       version: 3

.mkosi/mkosi.arch

@@ -35,12 +35,12 @@ BuildPackages=
         libxkbcommon
         libxslt
         lz4
-        m4
         meson
         pam
         pkgconfig
         python
         python-lxml
+        python-jinja
         qrencode
         rsync
         xz

.mkosi/mkosi.debian

@@ -46,11 +46,11 @@ BuildPackages=
         libtss2-dev
         libxkbcommon-dev
         libzstd-dev
-        m4
         meson
         pkg-config
         python3
         python3-lxml
+        python3-jinja2
         tree
         uuid-dev
         xsltproc

.mkosi/mkosi.fedora

@@ -45,7 +45,6 @@ BuildPackages=
         libzstd-devel
         lz4
         lz4-devel
-        m4
         meson
         ninja-build
         openssl-devel
@@ -55,6 +54,7 @@ BuildPackages=
         pkgconfig
         python3-devel
         python3-lxml
+        python3dist(jinja2)
         qrencode-devel
         rpm
         tpm2-tss-devel

.mkosi/mkosi.opensuse

@@ -30,13 +30,13 @@ BuildPackages=
         libseccomp-devel
         libselinux-devel
         libxslt-tools
-        m4
         meson
         pam-devel
         pciutils-devel
         pcre-devel
         python3
         python3-lxml
+        python3-jinja2
         qrencode-devel
         system-user-nobody
         systemd-sysvinit

.mkosi/mkosi.ubuntu

@@ -49,11 +49,11 @@ BuildPackages=
         libxkbcommon-dev
         libxtables-dev
         libzstd-dev
-        m4
         meson
         pkg-config
         python3
         python3-lxml
+        python3-jinja2
         tree
         tzdata
         uuid-dev

.semaphore/semaphore-runner.sh

@@ -57,7 +57,7 @@ for phase in "${PHASES[@]}"; do
             echo "deb http://archive.ubuntu.com/ubuntu $UBUNTU_RELEASE-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/backports.list
             sudo apt-get -q update
             sudo apt-get install -y -t "$UBUNTU_RELEASE-backports" lxc
-            sudo apt-get install -y python3-debian git dpkg-dev fakeroot
+            sudo apt-get install -y python3-debian git dpkg-dev fakeroot python3-jinja2
 
             [ -d $AUTOPKGTEST_DIR ] || git clone --quiet --depth=1 https://salsa.debian.org/ci-team/autopkgtest.git "$AUTOPKGTEST_DIR"
 

README

@@ -190,11 +190,12 @@ REQUIREMENTS:
         gperf
         docbook-xsl (optional, required for documentation)
         xsltproc    (optional, required for documentation)
+        python-jinja2
         python-lxml (optional, required to build the indices)
         python >= 3.5
         meson >= 0.46 (>= 0.49 is required to build position-independent executables)
         ninja
-        gcc, awk, sed, grep, m4, and similar tools
+        gcc, awk, sed, grep, and similar tools
         clang >= 10.0, llvm >= 10.0 (optional, required to build BPF programs
                 from source code in C)
 

docs/HACKING.md

@@ -106,13 +106,31 @@ And after that, head over to your repo on GitHub and click "Compare & pull reque
 
 Happy hacking!
 
+## Templating engines in .in files
+
+Some source files are generated during build. We use two templating engines:
+* meson's `configure_file()` directive uses syntax with `@VARIABLE@`.
+
+  See https://mesonbuild.com/Reference-manual.html#configure_file for
+  details.
+
+* most files are rendered using jinja2, with `{{VARIABLE}}` and `{% if … %}`,
+  `{% elif … %}`, `{% else … %}`, `{% endif … %}` blocks. `{# … #}` is a
+  jinja2 comment, i.e. that block will not be visible in the rendered
+  output. `{% raw %} … {% endraw %}` creates a block where the jinja2 syntax
+  is not interpreted.
+
+  See https://jinja2docs.readthedocs.io/en/stable/templates.html#synopsis
+  for details.
+
+Please note that files for both template engines use the `.in` extension.
 
 ## Developer and release modes
 
 In the default meson configuration (`-Dmode=developer`), certain checks are
 enabled that are suitable when hacking on systemd (such as internal
-documentation consistency checks). Those are not useful when compiling for code
-for distribution and can be disabled by setting `-Dmode=release`.
+documentation consistency checks). Those are not useful when compiling for
+distribution and can be disabled by setting `-Dmode=release`.
 
 ## Fuzzers
 

docs/sysvinit/README.in

@@ -1,4 +1,4 @@
-You are looking for the traditional init scripts in @SYSTEM_SYSVINIT_PATH@,
+You are looking for the traditional init scripts in {{ SYSTEM_SYSVINIT_PATH }},
 and they are gone?
 
 Here's an explanation on what's going on:
@@ -15,7 +15,7 @@ service, respectively. For further details, please refer to
 systemctl(1).
 
 Note that traditional init scripts continue to function on a systemd
-system. An init script @SYSTEM_SYSVINIT_PATH@/foobar is implicitly mapped
+system. An init script {{ SYSTEM_SYSVINIT_PATH }}/foobar is implicitly mapped
 into a service unit foobar.service during system initialization.
 
 Thank you!

docs/sysvinit/meson.build

@@ -1,11 +1,10 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-file = configure_file(
+custom_target(
+        'README',
         input : 'README.in',
         output : 'README',
-        configuration : substs)
-
-if conf.get('HAVE_SYSV_COMPAT') == 1
-        install_data(file,
-                     install_dir : sysvinit_path)
-endif
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : conf.get('HAVE_SYSV_COMPAT') == 1,
+        install_dir : sysvinit_path)

man/custom-entities.ent.in

@@ -1,15 +1,15 @@
 <?xml version="1.0" encoding="utf-8" ?>
-<!ENTITY MOUNT_PATH @MOUNT_PATH@>
-<!ENTITY UMOUNT_PATH @UMOUNT_PATH@>
-<!ENTITY systemgeneratordir @SYSTEM_GENERATOR_DIR@>
-<!ENTITY usergeneratordir @USER_GENERATOR_DIR@>
-<!ENTITY systemenvgeneratordir @SYSTEM_ENV_GENERATOR_DIR@>
-<!ENTITY userenvgeneratordir @USER_ENV_GENERATOR_DIR@>
-<!ENTITY CERTIFICATE_ROOT @CERTIFICATE_ROOT@>
-<!ENTITY FALLBACK_HOSTNAME @FALLBACK_HOSTNAME@>
-<!ENTITY MEMORY_ACCOUNTING_DEFAULT @MEMORY_ACCOUNTING_DEFAULT_YES_NO@>
-<!ENTITY KILL_USER_PROCESSES @KILL_USER_PROCESSES_YES_NO@>
-<!ENTITY DEBUGTTY @DEBUGTTY@>
-<!ENTITY RC_LOCAL_PATH @RC_LOCAL_PATH@>
+<!ENTITY MOUNT_PATH "{{MOUNT_PATH}}">
+<!ENTITY UMOUNT_PATH "{{UMOUNT_PATH}}">
+<!ENTITY SYSTEM_GENERATOR_DIR "{{SYSTEM_GENERATOR_DIR}}">
+<!ENTITY USER_GENERATOR_DIR "{{USER_GENERATOR_DIR}}">
+<!ENTITY SYSTEM_ENV_GENERATOR_DIR "{{SYSTEM_ENV_GENERATOR_DIR}}">
+<!ENTITY USER_ENV_GENERATOR_DIR "{{USER_ENV_GENERATOR_DIR}}">
+<!ENTITY CERTIFICATE_ROOT "{{CERTIFICATE_ROOT}}">
+<!ENTITY FALLBACK_HOSTNAME "{{FALLBACK_HOSTNAME}}">
+<!ENTITY MEMORY_ACCOUNTING_DEFAULT "{{ 'yes' if MEMORY_ACCOUNTING_DEFAULT else 'no' }}">
+<!ENTITY KILL_USER_PROCESSES "{{ 'yes' if KILL_USER_PROCESSES else 'no' }}">
+<!ENTITY DEBUGTTY "{{DEBUGTTY}}">
+<!ENTITY RC_LOCAL_PATH "{{RC_LOCAL_PATH}}">
 <!ENTITY fedora_latest_version "34">
 <!ENTITY fedora_cloud_release "1.2">

man/meson.build

@@ -26,10 +26,12 @@ custom_man_xsl = files('custom-man.xsl')
 custom_html_xsl = files('custom-html.xsl')
 xslt_cmd = [xsltproc, '-o', '@OUTPUT0@'] + xsltproc_flags
 
-custom_entities_ent = configure_file(
+custom_entities_ent = custom_target(
+        'custom-entities.ent',
         input : 'custom-entities.ent.in',
         output : 'custom-entities.ent',
-        configuration : conf)
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true)
 
 man_pages = []
 html_pages = []
@@ -60,7 +62,7 @@ foreach tuple : xsltproc.found() ? manpages : []
                         input : xml,
                         output : [man] + manaliases,
                         command : xslt_cmd + [custom_man_xsl, '@INPUT@'],
-                        depend_files : custom_entities_ent,
+                        depends : custom_entities_ent,
                         install : want_man,
                         install_dir : mandirn)
                 man_pages += p1
@@ -85,8 +87,7 @@ foreach tuple : xsltproc.found() ? manpages : []
                         input : xml,
                         output : html,
                         command : xslt_cmd + [custom_html_xsl, '@INPUT@'],
-                        depend_files : custom_entities_ent,
-                        depends : p2,
+                        depends : [custom_entities_ent, p2],
                         install : want_html,
                         install_dir : join_paths(docdir, 'html'))
                 html_pages += p3
@@ -163,8 +164,7 @@ foreach tuple : xsltproc.found() ? [['systemd.directives', '7', systemd_directiv
                 input : xml,
                 output : html,
                 command : xslt_cmd + [custom_html_xsl, '@INPUT@'],
-                depend_files : custom_entities_ent,
-                depends : p2,
+                depends : [custom_entities_ent, p2],
                 install : want_html and have_lxml,
                 install_dir : join_paths(docdir, 'html'))
         html_pages += p3
@@ -200,12 +200,15 @@ endif
 
 ############################################################
 
+buildroot_substs = configuration_data()
+buildroot_substs.set_quoted('BUILD_ROOT', project_build_root)
+
 configure_file(
         input : 'man.in',
         output : 'man',
-        configuration : substs)
+        configuration : buildroot_substs)
 
 configure_file(
         input : 'html.in',
         output : 'html',
-        configuration : substs)
+        configuration : buildroot_substs)

man/systemd-environment-d-generator.xml

@@ -25,7 +25,7 @@
   </refnamediv>
 
   <refsynopsisdiv>
-    <para><filename>&userenvgeneratordir;/30-systemd-environment-d-generator</filename></para>
+    <para><filename>&USER_ENV_GENERATOR_DIR;/30-systemd-environment-d-generator</filename></para>
   </refsynopsisdiv>
 
   <refsect1>

man/systemd.environment-generator.xml

@@ -25,31 +25,31 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>&systemenvgeneratordir;/some-generator</command>
+      <command>&SYSTEM_ENV_GENERATOR_DIR;/some-generator</command>
     </cmdsynopsis>
     <cmdsynopsis>
-      <command>&userenvgeneratordir;/some-generator</command>
+      <command>&USER_ENV_GENERATOR_DIR;/some-generator</command>
     </cmdsynopsis>
 
     <para>
       <literallayout><filename>/run/systemd/system-environment-generators/*</filename>
 <filename>/etc/systemd/system-environment-generators/*</filename>
 <filename>/usr/local/lib/systemd/system-environment-generators/*</filename>
-<filename>&systemenvgeneratordir;/*</filename></literallayout>
+<filename>&SYSTEM_ENV_GENERATOR_DIR;/*</filename></literallayout>
     </para>
 
     <para>
       <literallayout><filename>/run/systemd/user-environment-generators/*</filename>
 <filename>/etc/systemd/user-environment-generators/*</filename>
 <filename>/usr/local/lib/systemd/user-environment-generators/*</filename>
-<filename>&userenvgeneratordir;/*</filename></literallayout>
+<filename>&USER_ENV_GENERATOR_DIR;/*</filename></literallayout>
     </para>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
     <para>Generators are small executables that live in
-    <filename>&systemenvgeneratordir;/</filename> and other directories listed above.
+    <filename>&SYSTEM_ENV_GENERATOR_DIR;/</filename> and other directories listed above.
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> will
     execute those binaries very early at the startup of each manager and at configuration
     reload time, before running the generators described in
@@ -116,7 +116,7 @@
       <title>Debugging a generator</title>
 
       <programlisting>SYSTEMD_LOG_LEVEL=debug VAR_A=something VAR_B="something else" \
-&systemenvgeneratordir;/path-to-generator
+&SYSTEM_ENV_GENERATOR_DIR;/path-to-generator
 </programlisting>
     </example>
   </refsect1>

man/systemd.generator.xml

@@ -34,20 +34,20 @@
       <literallayout><filename>/run/systemd/system-generators/*</filename>
 <filename>/etc/systemd/system-generators/*</filename>
 <filename>/usr/local/lib/systemd/system-generators/*</filename>
-<filename>&systemgeneratordir;/*</filename></literallayout>
+<filename>&SYSTEM_GENERATOR_DIR;/*</filename></literallayout>
     </para>
 
     <para>
       <literallayout><filename>/run/systemd/user-generators/*</filename>
 <filename>/etc/systemd/user-generators/*</filename>
 <filename>/usr/local/lib/systemd/user-generators/*</filename>
-<filename>&usergeneratordir;/*</filename></literallayout>
+<filename>&USER_GENERATOR_DIR;/*</filename></literallayout>
     </para>
   </refsynopsisdiv>
 
   <refsect1>
     <title>Description</title>
-    <para>Generators are small executables placed in <filename>&systemgeneratordir;/</filename> and other
+    <para>Generators are small executables placed in <filename>&SYSTEM_GENERATOR_DIR;/</filename> and other
     directories listed above.
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> will execute
     these binaries very early at bootup and at configuration reload time — before unit files are
@@ -294,7 +294,7 @@
       <title>Debugging a generator</title>
 
       <programlisting>dir=$(mktemp -d)
-SYSTEMD_LOG_LEVEL=debug &systemgeneratordir;/systemd-fstab-generator \
+SYSTEMD_LOG_LEVEL=debug &SYSTEM_GENERATOR_DIR;/systemd-fstab-generator \
         "$dir" "$dir" "$dir"
 find $dir</programlisting>
     </example>

man/systemd.network.xml

@@ -2344,6 +2344,14 @@ IPv6Token=prefixstable:2002:da8:1::</programlisting></para>
 
     <variablelist class='network-directives'>
 
+      <varlistentry>
+        <term><varname>ServerAddress=</varname></term>
+        <listitem><para>Specifies server address for the DHCP server. Takes an IPv4 address with prefix
+        length, e.g., <literal>192.168.0.1/24</literal>. This setting may be useful when the link which
+        DHCP server running on has multiple static addresses. When unset, one of static addresses in
+        the link will be automatically selected. Defaults to unset.</para></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>PoolOffset=</varname></term>
         <term><varname>PoolSize=</varname></term>

meson.build

@@ -16,19 +16,11 @@ project('systemd', 'c',
 libsystemd_version = '0.31.0'
 libudev_version = '1.7.1'
 
-# We need the same data in two different formats, ugh!
-# Also, for hysterical reasons, we use different variable
-# names, sometimes. Not all variables are included in every
-# set. Ugh, ugh, ugh!
 conf = configuration_data()
-conf.set('PROJECT_VERSION',        meson.project_version(),
+conf.set_quoted('PROJECT_URL', 'https://www.freedesktop.org/wiki/Software/systemd')
+conf.set('PROJECT_VERSION',    meson.project_version(),
          description : 'Numerical project version (used where a simple number is expected)')
 
-substs = configuration_data()
-substs.set('PROJECT_URL',          'https://www.freedesktop.org/wiki/Software/systemd')
-substs.set('PROJECT_VERSION',      meson.project_version(),
-           description : 'Numerical project version (used where a simple number is expected)')
-
 # This is to be used instead of meson.source_root(), as the latter will return
 # the wrong result when systemd is being built as a meson subproject
 project_source_root = meson.current_source_dir()
@@ -219,106 +211,77 @@ endif
 memory_accounting_default = get_option('memory-accounting-default')
 status_unit_format_default = get_option('status-unit-format-default')
 
+conf.set_quoted('BINFMT_DIR',                                 binfmtdir)
+conf.set_quoted('BOOTLIBDIR',                                 bootlibdir)
+conf.set_quoted('CATALOG_DATABASE',                           join_paths(catalogstatedir, 'database'))
+conf.set_quoted('CERTIFICATE_ROOT',                           get_option('certificate-root'))
+conf.set_quoted('DOCUMENT_ROOT',                              join_paths(pkgdatadir, 'gatewayd'))
+conf.set_quoted('ENVIRONMENT_DIR',                            environmentdir)
+conf.set_quoted('INCLUDE_DIR',                                includedir)
+conf.set_quoted('LIBDIR',                                     libdir)
+conf.set_quoted('MODPROBE_DIR',                               modprobedir)
+conf.set_quoted('MODULESLOAD_DIR',                            modulesloaddir)
 conf.set_quoted('PKGSYSCONFDIR',                              pkgsysconfdir)
+conf.set_quoted('POLKIT_AGENT_BINARY_PATH',                   join_paths(bindir, 'pkttyagent'))
+conf.set_quoted('PREFIX',                                     prefixdir)
+conf.set_quoted('RANDOM_SEED',                                join_paths(randomseeddir, 'random-seed'))
+conf.set_quoted('RANDOM_SEED_DIR',                            randomseeddir)
+conf.set_quoted('RC_LOCAL_PATH',                              get_option('rc-local'))
+conf.set_quoted('ROOTBINDIR',                                 rootbindir)
+conf.set_quoted('ROOTLIBDIR',                                 rootlibdir)
+conf.set_quoted('ROOTLIBEXECDIR',                             rootlibexecdir)
+conf.set_quoted('ROOTPREFIX',                                 rootprefixdir)
+conf.set_quoted('ROOTPREFIX_NOSLASH',                         rootprefixdir_noslash)
+conf.set_quoted('SYSCONF_DIR',                                sysconfdir)
+conf.set_quoted('SYSCTL_DIR',                                 sysctldir)
+conf.set_quoted('SYSTEMCTL_BINARY_PATH',                      join_paths(rootbindir, 'systemctl'))
+conf.set_quoted('SYSTEMD_BINARY_PATH',                        join_paths(rootlibexecdir, 'systemd'))
+conf.set_quoted('SYSTEMD_CATALOG_DIR',                        catalogdir)
+conf.set_quoted('SYSTEMD_CGROUPS_AGENT_PATH',                 join_paths(rootlibexecdir, 'systemd-cgroups-agent'))
+conf.set_quoted('SYSTEMD_CRYPTSETUP_PATH',                    join_paths(rootlibexecdir, 'systemd-cryptsetup'))
+conf.set_quoted('SYSTEMD_EXPORT_PATH',                        join_paths(rootlibexecdir, 'systemd-export'))
+conf.set_quoted('SYSTEMD_FSCK_PATH',                          join_paths(rootlibexecdir, 'systemd-fsck'))
+conf.set_quoted('SYSTEMD_GROWFS_PATH',                        join_paths(rootlibexecdir, 'systemd-growfs'))
+conf.set_quoted('SYSTEMD_HOMEWORK_PATH',                      join_paths(rootlibexecdir, 'systemd-homework'))
+conf.set_quoted('SYSTEMD_IMPORT_FS_PATH',                     join_paths(rootlibexecdir, 'systemd-import-fs'))
+conf.set_quoted('SYSTEMD_IMPORT_PATH',                        join_paths(rootlibexecdir, 'systemd-import'))
+conf.set_quoted('SYSTEMD_KBD_MODEL_MAP',                      join_paths(pkgdatadir, 'kbd-model-map'))
+conf.set_quoted('SYSTEMD_LANGUAGE_FALLBACK_MAP',              join_paths(pkgdatadir, 'language-fallback-map'))
+conf.set_quoted('SYSTEMD_MAKEFS_PATH',                        join_paths(rootlibexecdir, 'systemd-makefs'))
+conf.set_quoted('SYSTEMD_PULL_PATH',                          join_paths(rootlibexecdir, 'systemd-pull'))
+conf.set_quoted('SYSTEMD_SHUTDOWN_BINARY_PATH',               join_paths(rootlibexecdir, 'systemd-shutdown'))
+conf.set_quoted('SYSTEMD_STDIO_BRIDGE_BINARY_PATH',           join_paths(bindir, 'systemd-stdio-bridge'))
+conf.set_quoted('SYSTEMD_TEST_DATA',                          join_paths(testsdir, 'testdata'))
+conf.set_quoted('SYSTEMD_TTY_ASK_PASSWORD_AGENT_BINARY_PATH', join_paths(rootbindir, 'systemd-tty-ask-password-agent'))
+conf.set_quoted('SYSTEMD_USERWORK_PATH',                      join_paths(rootlibexecdir, 'systemd-userwork'))
+conf.set_quoted('SYSTEMD_VERITYSETUP_PATH',                   join_paths(rootlibexecdir, 'systemd-veritysetup'))
 conf.set_quoted('SYSTEM_CONFIG_UNIT_DIR',                     join_paths(pkgsysconfdir, 'system'))
-conf.set_quoted('SYSTEM_DATA_UNIT_PATH',                      systemunitdir)
+conf.set_quoted('SYSTEM_DATA_UNIT_DIR',                       systemunitdir)
+conf.set_quoted('SYSTEM_ENV_GENERATOR_DIR',                   systemenvgeneratordir)
+conf.set_quoted('SYSTEM_GENERATOR_DIR',                       systemgeneratordir)
+conf.set_quoted('SYSTEM_PRESET_DIR',                          systempresetdir)
+conf.set_quoted('SYSTEM_SHUTDOWN_PATH',                       systemshutdowndir)
+conf.set_quoted('SYSTEM_SLEEP_PATH',                          systemsleepdir)
 conf.set_quoted('SYSTEM_SYSVINIT_PATH',                       sysvinit_path)
 conf.set_quoted('SYSTEM_SYSVRCND_PATH',                       sysvrcnd_path)
-conf.set_quoted('RC_LOCAL_PATH',                              get_option('rc-local'))
+conf.set_quoted('SYSUSERS_DIR',                               sysusersdir)
+conf.set_quoted('TMPFILES_DIR',                               tmpfilesdir)
+conf.set_quoted('UDEVLIBEXECDIR',                             udevlibexecdir)
+conf.set_quoted('UDEV_HWDB_DIR',                              udevhwdbdir)
+conf.set_quoted('UDEV_RULES_DIR',                             udevrulesdir)
+conf.set_quoted('USER_CONFIG_UNIT_DIR',                       join_paths(pkgsysconfdir, 'user'))
+conf.set_quoted('USER_DATA_UNIT_DIR',                         userunitdir)
+conf.set_quoted('USER_ENV_GENERATOR_DIR',                     userenvgeneratordir)
+conf.set_quoted('USER_GENERATOR_DIR',                         usergeneratordir)
+conf.set_quoted('USER_KEYRING_PATH',                          join_paths(pkgsysconfdir, 'import-pubring.gpg'))
+conf.set_quoted('USER_PRESET_DIR',                            userpresetdir)
+conf.set_quoted('VENDOR_KEYRING_PATH',                        join_paths(rootlibexecdir, 'import-pubring.gpg'))
 
 conf.set('ANSI_OK_COLOR',                                     'ANSI_' + get_option('ok-color').underscorify().to_upper())
 conf.set10('ENABLE_FEXECVE',                                  get_option('fexecve'))
-
-conf.set_quoted('USER_CONFIG_UNIT_DIR',                       join_paths(pkgsysconfdir, 'user'))
-conf.set_quoted('USER_DATA_UNIT_DIR',                         userunitdir)
-conf.set_quoted('CERTIFICATE_ROOT',                           get_option('certificate-root'))
-conf.set_quoted('CATALOG_DATABASE',                           join_paths(catalogstatedir, 'database'))
-conf.set_quoted('SYSTEMD_BINARY_PATH',                        join_paths(rootlibexecdir, 'systemd'))
-conf.set_quoted('SYSTEMD_CGROUPS_AGENT_PATH',                 join_paths(rootlibexecdir, 'systemd-cgroups-agent'))
-conf.set_quoted('SYSTEMD_FSCK_PATH',                          join_paths(rootlibexecdir, 'systemd-fsck'))
-conf.set_quoted('SYSTEMD_GROWFS_PATH',                        join_paths(rootlibexecdir, 'systemd-growfs'))
-conf.set_quoted('SYSTEMD_MAKEFS_PATH',                        join_paths(rootlibexecdir, 'systemd-makefs'))
-conf.set_quoted('SYSTEMD_SHUTDOWN_BINARY_PATH',               join_paths(rootlibexecdir, 'systemd-shutdown'))
-conf.set_quoted('SYSTEMCTL_BINARY_PATH',                      join_paths(rootbindir, 'systemctl'))
-conf.set_quoted('SYSTEMD_TTY_ASK_PASSWORD_AGENT_BINARY_PATH', join_paths(rootbindir, 'systemd-tty-ask-password-agent'))
-conf.set_quoted('SYSTEMD_STDIO_BRIDGE_BINARY_PATH',           join_paths(bindir, 'systemd-stdio-bridge'))
-conf.set_quoted('ROOTPREFIX',                                 rootprefixdir)
-conf.set_quoted('ROOTPREFIX_NOSLASH',                         rootprefixdir_noslash)
-conf.set_quoted('RANDOM_SEED_DIR',                            randomseeddir)
-conf.set_quoted('RANDOM_SEED',                                join_paths(randomseeddir, 'random-seed'))
-conf.set_quoted('SYSTEMD_CRYPTSETUP_PATH',                    join_paths(rootlibexecdir, 'systemd-cryptsetup'))
-conf.set_quoted('SYSTEMD_VERITYSETUP_PATH',                   join_paths(rootlibexecdir, 'systemd-veritysetup'))
-conf.set_quoted('SYSTEM_GENERATOR_DIR',                       systemgeneratordir)
-conf.set_quoted('USER_GENERATOR_DIR',                         usergeneratordir)
-conf.set_quoted('SYSTEM_ENV_GENERATOR_DIR',                   systemenvgeneratordir)
-conf.set_quoted('USER_ENV_GENERATOR_DIR',                     userenvgeneratordir)
-conf.set_quoted('SYSTEM_SHUTDOWN_PATH',                       systemshutdowndir)
-conf.set_quoted('SYSTEM_SLEEP_PATH',                          systemsleepdir)
-conf.set_quoted('SYSTEMD_KBD_MODEL_MAP',                      join_paths(pkgdatadir, 'kbd-model-map'))
-conf.set_quoted('SYSTEMD_LANGUAGE_FALLBACK_MAP',              join_paths(pkgdatadir, 'language-fallback-map'))
-conf.set_quoted('SYSTEMD_TEST_DATA',                          join_paths(testsdir, 'testdata'))
-conf.set_quoted('SYSTEMD_CATALOG_DIR',                        catalogdir)
-conf.set_quoted('UDEVLIBEXECDIR',                             udevlibexecdir)
-conf.set_quoted('POLKIT_AGENT_BINARY_PATH',                   join_paths(bindir, 'pkttyagent'))
-conf.set_quoted('LIBDIR',                                     libdir)
-conf.set_quoted('ROOTLIBDIR',                                 rootlibdir)
-conf.set_quoted('ROOTLIBEXECDIR',                             rootlibexecdir)
-conf.set_quoted('BOOTLIBDIR',                                 bootlibdir)
-conf.set_quoted('SYSTEMD_PULL_PATH',                          join_paths(rootlibexecdir, 'systemd-pull'))
-conf.set_quoted('SYSTEMD_IMPORT_PATH',                        join_paths(rootlibexecdir, 'systemd-import'))
-conf.set_quoted('SYSTEMD_IMPORT_FS_PATH',                     join_paths(rootlibexecdir, 'systemd-import-fs'))
-conf.set_quoted('SYSTEMD_EXPORT_PATH',                        join_paths(rootlibexecdir, 'systemd-export'))
-conf.set_quoted('VENDOR_KEYRING_PATH',                        join_paths(rootlibexecdir, 'import-pubring.gpg'))
-conf.set_quoted('USER_KEYRING_PATH',                          join_paths(pkgsysconfdir, 'import-pubring.gpg'))
-conf.set_quoted('DOCUMENT_ROOT',                              join_paths(pkgdatadir, 'gatewayd'))
-conf.set_quoted('SYSTEMD_HOMEWORK_PATH',                      join_paths(rootlibexecdir, 'systemd-homework'))
-conf.set_quoted('SYSTEMD_USERWORK_PATH',                      join_paths(rootlibexecdir, 'systemd-userwork'))
 conf.set10('MEMORY_ACCOUNTING_DEFAULT',                       memory_accounting_default)
-conf.set_quoted('MEMORY_ACCOUNTING_DEFAULT_YES_NO',           memory_accounting_default ? 'yes' : 'no')
 conf.set('STATUS_UNIT_FORMAT_DEFAULT',                        'STATUS_UNIT_FORMAT_' + status_unit_format_default.to_upper())
-
-substs.set('prefix',                                          prefixdir)
-substs.set('rootprefix',                                      rootprefixdir)
-substs.set('rootprefix_noslash',                              rootprefixdir_noslash)
-substs.set('exec_prefix',                                     prefixdir)
-substs.set('libdir',                                          libdir)
-substs.set('rootlibdir',                                      rootlibdir)
-substs.set('includedir',                                      includedir)
-substs.set('sysconfdir',                                      sysconfdir)
-substs.set('bindir',                                          bindir)
-substs.set('rootbindir',                                      rootbindir)
-substs.set('rootlibexecdir',                                  rootlibexecdir)
-substs.set('systemunitdir',                                   systemunitdir)
-substs.set('userunitdir',                                     userunitdir)
-substs.set('systempresetdir',                                 systempresetdir)
-substs.set('userpresetdir',                                   userpresetdir)
-substs.set('udevhwdbdir',                                     udevhwdbdir)
-substs.set('udevrulesdir',                                    udevrulesdir)
-substs.set('udevlibexecdir',                                  udevlibexecdir)
-substs.set('environmentdir',                                  environmentdir)
-substs.set('catalogdir',                                      catalogdir)
-substs.set('tmpfilesdir',                                     tmpfilesdir)
-substs.set('sysusersdir',                                     sysusersdir)
-substs.set('sysctldir',                                       sysctldir)
-substs.set('binfmtdir',                                       binfmtdir)
-substs.set('modulesloaddir',                                  modulesloaddir)
-substs.set('modprobedir',                                     modprobedir)
-substs.set('systemgeneratordir',                              systemgeneratordir)
-substs.set('usergeneratordir',                                usergeneratordir)
-substs.set('systemenvgeneratordir',                           systemenvgeneratordir)
-substs.set('userenvgeneratordir',                             userenvgeneratordir)
-substs.set('systemshutdowndir',                               systemshutdowndir)
-substs.set('systemsleepdir',                                  systemsleepdir)
-substs.set('CERTIFICATEROOT',                                 get_option('certificate-root'))
-substs.set('RANDOM_SEED',                                     join_paths(randomseeddir, 'random-seed'))
-substs.set('SYSTEM_SYSVINIT_PATH',                            sysvinit_path)
-substs.set('SYSTEM_SYSVRCND_PATH',                            sysvrcnd_path)
-substs.set('SYSTEMD_TEST_DATA',                               join_paths(testsdir, 'testdata'))
-substs.set('RC_LOCAL_PATH',                                   get_option('rc-local'))
-substs.set('MEMORY_ACCOUNTING_DEFAULT',                       memory_accounting_default ? 'yes' : 'no')
-substs.set('STATUS_UNIT_FORMAT_DEFAULT',                      status_unit_format_default)
-substs.set('HIGH_RLIMIT_NOFILE',                              conf.get('HIGH_RLIMIT_NOFILE'))
-substs.set('BUILD_ROOT',                                      project_build_root)
+conf.set_quoted('STATUS_UNIT_FORMAT_DEFAULT_STR',             status_unit_format_default)
 
 #####################################################################
 
@@ -605,7 +568,6 @@ echo = find_program('echo')
 test = find_program('test')
 sed = find_program('sed')
 awk = find_program('awk')
-m4 = find_program('m4')
 stat = find_program('stat')
 ln = find_program('ln')
 git = find_program('git', required : false)
@@ -644,7 +606,6 @@ foreach prog : progs
         endif
         name = prog.length() > 2 ? prog[2] : prog[0].to_upper()
         conf.set_quoted(name, path)
-        substs.set(name, path)
 endforeach
 
 conf.set_quoted('TELINIT', get_option('telinit-path'))
@@ -655,6 +616,12 @@ endif
 
 ############################################################
 
+if run_command('python3', '-c', 'import jinja2').returncode() != 0
+        error('python3 jinja2 missing')
+endif
+
+############################################################
+
 gperf = find_program('gperf')
 
 gperf_test_format = '''
@@ -754,7 +721,6 @@ foreach tuple : [['system-alloc-uid-min', 'SYS_UID_MIN', 1],  # Also see login.d
                 endif
         endif
         conf.set(tuple[0].underscorify().to_upper(), v)
-        substs.set(tuple[0].underscorify().to_upper(), v)
 endforeach
 if conf.get('SYSTEM_ALLOC_UID_MIN') >= conf.get('SYSTEM_UID_MAX')
         error('Invalid uid allocation range')
@@ -767,15 +733,11 @@ dynamic_uid_min = get_option('dynamic-uid-min')
 dynamic_uid_max = get_option('dynamic-uid-max')
 conf.set('DYNAMIC_UID_MIN', dynamic_uid_min)
 conf.set('DYNAMIC_UID_MAX', dynamic_uid_max)
-substs.set('dynamicuidmin', dynamic_uid_min)
-substs.set('dynamicuidmax', dynamic_uid_max)
 
 container_uid_base_min = get_option('container-uid-base-min')
 container_uid_base_max = get_option('container-uid-base-max')
 conf.set('CONTAINER_UID_BASE_MIN', container_uid_base_min)
 conf.set('CONTAINER_UID_BASE_MAX', container_uid_base_max)
-substs.set('containeruidbasemin', container_uid_base_min)
-substs.set('containeruidbasemax', container_uid_base_max)
 
 nobody_user = get_option('nobody-user')
 nobody_group = get_option('nobody-group')
@@ -827,39 +789,32 @@ endif
 
 conf.set_quoted('NOBODY_USER_NAME', nobody_user)
 conf.set_quoted('NOBODY_GROUP_NAME', nobody_group)
-substs.set('NOBODY_USER_NAME', nobody_user)
-substs.set('NOBODY_GROUP_NAME', nobody_group)
 
 tty_gid = get_option('tty-gid')
 conf.set('TTY_GID', tty_gid)
-substs.set('TTY_GID', tty_gid)
 
 # Ensure provided GID argument is numeric, otherwise fall back to default assignment
 users_gid = get_option('users-gid')
-substs.set('USERS_GID', users_gid < 0 ? '-' : users_gid)
+conf.set('USERS_GID', users_gid < 0 ? '-' : users_gid)
 
 conf.set10('ENABLE_ADM_GROUP', get_option('adm-group'))
 conf.set10('ENABLE_WHEEL_GROUP', get_option('wheel-group'))
 
 dev_kvm_mode = get_option('dev-kvm-mode')
-substs.set('DEV_KVM_MODE', dev_kvm_mode)
+conf.set_quoted('DEV_KVM_MODE', dev_kvm_mode) # FIXME: convert to 0o… notation
 conf.set10('DEV_KVM_UACCESS', dev_kvm_mode != '0666')
 group_render_mode = get_option('group-render-mode')
-substs.set('GROUP_RENDER_MODE', group_render_mode)
+conf.set_quoted('GROUP_RENDER_MODE', group_render_mode)
 conf.set10('GROUP_RENDER_UACCESS', group_render_mode != '0666')
 
 kill_user_processes = get_option('default-kill-user-processes')
 conf.set10('KILL_USER_PROCESSES', kill_user_processes)
-conf.set_quoted('KILL_USER_PROCESSES_YES_NO', kill_user_processes ? 'yes' : 'no')
-substs.set('KILL_USER_PROCESSES', kill_user_processes ? 'yes' : 'no')
 
 dns_servers = get_option('dns-servers')
 conf.set_quoted('DNS_SERVERS', dns_servers)
-substs.set('DNS_SERVERS', dns_servers)
 
 ntp_servers = get_option('ntp-servers')
 conf.set_quoted('NTP_SERVERS', ntp_servers)
-substs.set('NTP_SERVERS', ntp_servers)
 
 default_locale = get_option('default-locale')
 if default_locale == ''
@@ -873,24 +828,18 @@ endif
 conf.set_quoted('SYSTEMD_DEFAULT_LOCALE', default_locale)
 
 localegen_path = get_option('localegen-path')
-have = false
-writable = ''
 if localegen_path != ''
         conf.set_quoted('LOCALEGEN_PATH', localegen_path)
-        have = true
-        writable = ' /usr/lib/locale'
 endif
-substs.set('SERVICE_LOCALEGEN_WRITABLE', writable)
-conf.set10('HAVE_LOCALEGEN', have)
+conf.set10('HAVE_LOCALEGEN', localegen_path != '')
 
 conf.set_quoted('GETTEXT_PACKAGE', meson.project_name())
 
 service_watchdog = get_option('service-watchdog')
 watchdog_value = service_watchdog == '' ? '' : 'WatchdogSec=' + service_watchdog
-substs.set('SERVICE_WATCHDOG', watchdog_value)
+conf.set_quoted('SERVICE_WATCHDOG', watchdog_value)
 
-substs.set('SUSHELL', get_option('debug-shell'))
-substs.set('DEBUGTTY', get_option('debug-tty'))
+conf.set_quoted('SUSHELL', get_option('debug-shell'))
 conf.set_quoted('DEBUGTTY', get_option('debug-tty'))
 
 enable_debug_hashmap = false
@@ -1029,10 +978,8 @@ else
 endif
 conf.set10('HAVE_APPARMOR', have)
 
-smack_run_label = get_option('smack-run-label')
-if smack_run_label != ''
-        conf.set_quoted('SMACK_RUN_LABEL', smack_run_label)
-endif
+conf.set10('HAVE_SMACK_RUN_LABEL', get_option('smack-run-label') != '')
+conf.set_quoted('SMACK_RUN_LABEL', get_option('smack-run-label'))
 
 want_polkit = get_option('polkit')
 install_polkit = false
@@ -1405,7 +1352,7 @@ if default_dnssec != 'no' and conf.get('HAVE_GCRYPT') == 0
 endif
 conf.set('DEFAULT_DNSSEC_MODE',
          'DNSSEC_' + default_dnssec.underscorify().to_upper())
-substs.set('DEFAULT_DNSSEC_MODE', default_dnssec)
+conf.set_quoted('DEFAULT_DNSSEC_MODE_STR', default_dnssec)
 
 dns_over_tls = get_option('dns-over-tls')
 if dns_over_tls != 'false'
@@ -1446,17 +1393,17 @@ if default_dns_over_tls != 'no' and conf.get('ENABLE_DNS_OVER_TLS') == 0
 endif
 conf.set('DEFAULT_DNS_OVER_TLS_MODE',
          'DNS_OVER_TLS_' + default_dns_over_tls.underscorify().to_upper())
-substs.set('DEFAULT_DNS_OVER_TLS_MODE', default_dns_over_tls)
+conf.set_quoted('DEFAULT_DNS_OVER_TLS_MODE_STR', default_dns_over_tls)
 
 default_mdns = get_option('default-mdns')
 conf.set('DEFAULT_MDNS_MODE',
          'RESOLVE_SUPPORT_' + default_mdns.to_upper())
-substs.set('DEFAULT_MDNS_MODE', default_mdns)
+conf.set_quoted('DEFAULT_MDNS_MODE_STR', default_mdns)
 
 default_llmnr = get_option('default-llmnr')
 conf.set('DEFAULT_LLMNR_MODE',
          'RESOLVE_SUPPORT_' + default_llmnr.to_upper())
-substs.set('DEFAULT_LLMNR_MODE', default_llmnr)
+conf.set_quoted('DEFAULT_LLMNR_MODE_STR', default_llmnr)
 
 want_repart = get_option('repart')
 if want_repart != 'false'
@@ -1502,7 +1449,6 @@ conf.set10('ENABLE_PAM_HOME', have)
 
 have = get_option('oomd')
 conf.set10('ENABLE_OOMD', have)
-substs.set10('ENABLE_OOMD', have)
 
 want_remote = get_option('remote')
 if want_remote != 'false'
@@ -1564,7 +1510,6 @@ foreach term : ['analyze',
         have = get_option(term)
         name = 'ENABLE_' + term.underscorify().to_upper()
         conf.set10(name, have)
-        substs.set10(name, have)
 endforeach
 
 enable_sysusers = conf.get('ENABLE_SYSUSERS') == 1
@@ -1640,7 +1585,7 @@ generate_gperfs = find_program('tools/generate-gperfs.py')
 make_autosuspend_rules_py = find_program('tools/make-autosuspend-rules.py')
 make_directive_index_py = find_program('tools/make-directive-index.py')
 make_man_index_py = find_program('tools/make-man-index.py')
-meson_apply_m4 = find_program('tools/meson-apply-m4.sh')
+meson_render_jinja2 = find_program('tools/meson-render-jinja2.py')
 update_dbus_docs_py = find_program('tools/update-dbus-docs.py')
 update_hwdb_sh = find_program('tools/update-hwdb.sh')
 update_hwdb_autosuspend_sh = find_program('tools/update-hwdb-autosuspend.sh')
@@ -3702,7 +3647,7 @@ custom_target(
                    'cd @0@ && '.format(meson.build_root()) +
                    'python3 @0@/tools/update-man-rules.py $(find @0@ -wholename "*/man/*.xml") >t && '.format(project_source_root) +
                    'mv t @0@/man/rules/meson.build'.format(meson.current_source_dir())],
-        depend_files : custom_entities_ent)
+        depends : custom_entities_ent)
 
 ############################################################
 watchdog_opt = service_watchdog == '' ? 'disabled' : service_watchdog
@@ -3734,7 +3679,7 @@ status = [
         'debug shell:                       @0@ @ @1@'.format(get_option('debug-shell'),
                                                               get_option('debug-tty')),
         'TTY GID:                           @0@'.format(tty_gid),
-        'users GID:                         @0@'.format(substs.get('USERS_GID')),
+        'users GID:                         @0@'.format(conf.get('USERS_GID')),
         'system UIDs:                       <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_UID_MAX'),
                                                                         conf.get('SYSTEM_ALLOC_UID_MIN')),
         'system GIDs:                       <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_GID_MAX'),

rules.d/50-udev-default.rules.in

@@ -36,8 +36,8 @@ SUBSYSTEM=="dvb", GROUP="video"
 SUBSYSTEM=="media", GROUP="video"
 SUBSYSTEM=="cec", GROUP="video"
 
-SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="@GROUP_RENDER_MODE@"
-SUBSYSTEM=="kfd", GROUP="render", MODE="@GROUP_RENDER_MODE@"
+SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="{{GROUP_RENDER_MODE}}"
+SUBSYSTEM=="kfd", GROUP="render", MODE="{{GROUP_RENDER_MODE}}"
 
 SUBSYSTEM=="misc", KERNEL=="sgx_enclave", GROUP="sgx", MODE="0660"
 
@@ -89,14 +89,14 @@ KERNEL=="tun", MODE="0666", OPTIONS+="static_node=net/tun"
 KERNEL=="fuse", MODE="0666", OPTIONS+="static_node=fuse"
 
 # The static_node is required on s390x and ppc (they are using MODULE_ALIAS)
-KERNEL=="kvm", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=kvm"
+KERNEL=="kvm", GROUP="kvm", MODE="{{DEV_KVM_MODE}}", OPTIONS+="static_node=kvm"
 
 KERNEL=="vfio", MODE="0666", OPTIONS+="static_node=vfio/vfio"
 
 KERNEL=="vsock", MODE="0666"
-KERNEL=="vhost-vsock", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=vhost-vsock"
+KERNEL=="vhost-vsock", GROUP="kvm", MODE="{{DEV_KVM_MODE}}", OPTIONS+="static_node=vhost-vsock"
 
-KERNEL=="vhost-net", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=vhost-net"
+KERNEL=="vhost-net", GROUP="kvm", MODE="{{DEV_KVM_MODE}}", OPTIONS+="static_node=vhost-net"
 
 KERNEL=="udmabuf", GROUP="kvm"
 

rules.d/64-btrfs.rules.in

@@ -12,6 +12,6 @@ IMPORT{builtin}="btrfs ready $devnode"
 ENV{ID_BTRFS_READY}=="0", ENV{SYSTEMD_READY}="0"
 
 # reconsider pending devices in case when multidevice volume awaits
-ENV{ID_BTRFS_READY}=="1", RUN+="@rootbindir@/udevadm trigger -s block -p ID_BTRFS_READY=0"
+ENV{ID_BTRFS_READY}=="1", RUN+="{{ROOTBINDIR}}/udevadm trigger -s block -p ID_BTRFS_READY=0"
 
 LABEL="btrfs_end"

rules.d/99-systemd.rules.in

@@ -57,7 +57,7 @@ SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", ENV{ID_USB_INTERFACES}=="*:0701??:
 SUBSYSTEM=="udc", ACTION=="add", TAG+="systemd", ENV{SYSTEMD_WANTS}+="usb-gadget.target"
 
 # Apply sysctl variables to network devices (and only to those) as they appear.
-ACTION=="add", SUBSYSTEM=="net", KERNEL!="lo", RUN+="@rootlibexecdir@/systemd-sysctl --prefix=/net/ipv4/conf/$name --prefix=/net/ipv4/neigh/$name --prefix=/net/ipv6/conf/$name --prefix=/net/ipv6/neigh/$name"
+ACTION=="add", SUBSYSTEM=="net", KERNEL!="lo", RUN+="{{ROOTLIBEXECDIR}}/systemd-sysctl --prefix=/net/ipv4/conf/$name --prefix=/net/ipv4/neigh/$name --prefix=/net/ipv6/conf/$name --prefix=/net/ipv6/neigh/$name"
 
 # Pull in backlight save/restore for all backlight devices and
 # keyboard backlights

rules.d/meson.build

@@ -42,18 +42,17 @@ install_data(rules,
 
 all_rules = rules
 
-rules_in = '''
-        50-udev-default.rules
-        64-btrfs.rules
-        99-systemd.rules
-'''.split()
+rules_in = ['50-udev-default.rules',
+            '64-btrfs.rules',
+            '99-systemd.rules']
 
 foreach file : rules_in
-        gen = configure_file(
+        all_rules += custom_target(
+                file,
                 input : file + '.in',
-                output : file,
-                configuration : substs)
-        install_data(gen,
-                     install_dir : udevrulesdir)
-        all_rules += gen
+                output: file,
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
+                capture : true,
+                install : true,
+                install_dir : udevrulesdir)
 endforeach

shell-completion/bash/meson.build

@@ -10,45 +10,45 @@ if bashcompletiondir == ''
         endif
 endif
 
-if bashcompletiondir != 'no'
-        bash_systemctl = configure_file(
-                input : 'systemctl.in',
-                output : 'systemctl',
-                configuration : substs)
+custom_target(
+        'systemctl',
+        input : 'systemctl.in',
+        output : 'systemctl',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : bashcompletiondir != 'no',
+        install_dir : bashcompletiondir)
 
-        items = [['busctl',              ''],
-                 ['journalctl',          ''],
-                 ['systemd-analyze',     ''],
-                 ['systemd-cat',         ''],
-                 ['systemd-cgls',        ''],
-                 ['systemd-cgtop',       ''],
-                 ['systemd-delta',       ''],
-                 ['systemd-detect-virt', ''],
-                 ['systemd-id128',       ''],
-                 ['systemd-nspawn',      ''],
-                 ['systemd-path',        ''],
-                 ['systemd-run',         ''],
-                 ['udevadm',             ''],
-                 ['kernel-install',      ''],
-                 [bash_systemctl,        ''],
-                 ['bootctl',             'ENABLE_EFI'],
-                 ['coredumpctl',         'ENABLE_COREDUMP'],
-                 ['homectl',             'ENABLE_HOMED'],
-                 ['hostnamectl',         'ENABLE_HOSTNAMED'],
-                 ['localectl',           'ENABLE_LOCALED'],
-                 ['loginctl',            'ENABLE_LOGIND'],
-                 ['machinectl',          'ENABLE_MACHINED'],
-                 ['networkctl',          'ENABLE_NETWORKD'],
-                 ['portablectl',         'ENABLE_PORTABLED'],
-                 ['resolvectl',          'ENABLE_RESOLVE'],
-                 ['systemd-resolve',     'ENABLE_RESOLVE'],
-                 ['timedatectl',         'ENABLE_TIMEDATED'],
-                ]
+items = [['busctl',              ''],
+         ['journalctl',          ''],
+         ['systemd-analyze',     ''],
+         ['systemd-cat',         ''],
+         ['systemd-cgls',        ''],
+         ['systemd-cgtop',       ''],
+         ['systemd-delta',       ''],
+         ['systemd-detect-virt', ''],
+         ['systemd-id128',       ''],
+         ['systemd-nspawn',      ''],
+         ['systemd-path',        ''],
+         ['systemd-run',         ''],
+         ['udevadm',             ''],
+         ['kernel-install',      ''],
+         ['bootctl',             'ENABLE_EFI'],
+         ['coredumpctl',         'ENABLE_COREDUMP'],
+         ['homectl',             'ENABLE_HOMED'],
+         ['hostnamectl',         'ENABLE_HOSTNAMED'],
+         ['localectl',           'ENABLE_LOCALED'],
+         ['loginctl',            'ENABLE_LOGIND'],
+         ['machinectl',          'ENABLE_MACHINED'],
+         ['networkctl',          'ENABLE_NETWORKD'],
+         ['portablectl',         'ENABLE_PORTABLED'],
+         ['resolvectl',          'ENABLE_RESOLVE'],
+         ['systemd-resolve',     'ENABLE_RESOLVE'],
+         ['timedatectl',         'ENABLE_TIMEDATED']]
 
-        foreach item : items
-                if item[1] == '' or conf.get(item[1]) == 1
-                        install_data(item[0],
-                                     install_dir : bashcompletiondir)
-                endif
-        endforeach
-endif
+foreach item : items
+        if bashcompletiondir != 'no' and (item[1] == '' or conf.get(item[1]) == 1)
+                install_data(item[0],
+                             install_dir : bashcompletiondir)
+        endif
+endforeach

shell-completion/bash/systemctl.in

@@ -11,7 +11,7 @@ __systemctl() {
 }
 
 __systemd_properties() {
-    @rootlibexecdir@/systemd --dump-bus-properties
+    {{ROOTLIBEXECDIR}}/systemd --dump-bus-properties
 }
 
 __contains_word () {
@@ -21,6 +21,7 @@ __contains_word () {
     done
 }
 
+{% raw -%}
 __filter_units_by_properties () {
     local mode=$1 properties=$2; shift 2
     local units=("$@")
@@ -50,6 +51,7 @@ __filter_units_by_properties () {
         echo $names
     fi
 }
+{% endraw %}
 
 __get_all_units      () { { __systemctl $1 list-unit-files "$2*"; __systemctl $1 list-units --all "$2*"; } \
                               | { while read -r a b; do echo " $a"; done; }; }

shell-completion/zsh/_systemctl.in

@@ -433,7 +433,7 @@ done
         if ( [[ ${+_sys_all_properties} -eq 0 ]] || _cache_invalid SYS_ALL_PROPERTIES$_sys_service_mgr ) ||
                ! _retrieve_cache SYS_ALL_PROPERTIES$_sys_service_mgr;
         then
-            _sys_all_properties=( ${${(M)${(f)"$(@rootlibexecdir@/systemd --dump-bus-properties)"}}} )
+            _sys_all_properties=( ${${(M)${(f)"$({{ROOTLIBEXECDIR}}/systemd --dump-bus-properties)"}}} )
             _store_cache SYS_ALL_PROPERTIES$_sys_service_mgr _sys_all_properties
         fi
         _values -s , "${_sys_all_properties[@]}"

shell-completion/zsh/meson.build

@@ -5,44 +5,44 @@ if zshcompletiondir == ''
         zshcompletiondir = join_paths(datadir, 'zsh/site-functions')
 endif
 
-if zshcompletiondir != 'no'
-        zsh_systemctl = configure_file(
-                input : '_systemctl.in',
-                output : '_systemctl',
-                configuration : substs)
+custom_target(
+        '_systemctl',
+        input : '_systemctl.in',
+        output : '_systemctl',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : zshcompletiondir != 'no',
+        install_dir : zshcompletiondir)
 
-        items = [['_busctl',                   ''],
-                 ['_journalctl',               ''],
-                 ['_systemd-analyze',          ''],
-                 ['_systemd-delta',            ''],
-                 ['_systemd-nspawn',           ''],
-                 ['_systemd',                  ''],
-                 ['_systemd-path',             ''],
-                 ['_systemd-run',              ''],
-                 ['_udevadm',                  ''],
-                 ['_kernel-install',           ''],
-                 ['_sd_hosts_or_user_at_host', ''],
-                 ['_sd_outputmodes',           ''],
-                 ['_sd_unit_files',            ''],
-                 ['_sd_machines',              ''],
-                 [zsh_systemctl,               ''],
-                 ['_bootctl',                  'ENABLE_EFI'],
-                 ['_coredumpctl',              'ENABLE_COREDUMP'],
-                 ['_hostnamectl',              'ENABLE_HOSTNAMED'],
-                 ['_localectl',                'ENABLE_LOCALED'],
-                 ['_loginctl',                 'ENABLE_LOGIND'],
-                 ['_machinectl',               'ENABLE_MACHINED'],
-                 ['_networkctl',               'ENABLE_NETWORKD'],
-                 ['_systemd-inhibit',          'ENABLE_LOGIND'],
-                 ['_resolvectl',               'ENABLE_RESOLVE'],
-                 ['_systemd-tmpfiles',         'ENABLE_TMPFILES'],
-                 ['_timedatectl',              'ENABLE_TIMEDATED'],
-                ]
+items = [['_busctl',                   ''],
+         ['_journalctl',               ''],
+         ['_systemd-analyze',          ''],
+         ['_systemd-delta',            ''],
+         ['_systemd-nspawn',           ''],
+         ['_systemd',                  ''],
+         ['_systemd-path',             ''],
+         ['_systemd-run',              ''],
+         ['_udevadm',                  ''],
+         ['_kernel-install',           ''],
+         ['_sd_hosts_or_user_at_host', ''],
+         ['_sd_outputmodes',           ''],
+         ['_sd_unit_files',            ''],
+         ['_sd_machines',              ''],
+         ['_bootctl',                  'ENABLE_EFI'],
+         ['_coredumpctl',              'ENABLE_COREDUMP'],
+         ['_hostnamectl',              'ENABLE_HOSTNAMED'],
+         ['_localectl',                'ENABLE_LOCALED'],
+         ['_loginctl',                 'ENABLE_LOGIND'],
+         ['_machinectl',               'ENABLE_MACHINED'],
+         ['_networkctl',               'ENABLE_NETWORKD'],
+         ['_systemd-inhibit',          'ENABLE_LOGIND'],
+         ['_resolvectl',               'ENABLE_RESOLVE'],
+         ['_systemd-tmpfiles',         'ENABLE_TMPFILES'],
+         ['_timedatectl',              'ENABLE_TIMEDATED']]
 
-        foreach item : items
-                if item[1] == '' or conf.get(item[1]) == 1
-                        install_data(item[0],
-                                     install_dir : zshcompletiondir)
-                endif
-        endforeach
-endif
+foreach item : items
+        if zshcompletiondir != 'no' and (item[1] == '' or conf.get(item[1]) == 1)
+                install_data(item[0],
+                             install_dir : zshcompletiondir)
+        endif
+endforeach

src/basic/fileio.c

@@ -1391,7 +1391,7 @@ int rename_and_apply_smack_floor_label(const char *from, const char *to) {
         if (rename(from, to) < 0)
                 return -errno;
 
-#ifdef SMACK_RUN_LABEL
+#if HAVE_SMACK_RUN_LABEL
         r = mac_smack_apply(to, SMACK_ATTR_ACCESS, SMACK_FLOOR_LABEL);
         if (r < 0)
                 return r;

src/basic/path-lookup.c

@@ -622,7 +622,7 @@ int lookup_paths_init(
                                         STRV_IFNOTNULL(runtime_attached),
                                         STRV_IFNOTNULL(generator),
                                         "/usr/local/lib/systemd/system",
-                                        SYSTEM_DATA_UNIT_PATH,
+                                        SYSTEM_DATA_UNIT_DIR,
                                         "/usr/lib/systemd/system",
                                         STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
                                         STRV_IFNOTNULL(generator_late));

src/boot/bless-boot-generator.c

@@ -62,7 +62,7 @@ int main(int argc, char *argv[]) {
          * even emergency.target. */
         p = strjoina(arg_dest, "/" SPECIAL_BASIC_TARGET ".wants/systemd-bless-boot.service");
         (void) mkdir_parents(p, 0755);
-        if (symlink(SYSTEM_DATA_UNIT_PATH "/systemd-bless-boot.service", p) < 0) {
+        if (symlink(SYSTEM_DATA_UNIT_DIR "/systemd-bless-boot.service", p) < 0) {
                 log_error_errno(errno, "Failed to create symlink '%s': %m", p);
                 return EXIT_FAILURE;
         }

src/boot/efi/meson.build

@@ -104,8 +104,8 @@ if have_gnu_efi
 
         if get_option('sbat-distro') != ''
                 efi_conf.set_quoted('SBAT_PROJECT', meson.project_name())
-                efi_conf.set_quoted('PROJECT_VERSION', substs.get('PROJECT_VERSION'))
-                efi_conf.set_quoted('PROJECT_URL', substs.get('PROJECT_URL'))
+                efi_conf.set_quoted('PROJECT_VERSION', meson.project_version())
+                efi_conf.set('PROJECT_URL', conf.get('PROJECT_URL'))
                 if get_option('sbat-distro-generation') < 1
                        error('SBAT Distro Generation must be a positive integer')
                 endif

src/core/load-fragment-gperf.gperf.in

@@ -1,4 +1,238 @@
-m4_dnl SPDX-License-Identifier: LGPL-2.1-or-later
+{# SPDX-License-Identifier: LGPL-2.1-or-later #}
+
+{%- macro EXEC_CONTEXT_CONFIG_ITEMS(type) -%}
+{# Define the context options only once #}
+{{type}}.WorkingDirectory,                 config_parse_working_directory,              0,                                  offsetof({{type}}, exec_context)
+{{type}}.RootDirectory,                    config_parse_unit_path_printf,               true,                               offsetof({{type}}, exec_context.root_directory)
+{{type}}.RootImage,                        config_parse_unit_path_printf,               true,                               offsetof({{type}}, exec_context.root_image)
+{{type}}.RootImageOptions,                 config_parse_root_image_options,             0,                                  offsetof({{type}}, exec_context)
+{{type}}.RootHash,                         config_parse_exec_root_hash,                 0,                                  offsetof({{type}}, exec_context)
+{{type}}.RootHashSignature,                config_parse_exec_root_hash_sig,             0,                                  offsetof({{type}}, exec_context)
+{{type}}.RootVerity,                       config_parse_unit_path_printf,               true,                               offsetof({{type}}, exec_context.root_verity)
+{{type}}.ExtensionImages,                  config_parse_extension_images,               0,                                  offsetof({{type}}, exec_context)
+{{type}}.MountImages,                      config_parse_mount_images,                   0,                                  offsetof({{type}}, exec_context)
+{{type}}.User,                             config_parse_user_group_compat,              0,                                  offsetof({{type}}, exec_context.user)
+{{type}}.Group,                            config_parse_user_group_compat,              0,                                  offsetof({{type}}, exec_context.group)
+{{type}}.SupplementaryGroups,              config_parse_user_group_strv_compat,         0,                                  offsetof({{type}}, exec_context.supplementary_groups)
+{{type}}.Nice,                             config_parse_exec_nice,                      0,                                  offsetof({{type}}, exec_context)
+{{type}}.OOMScoreAdjust,                   config_parse_exec_oom_score_adjust,          0,                                  offsetof({{type}}, exec_context)
+{{type}}.CoredumpFilter,                   config_parse_exec_coredump_filter,           0,                                  offsetof({{type}}, exec_context)
+{{type}}.IOSchedulingClass,                config_parse_exec_io_class,                  0,                                  offsetof({{type}}, exec_context)
+{{type}}.IOSchedulingPriority,             config_parse_exec_io_priority,               0,                                  offsetof({{type}}, exec_context)
+{{type}}.CPUSchedulingPolicy,              config_parse_exec_cpu_sched_policy,          0,                                  offsetof({{type}}, exec_context)
+{{type}}.CPUSchedulingPriority,            config_parse_exec_cpu_sched_prio,            0,                                  offsetof({{type}}, exec_context)
+{{type}}.CPUSchedulingResetOnFork,         config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.cpu_sched_reset_on_fork)
+{{type}}.CPUAffinity,                      config_parse_exec_cpu_affinity,              0,                                  offsetof({{type}}, exec_context)
+{{type}}.NUMAPolicy,                       config_parse_numa_policy,                    0,                                  offsetof({{type}}, exec_context.numa_policy.type)
+{{type}}.NUMAMask,                         config_parse_numa_mask,                      0,                                  offsetof({{type}}, exec_context.numa_policy)
+{{type}}.UMask,                            config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.umask)
+{{type}}.Environment,                      config_parse_environ,                        0,                                  offsetof({{type}}, exec_context.environment)
+{{type}}.EnvironmentFile,                  config_parse_unit_env_file,                  0,                                  offsetof({{type}}, exec_context.environment_files)
+{{type}}.PassEnvironment,                  config_parse_pass_environ,                   0,                                  offsetof({{type}}, exec_context.pass_environment)
+{{type}}.UnsetEnvironment,                 config_parse_unset_environ,                  0,                                  offsetof({{type}}, exec_context.unset_environment)
+{{type}}.DynamicUser,                      config_parse_bool,                           true,                               offsetof({{type}}, exec_context.dynamic_user)
+{{type}}.RemoveIPC,                        config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.remove_ipc)
+{{type}}.StandardInput,                    config_parse_exec_input,                     0,                                  offsetof({{type}}, exec_context)
+{{type}}.StandardOutput,                   config_parse_exec_output,                    0,                                  offsetof({{type}}, exec_context)
+{{type}}.StandardError,                    config_parse_exec_output,                    0,                                  offsetof({{type}}, exec_context)
+{{type}}.StandardInputText,                config_parse_exec_input_text,                0,                                  offsetof({{type}}, exec_context)
+{{type}}.StandardInputData,                config_parse_exec_input_data,                0,                                  offsetof({{type}}, exec_context)
+{{type}}.TTYPath,                          config_parse_unit_path_printf,               0,                                  offsetof({{type}}, exec_context.tty_path)
+{{type}}.TTYReset,                         config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.tty_reset)
+{{type}}.TTYVHangup,                       config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.tty_vhangup)
+{{type}}.TTYVTDisallocate,                 config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.tty_vt_disallocate)
+{{type}}.SyslogIdentifier,                 config_parse_unit_string_printf,             0,                                  offsetof({{type}}, exec_context.syslog_identifier)
+{{type}}.SyslogFacility,                   config_parse_log_facility,                   0,                                  offsetof({{type}}, exec_context.syslog_priority)
+{{type}}.SyslogLevel,                      config_parse_log_level,                      0,                                  offsetof({{type}}, exec_context.syslog_priority)
+{{type}}.SyslogLevelPrefix,                config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.syslog_level_prefix)
+{{type}}.LogLevelMax,                      config_parse_log_level,                      0,                                  offsetof({{type}}, exec_context.log_level_max)
+{{type}}.LogRateLimitIntervalSec,          config_parse_sec,                            0,                                  offsetof({{type}}, exec_context.log_ratelimit_interval_usec)
+{{type}}.LogRateLimitBurst,                config_parse_unsigned,                       0,                                  offsetof({{type}}, exec_context.log_ratelimit_burst)
+{{type}}.LogExtraFields,                   config_parse_log_extra_fields,               0,                                  offsetof({{type}}, exec_context)
+{{type}}.Capabilities,                     config_parse_warn_compat,                    DISABLED_LEGACY,                    offsetof({{type}}, exec_context)
+{{type}}.SecureBits,                       config_parse_exec_secure_bits,               0,                                  offsetof({{type}}, exec_context.secure_bits)
+{{type}}.CapabilityBoundingSet,            config_parse_capability_set,                 0,                                  offsetof({{type}}, exec_context.capability_bounding_set)
+{{type}}.AmbientCapabilities,              config_parse_capability_set,                 0,                                  offsetof({{type}}, exec_context.capability_ambient_set)
+{{type}}.TimerSlackNSec,                   config_parse_nsec,                           0,                                  offsetof({{type}}, exec_context.timer_slack_nsec)
+{{type}}.NoNewPrivileges,                  config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.no_new_privileges)
+{{type}}.KeyringMode,                      config_parse_exec_keyring_mode,              0,                                  offsetof({{type}}, exec_context.keyring_mode)
+{{type}}.ProtectProc,                      config_parse_protect_proc,                   0,                                  offsetof({{type}}, exec_context.protect_proc)
+{{type}}.ProcSubset,                       config_parse_proc_subset,                    0,                                  offsetof({{type}}, exec_context.proc_subset)
+{% if HAVE_SECCOMP %}
+{{type}}.SystemCallFilter,                 config_parse_syscall_filter,                 0,                                  offsetof({{type}}, exec_context)
+{{type}}.SystemCallArchitectures,          config_parse_syscall_archs,                  0,                                  offsetof({{type}}, exec_context.syscall_archs)
+{{type}}.SystemCallErrorNumber,            config_parse_syscall_errno,                  0,                                  offsetof({{type}}, exec_context)
+{{type}}.SystemCallLog,                    config_parse_syscall_log,                    0,                                  offsetof({{type}}, exec_context)
+{{type}}.MemoryDenyWriteExecute,           config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.memory_deny_write_execute)
+{{type}}.RestrictNamespaces,               config_parse_restrict_namespaces,            0,                                  offsetof({{type}}, exec_context)
+{{type}}.RestrictRealtime,                 config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.restrict_realtime)
+{{type}}.RestrictSUIDSGID,                 config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.restrict_suid_sgid)
+{{type}}.RestrictAddressFamilies,          config_parse_address_families,               0,                                  offsetof({{type}}, exec_context)
+{{type}}.LockPersonality,                  config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.lock_personality)
+{% else %}
+{{type}}.SystemCallFilter,                 config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.SystemCallArchitectures,          config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.SystemCallErrorNumber,            config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.SystemCallLog,                    config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.MemoryDenyWriteExecute,           config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.RestrictNamespaces,               config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.RestrictRealtime,                 config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.RestrictSUIDSGID,                 config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.RestrictAddressFamilies,          config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{{type}}.LockPersonality,                  config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{{type}}.LimitCPU,                         config_parse_rlimit,                         RLIMIT_CPU,                         offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitFSIZE,                       config_parse_rlimit,                         RLIMIT_FSIZE,                       offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitDATA,                        config_parse_rlimit,                         RLIMIT_DATA,                        offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitSTACK,                       config_parse_rlimit,                         RLIMIT_STACK,                       offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitCORE,                        config_parse_rlimit,                         RLIMIT_CORE,                        offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitRSS,                         config_parse_rlimit,                         RLIMIT_RSS,                         offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitNOFILE,                      config_parse_rlimit,                         RLIMIT_NOFILE,                      offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitAS,                          config_parse_rlimit,                         RLIMIT_AS,                          offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitNPROC,                       config_parse_rlimit,                         RLIMIT_NPROC,                       offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitMEMLOCK,                     config_parse_rlimit,                         RLIMIT_MEMLOCK,                     offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitLOCKS,                       config_parse_rlimit,                         RLIMIT_LOCKS,                       offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitSIGPENDING,                  config_parse_rlimit,                         RLIMIT_SIGPENDING,                  offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitMSGQUEUE,                    config_parse_rlimit,                         RLIMIT_MSGQUEUE,                    offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitNICE,                        config_parse_rlimit,                         RLIMIT_NICE,                        offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitRTPRIO,                      config_parse_rlimit,                         RLIMIT_RTPRIO,                      offsetof({{type}}, exec_context.rlimit)
+{{type}}.LimitRTTIME,                      config_parse_rlimit,                         RLIMIT_RTTIME,                      offsetof({{type}}, exec_context.rlimit)
+{{type}}.ReadWriteDirectories,             config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.read_write_paths)
+{{type}}.ReadOnlyDirectories,              config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.read_only_paths)
+{{type}}.InaccessibleDirectories,          config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.inaccessible_paths)
+{{type}}.ReadWritePaths,                   config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.read_write_paths)
+{{type}}.ReadOnlyPaths,                    config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.read_only_paths)
+{{type}}.InaccessiblePaths,                config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.inaccessible_paths)
+{{type}}.ExecPaths,                        config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.exec_paths)
+{{type}}.NoExecPaths,                      config_parse_namespace_path_strv,            0,                                  offsetof({{type}}, exec_context.no_exec_paths)
+{{type}}.BindPaths,                        config_parse_bind_paths,                     0,                                  offsetof({{type}}, exec_context)
+{{type}}.BindReadOnlyPaths,                config_parse_bind_paths,                     0,                                  offsetof({{type}}, exec_context)
+{{type}}.TemporaryFileSystem,              config_parse_temporary_filesystems,          0,                                  offsetof({{type}}, exec_context)
+{{type}}.PrivateTmp,                       config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_tmp)
+{{type}}.PrivateDevices,                   config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_devices)
+{{type}}.ProtectKernelTunables,            config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_kernel_tunables)
+{{type}}.ProtectKernelModules,             config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_kernel_modules)
+{{type}}.ProtectKernelLogs,                config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_kernel_logs)
+{{type}}.ProtectClock,                     config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_clock)
+{{type}}.ProtectControlGroups,             config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_control_groups)
+{{type}}.NetworkNamespacePath,             config_parse_unit_path_printf,               0,                                  offsetof({{type}}, exec_context.network_namespace_path)
+{{type}}.IPCNamespacePath,                 config_parse_unit_path_printf,               0,                                  offsetof({{type}}, exec_context.ipc_namespace_path)
+{{type}}.LogNamespace,                     config_parse_log_namespace,                  0,                                  offsetof({{type}}, exec_context)
+{{type}}.PrivateNetwork,                   config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_network)
+{{type}}.PrivateUsers,                     config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_users)
+{{type}}.PrivateMounts,                    config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_mounts)
+{{type}}.PrivateIPC,                       config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.private_ipc)
+{{type}}.ProtectSystem,                    config_parse_protect_system,                 0,                                  offsetof({{type}}, exec_context.protect_system)
+{{type}}.ProtectHome,                      config_parse_protect_home,                   0,                                  offsetof({{type}}, exec_context.protect_home)
+{{type}}.MountFlags,                       config_parse_exec_mount_flags,               0,                                  offsetof({{type}}, exec_context.mount_flags)
+{{type}}.MountAPIVFS,                      config_parse_exec_mount_apivfs,              0,                                  offsetof({{type}}, exec_context)
+{{type}}.Personality,                      config_parse_personality,                    0,                                  offsetof({{type}}, exec_context.personality)
+{{type}}.RuntimeDirectoryPreserve,         config_parse_runtime_preserve_mode,          0,                                  offsetof({{type}}, exec_context.runtime_directory_preserve_mode)
+{{type}}.RuntimeDirectoryMode,             config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_RUNTIME].mode)
+{{type}}.RuntimeDirectory,                 config_parse_exec_directories,               0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_RUNTIME].paths)
+{{type}}.StateDirectoryMode,               config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_STATE].mode)
+{{type}}.StateDirectory,                   config_parse_exec_directories,               0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_STATE].paths)
+{{type}}.CacheDirectoryMode,               config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_CACHE].mode)
+{{type}}.CacheDirectory,                   config_parse_exec_directories,               0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_CACHE].paths)
+{{type}}.LogsDirectoryMode,                config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_LOGS].mode)
+{{type}}.LogsDirectory,                    config_parse_exec_directories,               0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_LOGS].paths)
+{{type}}.ConfigurationDirectoryMode,       config_parse_mode,                           0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_CONFIGURATION].mode)
+{{type}}.ConfigurationDirectory,           config_parse_exec_directories,               0,                                  offsetof({{type}}, exec_context.directories[EXEC_DIRECTORY_CONFIGURATION].paths)
+{{type}}.SetCredential,                    config_parse_set_credential,                 0,                                  offsetof({{type}}, exec_context)
+{{type}}.LoadCredential,                   config_parse_load_credential,                0,                                  offsetof({{type}}, exec_context)
+{{type}}.TimeoutCleanSec,                  config_parse_sec,                            0,                                  offsetof({{type}}, exec_context.timeout_clean_usec)
+{% if HAVE_PAM %}
+{{type}}.PAMName,                          config_parse_unit_string_printf,             0,                                  offsetof({{type}}, exec_context.pam_name)
+{% else %}
+{{type}}.PAMName,                          config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{{type}}.IgnoreSIGPIPE,                    config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.ignore_sigpipe)
+{{type}}.UtmpIdentifier,                   config_parse_unit_string_printf,             0,                                  offsetof({{type}}, exec_context.utmp_id)
+{{type}}.UtmpMode,                         config_parse_exec_utmp_mode,                 0,                                  offsetof({{type}}, exec_context.utmp_mode)
+{% if HAVE_SELINUX %}
+{{type}}.SELinuxContext,                   config_parse_exec_selinux_context,           0,                                  offsetof({{type}}, exec_context)
+{% else %}
+{{type}}.SELinuxContext,                   config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{% if HAVE_APPARMOR %}
+{{type}}.AppArmorProfile,                  config_parse_exec_apparmor_profile,          0,                                  offsetof({{type}}, exec_context)
+{% else %}
+{{type}}.AppArmorProfile,                  config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{% if ENABLE_SMACK %}
+{{type}}.SmackProcessLabel,                config_parse_exec_smack_process_label,       0,                                  offsetof({{type}}, exec_context)
+{% else %}
+{{type}}.SmackProcessLabel,                config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{{type}}.ProtectHostname,                  config_parse_bool,                           0,                                  offsetof({{type}}, exec_context.protect_hostname)
+{%- endmacro -%}
+
+{%- macro KILL_CONTEXT_CONFIG_ITEMS(type) -%}
+{{type}}.SendSIGKILL,                      config_parse_bool,                           0,                                  offsetof({{type}}, kill_context.send_sigkill)
+{{type}}.SendSIGHUP,                       config_parse_bool,                           0,                                  offsetof({{type}}, kill_context.send_sighup)
+{{type}}.KillMode,                         config_parse_kill_mode,                      0,                                  offsetof({{type}}, kill_context.kill_mode)
+{{type}}.KillSignal,                       config_parse_signal,                         0,                                  offsetof({{type}}, kill_context.kill_signal)
+{{type}}.RestartKillSignal,                config_parse_signal,                         0,                                  offsetof({{type}}, kill_context.restart_kill_signal)
+{{type}}.FinalKillSignal,                  config_parse_signal,                         0,                                  offsetof({{type}}, kill_context.final_kill_signal)
+{{type}}.WatchdogSignal,                   config_parse_signal,                         0,                                  offsetof({{type}}, kill_context.watchdog_signal)
+{%- endmacro -%}
+
+{%- macro CGROUP_CONTEXT_CONFIG_ITEMS(type) -%}
+{{type}}.Slice,                            config_parse_unit_slice,                     0,                                  0
+{{type}}.AllowedCPUs,                      config_parse_allowed_cpus,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.AllowedMemoryNodes,               config_parse_allowed_mems,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.CPUAccounting,                    config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.cpu_accounting)
+{{type}}.CPUWeight,                        config_parse_cg_weight,                      0,                                  offsetof({{type}}, cgroup_context.cpu_weight)
+{{type}}.StartupCPUWeight,                 config_parse_cg_weight,                      0,                                  offsetof({{type}}, cgroup_context.startup_cpu_weight)
+{{type}}.CPUShares,                        config_parse_cpu_shares,                     0,                                  offsetof({{type}}, cgroup_context.cpu_shares)
+{{type}}.StartupCPUShares,                 config_parse_cpu_shares,                     0,                                  offsetof({{type}}, cgroup_context.startup_cpu_shares)
+{{type}}.CPUQuota,                         config_parse_cpu_quota,                      0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.CPUQuotaPeriodSec,                config_parse_sec_def_infinity,               0,                                  offsetof({{type}}, cgroup_context.cpu_quota_period_usec)
+{{type}}.MemoryAccounting,                 config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.memory_accounting)
+{{type}}.MemoryMin,                        config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.DefaultMemoryMin,                 config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.DefaultMemoryLow,                 config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.MemoryLow,                        config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.MemoryHigh,                       config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.MemoryMax,                        config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.MemorySwapMax,                    config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.MemoryLimit,                      config_parse_memory_limit,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.DeviceAllow,                      config_parse_device_allow,                   0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.DevicePolicy,                     config_parse_device_policy,                  0,                                  offsetof({{type}}, cgroup_context.device_policy)
+{{type}}.IOAccounting,                     config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.io_accounting)
+{{type}}.IOWeight,                         config_parse_cg_weight,                      0,                                  offsetof({{type}}, cgroup_context.io_weight)
+{{type}}.StartupIOWeight,                  config_parse_cg_weight,                      0,                                  offsetof({{type}}, cgroup_context.startup_io_weight)
+{{type}}.IODeviceWeight,                   config_parse_io_device_weight,               0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IOReadBandwidthMax,               config_parse_io_limit,                       0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IOWriteBandwidthMax,              config_parse_io_limit,                       0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IOReadIOPSMax,                    config_parse_io_limit,                       0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IOWriteIOPSMax,                   config_parse_io_limit,                       0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IODeviceLatencyTargetSec,         config_parse_io_device_latency,              0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.BlockIOAccounting,                config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.blockio_accounting)
+{{type}}.BlockIOWeight,                    config_parse_blockio_weight,                 0,                                  offsetof({{type}}, cgroup_context.blockio_weight)
+{{type}}.StartupBlockIOWeight,             config_parse_blockio_weight,                 0,                                  offsetof({{type}}, cgroup_context.startup_blockio_weight)
+{{type}}.BlockIODeviceWeight,              config_parse_blockio_device_weight,          0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.BlockIOReadBandwidth,             config_parse_blockio_bandwidth,              0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.BlockIOWriteBandwidth,            config_parse_blockio_bandwidth,              0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.TasksAccounting,                  config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.tasks_accounting)
+{{type}}.TasksMax,                         config_parse_tasks_max,                      0,                                  offsetof({{type}}, cgroup_context.tasks_max)
+{{type}}.Delegate,                         config_parse_delegate,                       0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.DisableControllers,               config_parse_disable_controllers,            0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.IPAccounting,                     config_parse_bool,                           0,                                  offsetof({{type}}, cgroup_context.ip_accounting)
+{{type}}.IPAddressAllow,                   config_parse_ip_address_access,              0,                                  offsetof({{type}}, cgroup_context.ip_address_allow)
+{{type}}.IPAddressDeny,                    config_parse_ip_address_access,              0,                                  offsetof({{type}}, cgroup_context.ip_address_deny)
+{{type}}.IPIngressFilterPath,              config_parse_ip_filter_bpf_progs,            0,                                  offsetof({{type}}, cgroup_context.ip_filters_ingress)
+{{type}}.IPEgressFilterPath,               config_parse_ip_filter_bpf_progs,            0,                                  offsetof({{type}}, cgroup_context.ip_filters_egress)
+{{type}}.ManagedOOMSwap,                   config_parse_managed_oom_mode,               0,                                  offsetof({{type}}, cgroup_context.moom_swap)
+{{type}}.ManagedOOMMemoryPressure,         config_parse_managed_oom_mode,               0,                                  offsetof({{type}}, cgroup_context.moom_mem_pressure)
+{{type}}.ManagedOOMMemoryPressureLimit,    config_parse_managed_oom_mem_pressure_limit, 0,                                  offsetof({{type}}, cgroup_context.moom_mem_pressure_limit)
+{{type}}.ManagedOOMPreference,             config_parse_managed_oom_preference,         0,                                  offsetof({{type}}, cgroup_context.moom_preference)
+{{type}}.NetClass,                         config_parse_warn_compat,                    DISABLED_LEGACY,                    0
+{{type}}.BPFProgram,                       config_parse_bpf_foreign_program,            0,                                  offsetof({{type}}, cgroup_context)
+{{type}}.SocketBindAllow,                  config_parse_cgroup_socket_bind,             0,                                  offsetof({{type}}, cgroup_context.socket_bind_allow)
+{{type}}.SocketBindDeny,                   config_parse_cgroup_socket_bind,             0,                                  offsetof({{type}}, cgroup_context.socket_bind_deny)
+{%- endmacro -%}
+
 %{
 #if __GNUC__ >= 7
 _Pragma("GCC diagnostic ignored \"-Wimplicit-fallthrough\"")
@@ -19,226 +253,6 @@ struct ConfigPerfItem;
 %struct-type
 %includes
 %%
-m4_dnl Define the context options only once
-m4_define(`EXEC_CONTEXT_CONFIG_ITEMS',
-`$1.WorkingDirectory,                    config_parse_working_directory,              0,                                  offsetof($1, exec_context)
-$1.RootDirectory,                        config_parse_unit_path_printf,               true,                               offsetof($1, exec_context.root_directory)
-$1.RootImage,                            config_parse_unit_path_printf,               true,                               offsetof($1, exec_context.root_image)
-$1.RootImageOptions,                     config_parse_root_image_options,             0,                                  offsetof($1, exec_context)
-$1.RootHash,                             config_parse_exec_root_hash,                 0,                                  offsetof($1, exec_context)
-$1.RootHashSignature,                    config_parse_exec_root_hash_sig,             0,                                  offsetof($1, exec_context)
-$1.RootVerity,                           config_parse_unit_path_printf,               true,                               offsetof($1, exec_context.root_verity)
-$1.ExtensionImages,                      config_parse_extension_images,               0,                                  offsetof($1, exec_context)
-$1.MountImages,                          config_parse_mount_images,                   0,                                  offsetof($1, exec_context)
-$1.User,                                 config_parse_user_group_compat,              0,                                  offsetof($1, exec_context.user)
-$1.Group,                                config_parse_user_group_compat,              0,                                  offsetof($1, exec_context.group)
-$1.SupplementaryGroups,                  config_parse_user_group_strv_compat,         0,                                  offsetof($1, exec_context.supplementary_groups)
-$1.Nice,                                 config_parse_exec_nice,                      0,                                  offsetof($1, exec_context)
-$1.OOMScoreAdjust,                       config_parse_exec_oom_score_adjust,          0,                                  offsetof($1, exec_context)
-$1.CoredumpFilter,                       config_parse_exec_coredump_filter,           0,                                  offsetof($1, exec_context)
-$1.IOSchedulingClass,                    config_parse_exec_io_class,                  0,                                  offsetof($1, exec_context)
-$1.IOSchedulingPriority,                 config_parse_exec_io_priority,               0,                                  offsetof($1, exec_context)
-$1.CPUSchedulingPolicy,                  config_parse_exec_cpu_sched_policy,          0,                                  offsetof($1, exec_context)
-$1.CPUSchedulingPriority,                config_parse_exec_cpu_sched_prio,            0,                                  offsetof($1, exec_context)
-$1.CPUSchedulingResetOnFork,             config_parse_bool,                           0,                                  offsetof($1, exec_context.cpu_sched_reset_on_fork)
-$1.CPUAffinity,                          config_parse_exec_cpu_affinity,              0,                                  offsetof($1, exec_context)
-$1.NUMAPolicy,                           config_parse_numa_policy,                    0,                                  offsetof($1, exec_context.numa_policy.type)
-$1.NUMAMask,                             config_parse_numa_mask,                      0,                                  offsetof($1, exec_context.numa_policy)
-$1.UMask,                                config_parse_mode,                           0,                                  offsetof($1, exec_context.umask)
-$1.Environment,                          config_parse_environ,                        0,                                  offsetof($1, exec_context.environment)
-$1.EnvironmentFile,                      config_parse_unit_env_file,                  0,                                  offsetof($1, exec_context.environment_files)
-$1.PassEnvironment,                      config_parse_pass_environ,                   0,                                  offsetof($1, exec_context.pass_environment)
-$1.UnsetEnvironment,                     config_parse_unset_environ,                  0,                                  offsetof($1, exec_context.unset_environment)
-$1.DynamicUser,                          config_parse_bool,                           true,                               offsetof($1, exec_context.dynamic_user)
-$1.RemoveIPC,                            config_parse_bool,                           0,                                  offsetof($1, exec_context.remove_ipc)
-$1.StandardInput,                        config_parse_exec_input,                     0,                                  offsetof($1, exec_context)
-$1.StandardOutput,                       config_parse_exec_output,                    0,                                  offsetof($1, exec_context)
-$1.StandardError,                        config_parse_exec_output,                    0,                                  offsetof($1, exec_context)
-$1.StandardInputText,                    config_parse_exec_input_text,                0,                                  offsetof($1, exec_context)
-$1.StandardInputData,                    config_parse_exec_input_data,                0,                                  offsetof($1, exec_context)
-$1.TTYPath,                              config_parse_unit_path_printf,               0,                                  offsetof($1, exec_context.tty_path)
-$1.TTYReset,                             config_parse_bool,                           0,                                  offsetof($1, exec_context.tty_reset)
-$1.TTYVHangup,                           config_parse_bool,                           0,                                  offsetof($1, exec_context.tty_vhangup)
-$1.TTYVTDisallocate,                     config_parse_bool,                           0,                                  offsetof($1, exec_context.tty_vt_disallocate)
-$1.SyslogIdentifier,                     config_parse_unit_string_printf,             0,                                  offsetof($1, exec_context.syslog_identifier)
-$1.SyslogFacility,                       config_parse_log_facility,                   0,                                  offsetof($1, exec_context.syslog_priority)
-$1.SyslogLevel,                          config_parse_log_level,                      0,                                  offsetof($1, exec_context.syslog_priority)
-$1.SyslogLevelPrefix,                    config_parse_bool,                           0,                                  offsetof($1, exec_context.syslog_level_prefix)
-$1.LogLevelMax,                          config_parse_log_level,                      0,                                  offsetof($1, exec_context.log_level_max)
-$1.LogRateLimitIntervalSec,              config_parse_sec,                            0,                                  offsetof($1, exec_context.log_ratelimit_interval_usec)
-$1.LogRateLimitBurst,                    config_parse_unsigned,                       0,                                  offsetof($1, exec_context.log_ratelimit_burst)
-$1.LogExtraFields,                       config_parse_log_extra_fields,               0,                                  offsetof($1, exec_context)
-$1.Capabilities,                         config_parse_warn_compat,                    DISABLED_LEGACY,                    offsetof($1, exec_context)
-$1.SecureBits,                           config_parse_exec_secure_bits,               0,                                  offsetof($1, exec_context.secure_bits)
-$1.CapabilityBoundingSet,                config_parse_capability_set,                 0,                                  offsetof($1, exec_context.capability_bounding_set)
-$1.AmbientCapabilities,                  config_parse_capability_set,                 0,                                  offsetof($1, exec_context.capability_ambient_set)
-$1.TimerSlackNSec,                       config_parse_nsec,                           0,                                  offsetof($1, exec_context.timer_slack_nsec)
-$1.NoNewPrivileges,                      config_parse_bool,                           0,                                  offsetof($1, exec_context.no_new_privileges)
-$1.KeyringMode,                          config_parse_exec_keyring_mode,              0,                                  offsetof($1, exec_context.keyring_mode)
-$1.ProtectProc,                          config_parse_protect_proc,                   0,                                  offsetof($1, exec_context.protect_proc)
-$1.ProcSubset,                           config_parse_proc_subset,                    0,                                  offsetof($1, exec_context.proc_subset)
-m4_ifdef(`HAVE_SECCOMP',
-`$1.SystemCallFilter,                    config_parse_syscall_filter,                 0,                                  offsetof($1, exec_context)
-$1.SystemCallArchitectures,              config_parse_syscall_archs,                  0,                                  offsetof($1, exec_context.syscall_archs)
-$1.SystemCallErrorNumber,                config_parse_syscall_errno,                  0,                                  offsetof($1, exec_context)
-$1.SystemCallLog,                        config_parse_syscall_log,                    0,                                  offsetof($1, exec_context)
-$1.MemoryDenyWriteExecute,               config_parse_bool,                           0,                                  offsetof($1, exec_context.memory_deny_write_execute)
-$1.RestrictNamespaces,                   config_parse_restrict_namespaces,            0,                                  offsetof($1, exec_context)
-$1.RestrictRealtime,                     config_parse_bool,                           0,                                  offsetof($1, exec_context.restrict_realtime)
-$1.RestrictSUIDSGID,                     config_parse_bool,                           0,                                  offsetof($1, exec_context.restrict_suid_sgid)
-$1.RestrictAddressFamilies,              config_parse_address_families,               0,                                  offsetof($1, exec_context)
-$1.LockPersonality,                      config_parse_bool,                           0,                                  offsetof($1, exec_context.lock_personality)',
-`$1.SystemCallFilter,                    config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.SystemCallArchitectures,              config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.SystemCallErrorNumber,                config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.SystemCallLog,                        config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.MemoryDenyWriteExecute,               config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.RestrictNamespaces,                   config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.RestrictRealtime,                     config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.RestrictSUIDSGID,                     config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.RestrictAddressFamilies,              config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-$1.LockPersonality,                      config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-$1.LimitCPU,                             config_parse_rlimit,                         RLIMIT_CPU,                         offsetof($1, exec_context.rlimit)
-$1.LimitFSIZE,                           config_parse_rlimit,                         RLIMIT_FSIZE,                       offsetof($1, exec_context.rlimit)
-$1.LimitDATA,                            config_parse_rlimit,                         RLIMIT_DATA,                        offsetof($1, exec_context.rlimit)
-$1.LimitSTACK,                           config_parse_rlimit,                         RLIMIT_STACK,                       offsetof($1, exec_context.rlimit)
-$1.LimitCORE,                            config_parse_rlimit,                         RLIMIT_CORE,                        offsetof($1, exec_context.rlimit)
-$1.LimitRSS,                             config_parse_rlimit,                         RLIMIT_RSS,                         offsetof($1, exec_context.rlimit)
-$1.LimitNOFILE,                          config_parse_rlimit,                         RLIMIT_NOFILE,                      offsetof($1, exec_context.rlimit)
-$1.LimitAS,                              config_parse_rlimit,                         RLIMIT_AS,                          offsetof($1, exec_context.rlimit)
-$1.LimitNPROC,                           config_parse_rlimit,                         RLIMIT_NPROC,                       offsetof($1, exec_context.rlimit)
-$1.LimitMEMLOCK,                         config_parse_rlimit,                         RLIMIT_MEMLOCK,                     offsetof($1, exec_context.rlimit)
-$1.LimitLOCKS,                           config_parse_rlimit,                         RLIMIT_LOCKS,                       offsetof($1, exec_context.rlimit)
-$1.LimitSIGPENDING,                      config_parse_rlimit,                         RLIMIT_SIGPENDING,                  offsetof($1, exec_context.rlimit)
-$1.LimitMSGQUEUE,                        config_parse_rlimit,                         RLIMIT_MSGQUEUE,                    offsetof($1, exec_context.rlimit)
-$1.LimitNICE,                            config_parse_rlimit,                         RLIMIT_NICE,                        offsetof($1, exec_context.rlimit)
-$1.LimitRTPRIO,                          config_parse_rlimit,                         RLIMIT_RTPRIO,                      offsetof($1, exec_context.rlimit)
-$1.LimitRTTIME,                          config_parse_rlimit,                         RLIMIT_RTTIME,                      offsetof($1, exec_context.rlimit)
-$1.ReadWriteDirectories,                 config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.read_write_paths)
-$1.ReadOnlyDirectories,                  config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.read_only_paths)
-$1.InaccessibleDirectories,              config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.inaccessible_paths)
-$1.ReadWritePaths,                       config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.read_write_paths)
-$1.ReadOnlyPaths,                        config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.read_only_paths)
-$1.InaccessiblePaths,                    config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.inaccessible_paths)
-$1.ExecPaths,                            config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.exec_paths)
-$1.NoExecPaths,                          config_parse_namespace_path_strv,            0,                                  offsetof($1, exec_context.no_exec_paths)
-$1.BindPaths,                            config_parse_bind_paths,                     0,                                  offsetof($1, exec_context)
-$1.BindReadOnlyPaths,                    config_parse_bind_paths,                     0,                                  offsetof($1, exec_context)
-$1.TemporaryFileSystem,                  config_parse_temporary_filesystems,          0,                                  offsetof($1, exec_context)
-$1.PrivateTmp,                           config_parse_bool,                           0,                                  offsetof($1, exec_context.private_tmp)
-$1.PrivateDevices,                       config_parse_bool,                           0,                                  offsetof($1, exec_context.private_devices)
-$1.ProtectKernelTunables,                config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_kernel_tunables)
-$1.ProtectKernelModules,                 config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_kernel_modules)
-$1.ProtectKernelLogs,                    config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_kernel_logs)
-$1.ProtectClock,                         config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_clock)
-$1.ProtectControlGroups,                 config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_control_groups)
-$1.NetworkNamespacePath,                 config_parse_unit_path_printf,               0,                                  offsetof($1, exec_context.network_namespace_path)
-$1.IPCNamespacePath,                     config_parse_unit_path_printf,               0,                                  offsetof($1, exec_context.ipc_namespace_path)
-$1.LogNamespace,                         config_parse_log_namespace,                  0,                                  offsetof($1, exec_context)
-$1.PrivateNetwork,                       config_parse_bool,                           0,                                  offsetof($1, exec_context.private_network)
-$1.PrivateUsers,                         config_parse_bool,                           0,                                  offsetof($1, exec_context.private_users)
-$1.PrivateMounts,                        config_parse_bool,                           0,                                  offsetof($1, exec_context.private_mounts)
-$1.PrivateIPC,                           config_parse_bool,                           0,                                  offsetof($1, exec_context.private_ipc)
-$1.ProtectSystem,                        config_parse_protect_system,                 0,                                  offsetof($1, exec_context.protect_system)
-$1.ProtectHome,                          config_parse_protect_home,                   0,                                  offsetof($1, exec_context.protect_home)
-$1.MountFlags,                           config_parse_exec_mount_flags,               0,                                  offsetof($1, exec_context.mount_flags)
-$1.MountAPIVFS,                          config_parse_exec_mount_apivfs,              0,                                  offsetof($1, exec_context)
-$1.Personality,                          config_parse_personality,                    0,                                  offsetof($1, exec_context.personality)
-$1.RuntimeDirectoryPreserve,             config_parse_runtime_preserve_mode,          0,                                  offsetof($1, exec_context.runtime_directory_preserve_mode)
-$1.RuntimeDirectoryMode,                 config_parse_mode,                           0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_RUNTIME].mode)
-$1.RuntimeDirectory,                     config_parse_exec_directories,               0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_RUNTIME].paths)
-$1.StateDirectoryMode,                   config_parse_mode,                           0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_STATE].mode)
-$1.StateDirectory,                       config_parse_exec_directories,               0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_STATE].paths)
-$1.CacheDirectoryMode,                   config_parse_mode,                           0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_CACHE].mode)
-$1.CacheDirectory,                       config_parse_exec_directories,               0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_CACHE].paths)
-$1.LogsDirectoryMode,                    config_parse_mode,                           0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_LOGS].mode)
-$1.LogsDirectory,                        config_parse_exec_directories,               0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_LOGS].paths)
-$1.ConfigurationDirectoryMode,           config_parse_mode,                           0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_CONFIGURATION].mode)
-$1.ConfigurationDirectory,               config_parse_exec_directories,               0,                                  offsetof($1, exec_context.directories[EXEC_DIRECTORY_CONFIGURATION].paths)
-$1.SetCredential,                        config_parse_set_credential,                 0,                                  offsetof($1, exec_context)
-$1.LoadCredential,                       config_parse_load_credential,                0,                                  offsetof($1, exec_context)
-$1.TimeoutCleanSec,                      config_parse_sec,                            0,                                  offsetof($1, exec_context.timeout_clean_usec)
-$1.ProtectHostname,                      config_parse_bool,                           0,                                  offsetof($1, exec_context.protect_hostname)
-m4_ifdef(`HAVE_PAM',
-`$1.PAMName,                             config_parse_unit_string_printf,             0,                                  offsetof($1, exec_context.pam_name)',
-`$1.PAMName,                             config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-$1.IgnoreSIGPIPE,                        config_parse_bool,                           0,                                  offsetof($1, exec_context.ignore_sigpipe)
-$1.UtmpIdentifier,                       config_parse_unit_string_printf,             0,                                  offsetof($1, exec_context.utmp_id)
-$1.UtmpMode,                             config_parse_exec_utmp_mode,                 0,                                  offsetof($1, exec_context.utmp_mode)
-m4_ifdef(`HAVE_SELINUX',
-`$1.SELinuxContext,                      config_parse_exec_selinux_context,           0,                                  offsetof($1, exec_context)',
-`$1.SELinuxContext,                      config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-m4_ifdef(`HAVE_APPARMOR',
-`$1.AppArmorProfile,                     config_parse_exec_apparmor_profile,          0,                                  offsetof($1, exec_context)',
-`$1.AppArmorProfile,                     config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-m4_ifdef(`ENABLE_SMACK',
-`$1.SmackProcessLabel,                   config_parse_exec_smack_process_label,       0,                                  offsetof($1, exec_context)',
-`$1.SmackProcessLabel,                   config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')'
-)m4_dnl
-m4_define(`KILL_CONTEXT_CONFIG_ITEMS',
-`$1.SendSIGKILL,                         config_parse_bool,                           0,                                  offsetof($1, kill_context.send_sigkill)
-$1.SendSIGHUP,                           config_parse_bool,                           0,                                  offsetof($1, kill_context.send_sighup)
-$1.KillMode,                             config_parse_kill_mode,                      0,                                  offsetof($1, kill_context.kill_mode)
-$1.KillSignal,                           config_parse_signal,                         0,                                  offsetof($1, kill_context.kill_signal)
-$1.RestartKillSignal,                    config_parse_signal,                         0,                                  offsetof($1, kill_context.restart_kill_signal)
-$1.FinalKillSignal,                      config_parse_signal,                         0,                                  offsetof($1, kill_context.final_kill_signal)
-$1.WatchdogSignal,                       config_parse_signal,                         0,                                  offsetof($1, kill_context.watchdog_signal)'
-)m4_dnl
-m4_define(`CGROUP_CONTEXT_CONFIG_ITEMS',
-`$1.Slice,                               config_parse_unit_slice,                     0,                                  0
-$1.AllowedCPUs,                          config_parse_allowed_cpus,                   0,                                  offsetof($1, cgroup_context)
-$1.AllowedMemoryNodes,                   config_parse_allowed_mems,                   0,                                  offsetof($1, cgroup_context)
-$1.CPUAccounting,                        config_parse_bool,                           0,                                  offsetof($1, cgroup_context.cpu_accounting)
-$1.CPUWeight,                            config_parse_cg_weight,                      0,                                  offsetof($1, cgroup_context.cpu_weight)
-$1.StartupCPUWeight,                     config_parse_cg_weight,                      0,                                  offsetof($1, cgroup_context.startup_cpu_weight)
-$1.CPUShares,                            config_parse_cpu_shares,                     0,                                  offsetof($1, cgroup_context.cpu_shares)
-$1.StartupCPUShares,                     config_parse_cpu_shares,                     0,                                  offsetof($1, cgroup_context.startup_cpu_shares)
-$1.CPUQuota,                             config_parse_cpu_quota,                      0,                                  offsetof($1, cgroup_context)
-$1.CPUQuotaPeriodSec,                    config_parse_sec_def_infinity,               0,                                  offsetof($1, cgroup_context.cpu_quota_period_usec)
-$1.MemoryAccounting,                     config_parse_bool,                           0,                                  offsetof($1, cgroup_context.memory_accounting)
-$1.MemoryMin,                            config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.DefaultMemoryMin,                     config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.DefaultMemoryLow,                     config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.MemoryLow,                            config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.MemoryHigh,                           config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.MemoryMax,                            config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.MemorySwapMax,                        config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.MemoryLimit,                          config_parse_memory_limit,                   0,                                  offsetof($1, cgroup_context)
-$1.DeviceAllow,                          config_parse_device_allow,                   0,                                  offsetof($1, cgroup_context)
-$1.DevicePolicy,                         config_parse_device_policy,                  0,                                  offsetof($1, cgroup_context.device_policy)
-$1.IOAccounting,                         config_parse_bool,                           0,                                  offsetof($1, cgroup_context.io_accounting)
-$1.IOWeight,                             config_parse_cg_weight,                      0,                                  offsetof($1, cgroup_context.io_weight)
-$1.StartupIOWeight,                      config_parse_cg_weight,                      0,                                  offsetof($1, cgroup_context.startup_io_weight)
-$1.IODeviceWeight,                       config_parse_io_device_weight,               0,                                  offsetof($1, cgroup_context)
-$1.IOReadBandwidthMax,                   config_parse_io_limit,                       0,                                  offsetof($1, cgroup_context)
-$1.IOWriteBandwidthMax,                  config_parse_io_limit,                       0,                                  offsetof($1, cgroup_context)
-$1.IOReadIOPSMax,                        config_parse_io_limit,                       0,                                  offsetof($1, cgroup_context)
-$1.IOWriteIOPSMax,                       config_parse_io_limit,                       0,                                  offsetof($1, cgroup_context)
-$1.IODeviceLatencyTargetSec,             config_parse_io_device_latency,              0,                                  offsetof($1, cgroup_context)
-$1.BlockIOAccounting,                    config_parse_bool,                           0,                                  offsetof($1, cgroup_context.blockio_accounting)
-$1.BlockIOWeight,                        config_parse_blockio_weight,                 0,                                  offsetof($1, cgroup_context.blockio_weight)
-$1.StartupBlockIOWeight,                 config_parse_blockio_weight,                 0,                                  offsetof($1, cgroup_context.startup_blockio_weight)
-$1.BlockIODeviceWeight,                  config_parse_blockio_device_weight,          0,                                  offsetof($1, cgroup_context)
-$1.BlockIOReadBandwidth,                 config_parse_blockio_bandwidth,              0,                                  offsetof($1, cgroup_context)
-$1.BlockIOWriteBandwidth,                config_parse_blockio_bandwidth,              0,                                  offsetof($1, cgroup_context)
-$1.TasksAccounting,                      config_parse_bool,                           0,                                  offsetof($1, cgroup_context.tasks_accounting)
-$1.TasksMax,                             config_parse_tasks_max,                      0,                                  offsetof($1, cgroup_context.tasks_max)
-$1.Delegate,                             config_parse_delegate,                       0,                                  offsetof($1, cgroup_context)
-$1.DisableControllers,                   config_parse_disable_controllers,            0,                                  offsetof($1, cgroup_context)
-$1.IPAccounting,                         config_parse_bool,                           0,                                  offsetof($1, cgroup_context.ip_accounting)
-$1.IPAddressAllow,                       config_parse_ip_address_access,              0,                                  offsetof($1, cgroup_context.ip_address_allow)
-$1.IPAddressDeny,                        config_parse_ip_address_access,              0,                                  offsetof($1, cgroup_context.ip_address_deny)
-$1.IPIngressFilterPath,                  config_parse_ip_filter_bpf_progs,            0,                                  offsetof($1, cgroup_context.ip_filters_ingress)
-$1.IPEgressFilterPath,                   config_parse_ip_filter_bpf_progs,            0,                                  offsetof($1, cgroup_context.ip_filters_egress)
-$1.ManagedOOMSwap,                       config_parse_managed_oom_mode,               0,                                  offsetof($1, cgroup_context.moom_swap)
-$1.ManagedOOMMemoryPressure,             config_parse_managed_oom_mode,               0,                                  offsetof($1, cgroup_context.moom_mem_pressure)
-$1.ManagedOOMMemoryPressureLimit,        config_parse_managed_oom_mem_pressure_limit, 0,                                  offsetof($1, cgroup_context.moom_mem_pressure_limit)
-$1.ManagedOOMPreference,                 config_parse_managed_oom_preference,         0,                                  offsetof($1, cgroup_context.moom_preference)
-$1.NetClass,                             config_parse_warn_compat,                    DISABLED_LEGACY,                    0
-$1.BPFProgram,                           config_parse_bpf_foreign_program,            0,                                  offsetof($1, cgroup_context)
-$1.SocketBindAllow,                      config_parse_cgroup_socket_bind,             0,                                  offsetof($1, cgroup_context.socket_bind_allow)
-$1.SocketBindDeny,                       config_parse_cgroup_socket_bind,             0,                                  offsetof($1, cgroup_context.socket_bind_deny)'
-)m4_dnl
 Unit.Description,                        config_parse_unit_string_printf,             0,                                  offsetof(Unit, description)
 Unit.Documentation,                      config_parse_documentation,                  0,                                  offsetof(Unit, documentation)
 Unit.SourcePath,                         config_parse_unit_path_printf,               0,                                  offsetof(Unit, source_path)
@@ -266,7 +280,7 @@ Unit.RefuseManualStop,                   config_parse_bool,
 Unit.AllowIsolate,                       config_parse_bool,                           0,                                  offsetof(Unit, allow_isolate)
 Unit.DefaultDependencies,                config_parse_bool,                           0,                                  offsetof(Unit, default_dependencies)
 Unit.OnFailureJobMode,                   config_parse_job_mode,                       0,                                  offsetof(Unit, on_failure_job_mode)
-m4_dnl The following is a legacy alias name for compatibility
+{# The following is a legacy alias name for compatibility #}
 Unit.OnFailureIsolate,                   config_parse_job_mode_isolate,               0,                                  offsetof(Unit, on_failure_job_mode)
 Unit.IgnoreOnIsolate,                    config_parse_bool,                           0,                                  offsetof(Unit, ignore_on_isolate)
 Unit.IgnoreOnSnapshot,                   config_parse_warn_compat,                    DISABLED_LEGACY,                    0
@@ -275,7 +289,7 @@ Unit.JobRunningTimeoutSec,               config_parse_job_running_timeout_sec,
 Unit.JobTimeoutAction,                   config_parse_emergency_action,               0,                                  offsetof(Unit, job_timeout_action)
 Unit.JobTimeoutRebootArgument,           config_parse_unit_string_printf,             0,                                  offsetof(Unit, job_timeout_reboot_arg)
 Unit.StartLimitIntervalSec,              config_parse_sec,                            0,                                  offsetof(Unit, start_ratelimit.interval)
-m4_dnl The following is a legacy alias name for compatibility
+{# The following is a legacy alias name for compatibility #}
 Unit.StartLimitInterval,                 config_parse_sec,                            0,                                  offsetof(Unit, start_ratelimit.interval)
 Unit.StartLimitBurst,                    config_parse_unsigned,                       0,                                  offsetof(Unit, start_ratelimit.burst)
 Unit.StartLimitAction,                   config_parse_emergency_action,               0,                                  offsetof(Unit, start_limit_action)
@@ -338,7 +352,6 @@ Unit.AssertUser,                         config_parse_unit_condition_string,
 Unit.AssertGroup,                        config_parse_unit_condition_string,          CONDITION_GROUP,                    offsetof(Unit, asserts)
 Unit.AssertControlGroupController,       config_parse_unit_condition_string,          CONDITION_CONTROL_GROUP_CONTROLLER, offsetof(Unit, asserts)
 Unit.CollectMode,                        config_parse_collect_mode,                   0,                                  offsetof(Unit, collect_mode)
-m4_dnl
 Service.PIDFile,                         config_parse_pid_file,                       0,                                  offsetof(Service, pid_file)
 Service.ExecCondition,                   config_parse_exec,                           SERVICE_EXEC_CONDITION,             offsetof(Service, exec_command)
 Service.ExecStartPre,                    config_parse_exec,                           SERVICE_EXEC_START_PRE,             offsetof(Service, exec_command)
@@ -356,7 +369,7 @@ Service.TimeoutStartFailureMode,         config_parse_service_timeout_failure_mo
 Service.TimeoutStopFailureMode,          config_parse_service_timeout_failure_mode,   0,                                  offsetof(Service, timeout_stop_failure_mode)
 Service.RuntimeMaxSec,                   config_parse_sec,                            0,                                  offsetof(Service, runtime_max_usec)
 Service.WatchdogSec,                     config_parse_sec,                            0,                                  offsetof(Service, watchdog_usec)
-m4_dnl The following five only exist for compatibility, they moved into Unit, see above
+{# The following five only exist for compatibility, they moved into Unit, see above #}
 Service.StartLimitInterval,              config_parse_sec,                            0,                                  offsetof(Unit, start_ratelimit.interval)
 Service.StartLimitBurst,                 config_parse_unsigned,                       0,                                  offsetof(Unit, start_ratelimit.burst)
 Service.StartLimitAction,                config_parse_emergency_action,               0,                                  offsetof(Unit, start_limit_action)
@@ -382,10 +395,9 @@ Service.BusPolicy,                       config_parse_warn_compat,
 Service.USBFunctionDescriptors,          config_parse_unit_path_printf,               0,                                  offsetof(Service, usb_function_descriptors)
 Service.USBFunctionStrings,              config_parse_unit_path_printf,               0,                                  offsetof(Service, usb_function_strings)
 Service.OOMPolicy,                       config_parse_oom_policy,                     0,                                  offsetof(Service, oom_policy)
-EXEC_CONTEXT_CONFIG_ITEMS(Service)m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Service)m4_dnl
-KILL_CONTEXT_CONFIG_ITEMS(Service)m4_dnl
-m4_dnl
+{{ EXEC_CONTEXT_CONFIG_ITEMS('Service') }}
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Service') }}
+{{ KILL_CONTEXT_CONFIG_ITEMS('Service') }}
 Socket.ListenStream,                     config_parse_socket_listen,                  SOCKET_SOCKET,                      0
 Socket.ListenDatagram,                   config_parse_socket_listen,                  SOCKET_SOCKET,                      0
 Socket.ListenSequentialPacket,           config_parse_socket_listen,                  SOCKET_SOCKET,                      0
@@ -442,20 +454,23 @@ Socket.FileDescriptorName,               config_parse_fdname,
 Socket.Service,                          config_parse_socket_service,                 0,                                  0
 Socket.TriggerLimitIntervalSec,          config_parse_sec,                            0,                                  offsetof(Socket, trigger_limit.interval)
 Socket.TriggerLimitBurst,                config_parse_unsigned,                       0,                                  offsetof(Socket, trigger_limit.burst)
-m4_ifdef(`ENABLE_SMACK',
-`Socket.SmackLabel,                      config_parse_unit_string_printf,             0,                                  offsetof(Socket, smack)
+{% if ENABLE_SMACK %}
+Socket.SmackLabel,                       config_parse_unit_string_printf,             0,                                  offsetof(Socket, smack)
 Socket.SmackLabelIPIn,                   config_parse_unit_string_printf,             0,                                  offsetof(Socket, smack_ip_in)
-Socket.SmackLabelIPOut,                  config_parse_unit_string_printf,             0,                                  offsetof(Socket, smack_ip_out)',
-`Socket.SmackLabel,                      config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+Socket.SmackLabelIPOut,                  config_parse_unit_string_printf,             0,                                  offsetof(Socket, smack_ip_out)
+{% else %}
+Socket.SmackLabel,                       config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
 Socket.SmackLabelIPIn,                   config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
-Socket.SmackLabelIPOut,                  config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-m4_ifdef(`HAVE_SELINUX',
-`Socket.SELinuxContextFromNet,           config_parse_bool,                           0,                                  offsetof(Socket, selinux_context_from_net)',
-`Socket.SELinuxContextFromNet,           config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0')
-EXEC_CONTEXT_CONFIG_ITEMS(Socket)m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Socket)m4_dnl
-KILL_CONTEXT_CONFIG_ITEMS(Socket)m4_dnl
-m4_dnl
+Socket.SmackLabelIPOut,                  config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{% if HAVE_SELINUX %}
+Socket.SELinuxContextFromNet,            config_parse_bool,                           0,                                  offsetof(Socket, selinux_context_from_net)
+{% else %}
+Socket.SELinuxContextFromNet,            config_parse_warn_compat,                    DISABLED_CONFIGURATION,             0
+{% endif %}
+{{ EXEC_CONTEXT_CONFIG_ITEMS('Socket') }}
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Socket') }}
+{{ KILL_CONTEXT_CONFIG_ITEMS('Socket') }}
 Mount.What,                              config_parse_unit_string_printf,             0,                                  offsetof(Mount, parameters_fragment.what)
 Mount.Where,                             config_parse_unit_path_printf,               0,                                  offsetof(Mount, where)
 Mount.Options,                           config_parse_unit_string_printf,             0,                                  offsetof(Mount, parameters_fragment.options)
@@ -466,22 +481,19 @@ Mount.SloppyOptions,                     config_parse_bool,
 Mount.LazyUnmount,                       config_parse_bool,                           0,                                  offsetof(Mount, lazy_unmount)
 Mount.ForceUnmount,                      config_parse_bool,                           0,                                  offsetof(Mount, force_unmount)
 Mount.ReadWriteOnly,                     config_parse_bool,                           0,                                  offsetof(Mount, read_write_only)
-EXEC_CONTEXT_CONFIG_ITEMS(Mount)m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Mount)m4_dnl
-KILL_CONTEXT_CONFIG_ITEMS(Mount)m4_dnl
-m4_dnl
+{{ EXEC_CONTEXT_CONFIG_ITEMS('Mount') }}
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Mount') }}
+{{ KILL_CONTEXT_CONFIG_ITEMS('Mount') }}
 Automount.Where,                         config_parse_unit_path_printf,               0,                                  offsetof(Automount, where)
 Automount.DirectoryMode,                 config_parse_mode,                           0,                                  offsetof(Automount, directory_mode)
 Automount.TimeoutIdleSec,                config_parse_sec_fix_0,                      0,                                  offsetof(Automount, timeout_idle_usec)
-m4_dnl
 Swap.What,                               config_parse_unit_path_printf,               0,                                  offsetof(Swap, parameters_fragment.what)
 Swap.Priority,                           config_parse_swap_priority,                  0,                                  0
 Swap.Options,                            config_parse_unit_string_printf,             0,                                  offsetof(Swap, parameters_fragment.options)
 Swap.TimeoutSec,                         config_parse_sec_fix_0,                      0,                                  offsetof(Swap, timeout_usec)
-EXEC_CONTEXT_CONFIG_ITEMS(Swap)m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Swap)m4_dnl
-KILL_CONTEXT_CONFIG_ITEMS(Swap)m4_dnl
-m4_dnl
+{{ EXEC_CONTEXT_CONFIG_ITEMS('Swap') }}
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Swap') }}
+{{ KILL_CONTEXT_CONFIG_ITEMS('Swap') }}
 Timer.OnCalendar,                        config_parse_timer,                          TIMER_CALENDAR,                     0
 Timer.OnActiveSec,                       config_parse_timer,                          TIMER_ACTIVE,                       0
 Timer.OnBootSec,                         config_parse_timer,                          TIMER_BOOT,                         0
@@ -497,7 +509,6 @@ Timer.FixedRandomDelay,                  config_parse_bool,
 Timer.AccuracySec,                       config_parse_sec,                            0,                                  offsetof(Timer, accuracy_usec)
 Timer.RandomizedDelaySec,                config_parse_sec,                            0,                                  offsetof(Timer, random_usec)
 Timer.Unit,                              config_parse_trigger_unit,                   0,                                  0
-m4_dnl
 Path.PathExists,                         config_parse_path_spec,                      0,                                  0
 Path.PathExistsGlob,                     config_parse_path_spec,                      0,                                  0
 Path.PathChanged,                        config_parse_path_spec,                      0,                                  0
@@ -506,14 +517,12 @@ Path.DirectoryNotEmpty,                  config_parse_path_spec,
 Path.Unit,                               config_parse_trigger_unit,                   0,                                  0
 Path.MakeDirectory,                      config_parse_bool,                           0,                                  offsetof(Path, make_directory)
 Path.DirectoryMode,                      config_parse_mode,                           0,                                  offsetof(Path, directory_mode)
-m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Slice)m4_dnl
-m4_dnl
-CGROUP_CONTEXT_CONFIG_ITEMS(Scope)m4_dnl
-KILL_CONTEXT_CONFIG_ITEMS(Scope)m4_dnl
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Slice') }}
+{{ CGROUP_CONTEXT_CONFIG_ITEMS('Scope') }}
+{{ KILL_CONTEXT_CONFIG_ITEMS('Scope') }}
 Scope.RuntimeMaxSec,                     config_parse_sec,                            0,                                  offsetof(Scope, runtime_max_usec)
 Scope.TimeoutStopSec,                    config_parse_sec,                            0,                                  offsetof(Scope, timeout_stop_usec)
-m4_dnl The [Install] section is ignored here.
+{# The [Install] section is ignored here #}
 Install.Alias,                           NULL,                                        0,                                  0
 Install.WantedBy,                        NULL,                                        0,                                  0
 Install.RequiredBy,                      NULL,                                        0,                                  0

src/core/meson.build

@@ -132,9 +132,9 @@ endif
 
 load_fragment_gperf_gperf = custom_target(
         'load-fragment-gperf.gperf',
-        input : 'load-fragment-gperf.gperf.m4',
+        input : 'load-fragment-gperf.gperf.in',
         output: 'load-fragment-gperf.gperf',
-        command : [meson_apply_m4, config_h, '@INPUT@'],
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
         capture : true)
 
 load_fragment_gperf_c = custom_target(
@@ -174,21 +174,23 @@ core_includes = [includes, include_directories('.')]
 
 systemd_sources = files('main.c')
 
-in_files = [['system.conf',      pkgsysconfdir],
-            ['user.conf',        pkgsysconfdir],
-            ['systemd.pc',       pkgconfigdatadir]]
+in_files = [['system.conf',                     pkgsysconfdir],
+            ['user.conf',                       pkgsysconfdir],
+            ['systemd.pc',                      pkgconfigdatadir],
+            ['org.freedesktop.systemd1.policy', polkitpolicydir]]
 
 foreach item : in_files
         file = item[0]
         dir = item[1]
-        if install_sysconfdir_samples or dir != pkgsysconfdir
-                configure_file(
-                        input : file + '.in',
-                        output : file,
-                        configuration : substs,
-                        install_dir : dir == 'no' ? '' : dir)
-        endif
 
+        custom_target(
+                file,
+                input : file + '.in',
+                output: file,
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
+                capture : true,
+                install : dir != 'no',
+                install_dir : dir)
 endforeach
 
 install_data('org.freedesktop.systemd1.conf',
@@ -196,13 +198,6 @@ install_data('org.freedesktop.systemd1.conf',
 install_data('org.freedesktop.systemd1.service',
              install_dir : dbussystemservicedir)
 
-policy = configure_file(
-        input : 'org.freedesktop.systemd1.policy.in',
-        output : 'org.freedesktop.systemd1.policy',
-        configuration : substs)
-install_data(policy,
-             install_dir : polkitpolicydir)
-
 meson.add_install_script('sh', '-c', mkdir_p.format(systemshutdowndir))
 meson.add_install_script('sh', '-c', mkdir_p.format(systemsleepdir))
 meson.add_install_script('sh', '-c', mkdir_p.format(systemgeneratordir))

src/core/org.freedesktop.systemd1.policy.in

@@ -26,7 +26,7 @@
                         <allow_inactive>no</allow_inactive>
                         <allow_active>auth_admin_keep</allow_active>
                 </defaults>
-                <annotate key="org.freedesktop.policykit.exec.path">@rootlibexecdir@/systemd-reply-password</annotate>
+                <annotate key="org.freedesktop.policykit.exec.path">{{ROOTLIBEXECDIR}}/systemd-reply-password</annotate>
         </action>
 
         <action id="org.freedesktop.systemd1.manage-units">

src/core/system.conf.in

@@ -37,7 +37,7 @@
 #NoNewPrivileges=no
 #SystemCallArchitectures=
 #TimerSlackNSec=
-#StatusUnitFormat=@STATUS_UNIT_FORMAT_DEFAULT@
+#StatusUnitFormat={{STATUS_UNIT_FORMAT_DEFAULT_STR}}
 #DefaultTimerAccuracySec=1min
 #DefaultStandardOutput=journal
 #DefaultStandardError=inherit
@@ -52,7 +52,7 @@
 #DefaultIOAccounting=no
 #DefaultIPAccounting=no
 #DefaultBlockIOAccounting=no
-#DefaultMemoryAccounting=@MEMORY_ACCOUNTING_DEFAULT@
+#DefaultMemoryAccounting={{ 'yes' if MEMORY_ACCOUNTING_DEFAULT else 'no' }}
 #DefaultTasksAccounting=yes
 #DefaultTasksMax=15%
 #DefaultLimitCPU=
@@ -61,7 +61,7 @@
 #DefaultLimitSTACK=
 #DefaultLimitCORE=
 #DefaultLimitRSS=
-#DefaultLimitNOFILE=1024:@HIGH_RLIMIT_NOFILE@
+#DefaultLimitNOFILE=1024:{{HIGH_RLIMIT_NOFILE}}
 #DefaultLimitAS=
 #DefaultLimitNPROC=
 #DefaultLimitMEMLOCK=

src/core/systemd.pc.in

@@ -12,9 +12,9 @@
 # shall have underscores.
 
 prefix=/usr
-root_prefix=@rootprefix_noslash@
+root_prefix={{ROOTPREFIX_NOSLASH}}
 rootprefix=${root_prefix}
-sysconf_dir=@sysconfdir@
+sysconf_dir={{SYSCONF_DIR}}
 sysconfdir=${sysconf_dir}
 
 systemd_util_dir=${root_prefix}/lib/systemd
@@ -80,22 +80,22 @@ modulesloaddir=${modules_load_dir}
 catalog_dir=${prefix}/lib/systemd/catalog
 catalogdir=${catalog_dir}
 
-system_uid_max=@SYSTEM_UID_MAX@
+system_uid_max={{SYSTEM_UID_MAX}}
 systemuidmax=${system_uid_max}
-system_gid_max=@SYSTEM_GID_MAX@
+system_gid_max={{SYSTEM_GID_MAX}}
 systemgidmax=${system_gid_max}
 
-dynamic_uid_min=@dynamicuidmin@
+dynamic_uid_min={{DYNAMIC_UID_MIN}}
 dynamicuidmin=${dynamic_uid_min}
-dynamic_uid_max=@dynamicuidmax@
+dynamic_uid_max={{DYNAMIC_UID_MAX}}
 dynamicuidmax=${dynamic_uid_max}
 
-container_uid_base_min=@containeruidbasemin@
+container_uid_base_min={{CONTAINER_UID_BASE_MIN}}
 containeruidbasemin=${container_uid_base_min}
-container_uid_base_max=@containeruidbasemax@
+container_uid_base_max={{CONTAINER_UID_BASE_MAX}}
 containeruidbasemax=${container_uid_base_max}
 
 Name: systemd
 Description: systemd System and Service Manager
-URL: @PROJECT_URL@
-Version: @PROJECT_VERSION@
+URL: {{PROJECT_URL}}
+Version: {{PROJECT_VERSION}}

src/core/user.conf.in

@@ -20,7 +20,7 @@
 #LogTime=no
 #SystemCallArchitectures=
 #TimerSlackNSec=
-#StatusUnitFormat=@STATUS_UNIT_FORMAT_DEFAULT@
+#StatusUnitFormat={{STATUS_UNIT_FORMAT_DEFAULT_STR}}
 #DefaultTimerAccuracySec=1min
 #DefaultStandardOutput=inherit
 #DefaultStandardError=inherit

src/debug-generator/debug-generator.c

@@ -134,7 +134,7 @@ static int generate_wants_symlinks(void) {
                 if (!p)
                         return log_oom();
 
-                f = path_join(SYSTEM_DATA_UNIT_PATH, *u);
+                f = path_join(SYSTEM_DATA_UNIT_DIR, *u);
                 if (!f)
                         return log_oom();
 

src/fstab-generator/fstab-generator.c

@@ -881,7 +881,7 @@ static int add_volatile_root(void) {
                 return 0;
 
         return generator_add_symlink(arg_dest, SPECIAL_INITRD_ROOT_FS_TARGET, "requires",
-                                     SYSTEM_DATA_UNIT_PATH "/" SPECIAL_VOLATILE_ROOT_SERVICE);
+                                     SYSTEM_DATA_UNIT_DIR "/" SPECIAL_VOLATILE_ROOT_SERVICE);
 }
 
 static int add_volatile_var(void) {

src/getty-generator/getty-generator.c

@@ -28,7 +28,7 @@ static int add_symlink(const char *fservice, const char *tservice) {
         assert(fservice);
         assert(tservice);
 
-        from = strjoina(SYSTEM_DATA_UNIT_PATH "/", fservice);
+        from = strjoina(SYSTEM_DATA_UNIT_DIR "/", fservice);
         to = strjoina(arg_dest, "/getty.target.wants/", tservice);
 
         mkdir_parents_label(to, 0755);

src/hibernate-resume/hibernate-resume-generator.c

@@ -85,7 +85,7 @@ static int process_resume(void) {
                 return log_oom();
 
         mkdir_parents_label(lnk, 0755);
-        if (symlink(SYSTEM_DATA_UNIT_PATH "/systemd-hibernate-resume@.service", lnk) < 0)
+        if (symlink(SYSTEM_DATA_UNIT_DIR "/systemd-hibernate-resume@.service", lnk) < 0)
                 return log_error_errno(errno, "Failed to create symlink %s: %m", lnk);
 
         r = unit_name_from_path(arg_resume_device, ".device", &device_unit);

src/journal-remote/journal-remote.conf.in

@@ -15,6 +15,6 @@
 [Remote]
 # Seal=false
 # SplitMode=host
-# ServerKeyFile=@CERTIFICATEROOT@/private/journal-remote.pem
-# ServerCertificateFile=@CERTIFICATEROOT@/certs/journal-remote.pem
-# TrustedCertificateFile=@CERTIFICATEROOT@/ca/trusted.pem
+# ServerKeyFile={{CERTIFICATE_ROOT}}/private/journal-remote.pem
+# ServerCertificateFile={{CERTIFICATE_ROOT}}/certs/journal-remote.pem
+# TrustedCertificateFile={{CERTIFICATE_ROOT}}/ca/trusted.pem

src/journal-remote/journal-upload.conf.in

@@ -14,6 +14,6 @@
 
 [Upload]
 # URL=
-# ServerKeyFile=@CERTIFICATEROOT@/private/journal-upload.pem
-# ServerCertificateFile=@CERTIFICATEROOT@/certs/journal-upload.pem
-# TrustedCertificateFile=@CERTIFICATEROOT@/ca/trusted.pem
+# ServerKeyFile={{CERTIFICATE_ROOT}}/private/journal-upload.pem
+# ServerCertificateFile={{CERTIFICATE_ROOT}}/certs/journal-upload.pem
+# TrustedCertificateFile={{CERTIFICATE_ROOT}}/ca/trusted.pem

src/journal-remote/meson.build

@@ -42,27 +42,25 @@ systemd_journal_gatewayd_sources = files('''
         microhttpd-util.c
 '''.split())
 
-if conf.get('ENABLE_REMOTE') ==1 and conf.get('HAVE_LIBCURL') == 1
-        journal_upload_conf = configure_file(
-                input : 'journal-upload.conf.in',
-                output : 'journal-upload.conf',
-                configuration : substs)
-        if install_sysconfdir
-                install_data(journal_upload_conf,
-                             install_dir : pkgsysconfdir)
-        endif
-endif
+in_files = [
+        ['journal-upload.conf',
+         conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_LIBCURL') == 1 and install_sysconfdir_samples],
+        ['journal-remote.conf',
+         conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1 and install_sysconfdir_samples]]
+
+foreach tuple : in_files
+        file = tuple[0]
+        custom_target(
+                file,
+                input : file + '.in',
+                output: file,
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
+                capture : true,
+                install : tuple[1],
+                install_dir : pkgsysconfdir)
+endforeach
 
 if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-        journal_remote_conf = configure_file(
-                input : 'journal-remote.conf.in',
-                output : 'journal-remote.conf',
-                configuration : substs)
-        if install_sysconfdir_samples
-                install_data(journal_remote_conf,
-                             install_dir : pkgsysconfdir)
-        endif
-
         install_data('browse.html',
                      install_dir : join_paths(pkgdatadir, 'gatewayd'))
 

src/libsystemd/libsystemd.pc.in

@@ -7,14 +7,14 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@rootlibdir@
-includedir=@includedir@
+prefix={{PREFIX}}
+exec_prefix={{PREFIX}}
+libdir={{ROOTLIBDIR}}
+includedir={{INCLUDE_DIR}}
 
 Name: systemd
 Description: systemd Library
-URL: @PROJECT_URL@
-Version: @PROJECT_VERSION@
+URL: {{PROJECT_URL}}
+Version: {{PROJECT_VERSION}}
 Libs: -L${libdir} -lsystemd
 Cflags: -I${includedir}

src/libsystemd/meson.build

@@ -177,11 +177,14 @@ libsystemd_sym_path = join_paths(meson.current_source_dir(), 'libsystemd.sym')
 static_libsystemd = get_option('static-libsystemd')
 static_libsystemd_pic = static_libsystemd == 'true' or static_libsystemd == 'pic'
 
-configure_file(
+custom_target(
+        'libsystemd.pc',
         input : 'libsystemd.pc.in',
         output : 'libsystemd.pc',
-        configuration : substs,
-        install_dir : pkgconfiglibdir == 'no' ? '' : pkgconfiglibdir)
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : pkgconfiglibdir != 'no',
+        install_dir : pkgconfiglibdir)
 
 ############################################################
 

src/libsystemd/sd-path/sd-path.c

@@ -325,7 +325,7 @@ static int get_path(uint64_t type, char **buffer, const char **ret) {
                 return 0;
 
         case SD_PATH_SYSTEMD_SYSTEM_UNIT:
-                *ret = SYSTEM_DATA_UNIT_PATH;
+                *ret = SYSTEM_DATA_UNIT_DIR;
                 return 0;
 
         case SD_PATH_SYSTEMD_SYSTEM_PRESET:

src/libudev/libudev.pc.in

@@ -7,13 +7,13 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-libdir=@rootlibdir@
-includedir=@includedir@
+prefix={{PREFIX}}
+exec_prefix={{PREFIX}}
+libdir={{ROOTLIBDIR}}
+includedir={{INCLUDE_DIR}}
 
 Name: libudev
 Description: Library to access udev device information
-Version: @PROJECT_VERSION@
+Version: {{PROJECT_VERSION}}
 Libs: -L${libdir} -ludev
 Cflags: -I${includedir}

src/libudev/meson.build

@@ -39,11 +39,14 @@ libudev_static = static_library(
 static_libudev = get_option('static-libudev')
 static_libudev_pic = static_libudev == 'true' or static_libudev == 'pic'
 
-configure_file(
+custom_target(
+        'libudev.pc',
         input : 'libudev.pc.in',
         output : 'libudev.pc',
-        configuration : substs,
-        install_dir : pkgconfiglibdir == 'no' ? '' : pkgconfiglibdir)
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : pkgconfiglibdir != 'no',
+        install_dir : pkgconfiglibdir)
 
 ############################################################
 

src/login/70-uaccess.rules.in

@@ -41,14 +41,14 @@ SUBSYSTEM=="firewire", TEST=="units", ENV{IEEE1394_UNIT_FUNCTION_VIDEO}=="1", TA
 
 # DRI video devices
 SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
-m4_ifdef(`GROUP_RENDER_UACCESS',``
+{% if GROUP_RENDER_UACCESS %}
 # DRI render nodes
-SUBSYSTEM=="drm", KERNEL=="renderD*", TAG+="uaccess"''
-)m4_dnl
-m4_ifdef(`DEV_KVM_UACCESS',``
+SUBSYSTEM=="drm", KERNEL=="renderD*", TAG+="uaccess"
+{% endif %}
+{% if DEV_KVM_UACCESS %}
 # KVM
-SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"''
-)m4_dnl
+SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"
+{% endif %}
 
 # smart-card readers
 ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess"

src/login/71-seat.rules.in

@@ -59,9 +59,11 @@ SUBSYSTEM=="pci", ATTRS{vendor}=="0x1ab8", ATTRS{device}=="0x4005", TAG+="seat",
 # the child if we notice that the parent wasn't recognized yet.
 
 # Match parent
+{% raw -%}
 SUBSYSTEM=="usb", ATTR{idVendor}=="058f", ATTR{idProduct}=="6254", \
                   ATTR{%k.2/idVendor}=="17e9", ATTR{%k.2/idProduct}=="401a", ATTR{%k.2/product}=="mimo inc", \
                   ENV{ID_AUTOSEAT}="1", ENV{ID_AVOID_LOOP}="1"
+{% endraw %}
 
 # Match child, look for parent's ID_AVOID_LOOP
 SUBSYSTEM=="usb", ATTR{idVendor}=="17e9", ATTR{idProduct}=="401a", ATTR{product}=="mimo inc", \
@@ -72,11 +74,11 @@ SUBSYSTEM=="usb", ATTR{idVendor}=="17e9", ATTR{idProduct}=="401a", ATTR{product}
 SUBSYSTEM=="usb", ATTR{idVendor}=="17e9", ATTR{idProduct}=="401a", ATTR{product}=="mimo inc", \
                   ATTR{../idVendor}=="058f", ATTR{../idProduct}=="6254", \
                   ENV{ID_AVOID_LOOP}=="", \
-                  RUN+="@rootbindir@/udevadm trigger --parent-match=%p/.."
+                  RUN+="{{ROOTBINDIR}}/udevadm trigger --parent-match=%p/.."
 
 TAG=="seat", ENV{ID_PATH}=="", IMPORT{builtin}="path_id"
 TAG=="seat", ENV{ID_FOR_SEAT}=="", ENV{ID_PATH_TAG}!="", ENV{ID_FOR_SEAT}="$env{SUBSYSTEM}-$env{ID_PATH_TAG}"
 
-SUBSYSTEM=="input", ATTR{name}=="Wiebetech LLC Wiebetech", RUN+="@rootbindir@/loginctl lock-sessions"
+SUBSYSTEM=="input", ATTR{name}=="Wiebetech LLC Wiebetech", RUN+="{{ROOTBINDIR}}/loginctl lock-sessions"
 
 LABEL="seat_end"

src/login/73-seat-late.rules.in

@@ -13,8 +13,8 @@ ENV{ID_SEAT}=="", ENV{ID_AUTOSEAT}=="1", ENV{ID_FOR_SEAT}!="", ENV{ID_SEAT}="sea
 ENV{ID_SEAT}=="", IMPORT{parent}="ID_SEAT"
 
 ENV{ID_SEAT}!="", TAG+="$env{ID_SEAT}"
-m4_ifdef(`HAVE_ACL',``
-TAG=="uaccess", ENV{MAJOR}!="", RUN{builtin}+="uaccess"''
-)m4_dnl
+{% if HAVE_ACL %}
+TAG=="uaccess", ENV{MAJOR}!="", RUN{builtin}+="uaccess"
+{% endif %}
 
 LABEL="seat_late_end"

src/login/logind.conf.in

@@ -17,7 +17,7 @@
 [Login]
 #NAutoVTs=6
 #ReserveVT=6
-#KillUserProcesses=@KILL_USER_PROCESSES@
+#KillUserProcesses={{ "yes" if KILL_USER_PROCESSES else "no" }}
 #KillOnlyUsers=
 #KillExcludeUsers=root
 #InhibitDelayMaxSec=5

src/login/meson.build

@@ -65,58 +65,35 @@ user_runtime_dir_sources = files('''
 pam_systemd_sym = 'src/login/pam_systemd.sym'
 pam_systemd_c = files('pam_systemd.c')
 
-if conf.get('ENABLE_LOGIND') == 1
-        logind_conf = configure_file(
-                input : 'logind.conf.in',
-                output : 'logind.conf',
-                configuration : substs)
-        if install_sysconfdir_samples
-                install_data(logind_conf,
-                             install_dir : pkgsysconfdir)
-        endif
+enable_logind = conf.get('ENABLE_LOGIND') == 1
+in_files = [
+        ['logind.conf',        pkgsysconfdir, enable_logind],
+        ['70-uaccess.rules',   udevrulesdir,  enable_logind and conf.get('HAVE_ACL') == 1],
+        ['71-seat.rules',      udevrulesdir,  enable_logind],
+        ['73-seat-late.rules', udevrulesdir,  enable_logind],
+        ['systemd-user',       pamconfdir,    enable_logind and pamconfdir != 'no']]
 
+foreach tuple : in_files
+        file = tuple[0]
+        custom_target(
+                file,
+                input : file + '.in',
+                output: file,
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
+                capture : true,
+                install : tuple[2],
+                install_dir : tuple[1])
+endforeach
+
+if enable_logind
         install_data('org.freedesktop.login1.conf',
                      install_dir : dbuspolicydir)
         install_data('org.freedesktop.login1.service',
                      install_dir : dbussystemservicedir)
         install_data('org.freedesktop.login1.policy',
                      install_dir : polkitpolicydir)
-
-        install_data('70-power-switch.rules', install_dir : udevrulesdir)
-
-        seat_rules = configure_file(
-                input : '71-seat.rules.in',
-                output : '71-seat.rules',
-                configuration : substs)
-        install_data(seat_rules,
+        install_data('70-power-switch.rules',
                      install_dir : udevrulesdir)
-
-        custom_target(
-                '70-uaccess.rules',
-                input : '70-uaccess.rules.m4',
-                output: '70-uaccess.rules',
-                command : [meson_apply_m4, config_h, '@INPUT@'],
-                capture : true,
-                install : conf.get('HAVE_ACL') == 1,
-                install_dir : udevrulesdir)
-
-        custom_target(
-                '73-seat-late.rules',
-                input : '73-seat-late.rules.m4',
-                output: '73-seat-late.rules',
-                command : [meson_apply_m4, config_h, '@INPUT@'],
-                capture : true,
-                install : true,
-                install_dir : udevrulesdir)
-
-        custom_target(
-                'systemd-user',
-                input : 'systemd-user.m4',
-                output: 'systemd-user',
-                command : [meson_apply_m4, config_h, '@INPUT@'],
-                capture : true,
-                install : pamconfdir != 'no',
-                install_dir : pamconfdir)
 endif
 
 ############################################################

src/login/systemd-user.in

@@ -2,19 +2,19 @@
 #
 # Used by systemd --user instances.
 
-m4_ifdef(`ENABLE_HOMED',
+{% if ENABLE_HOMED %}
 -account sufficient pam_systemd_home.so
-)m4_dnl
+{% endif %}
 account sufficient pam_unix.so
 account required pam_permit.so
 
-m4_ifdef(`HAVE_SELINUX',
+{% if HAVE_SELINUX %}
 session required pam_selinux.so close
 session required pam_selinux.so nottys open
-)m4_dnl
+{% endif %}
 session required pam_loginuid.so
 session optional pam_keyinit.so force revoke
-m4_ifdef(`ENABLE_HOMED',
+{% if ENABLE_HOMED %}
 -session optional pam_systemd_home.so
-)m4_dnl
+{% endif %}
 session optional pam_systemd.so

src/modules-load/modules-load.c

@@ -186,9 +186,7 @@ static int run(int argc, char *argv[]) {
         r = 0;
 
         if (argc > optind) {
-                int i;
-
-                for (i = optind; i < argc; i++) {
+                for (int i = optind; i < argc; i++) {
                         k = apply_file(ctx, argv[i], false);
                         if (k < 0 && r == 0)
                                 r = k;

src/network/networkd-address-label.c

@@ -225,7 +225,7 @@ int config_parse_address_label(
                 return 0;
         }
 
-        if (k == 0xffffffffUL) {
+        if (k == UINT32_C(0xffffffff)) {
                 log_syntax(unit, LOG_WARNING, filename, line, 0, "Address label is invalid, ignoring: %s", rvalue);
                 return 0;
         }

src/network/networkd-address.c

@@ -146,12 +146,38 @@ Address *address_free(Address *address) {
 static bool address_may_have_broadcast(const Address *a) {
         assert(a);
 
+        if (a->family != AF_INET)
+                return false;
+
+        if (in4_addr_is_set(&a->in_addr_peer.in))
+                return false;
+
         /* A /31 or /32 IPv4 address does not have a broadcast address.
          * See https://tools.ietf.org/html/rfc3021 */
+        if (a->prefixlen > 30)
+                return false;
 
-        return a->family == AF_INET &&
-                in4_addr_is_null(&a->in_addr_peer.in) &&
-                a->prefixlen <= 30;
+        if (a->set_broadcast >= 0)
+                return a->set_broadcast;
+
+        return true; /* Defaults to true. */
+}
+
+void address_set_broadcast(Address *a) {
+        assert(a);
+
+        if (!address_may_have_broadcast(a))
+                return;
+
+        /* If explicitly configured, do not update the address. */
+        if (in4_addr_is_set(&a->broadcast))
+                return;
+
+        /* If Address= is 0.0.0.0, then the broadcast address will be set later in address_acquire(). */
+        if (in4_addr_is_null(&a->in_addr.in))
+                return;
+
+        a->broadcast.s_addr = a->in_addr.in.s_addr | htobe32(UINT32_C(0xffffffff) >> a->prefixlen);
 }
 
 static bool address_may_set_broadcast(const Address *a, const Link *link) {
@@ -161,9 +187,6 @@ static bool address_may_set_broadcast(const Address *a, const Link *link) {
         if (!address_may_have_broadcast(a))
                 return false;
 
-        if (a->set_broadcast >= 0)
-                return a->set_broadcast;
-
         /* Typical configuration for wireguard does not set broadcast. */
         return !streq_ptr(link->kind, "wireguard");
 }
@@ -466,7 +489,7 @@ int address_get(Link *link, const Address *in, Address **ret) {
         return -ENOENT;
 }
 
-int link_has_ipv6_address(Link *link, const struct in6_addr *address) {
+int link_get_ipv6_address(Link *link, const struct in6_addr *address, Address **ret) {
         _cleanup_(address_freep) Address *a = NULL;
         int r;
 
@@ -482,10 +505,10 @@ int link_has_ipv6_address(Link *link, const struct in6_addr *address) {
         a->family = AF_INET6;
         a->in_addr.in6 = *address;
 
-        return address_get(link, a, NULL) >= 0;
+        return address_get(link, a, ret);
 }
 
-static int link_get_ipv4_address(Set *addresses, const struct in_addr *address, Address **ret) {
+static int addresses_get_ipv4_address(Set *addresses, const struct in_addr *address, Address **ret) {
         Address *a;
 
         assert(address);
@@ -506,7 +529,35 @@ static int link_get_ipv4_address(Set *addresses, const struct in_addr *address,
         return -ENOENT;
 }
 
+int link_get_ipv4_address(Link *link, const struct in_addr *address, unsigned char prefixlen, Address **ret) {
+        int r;
+
+        assert(link);
+        assert(address);
+
+        if (prefixlen != 0) {
+                _cleanup_(address_freep) Address *a = NULL;
+
+                /* If prefixlen is set, then we can use address_get(). */
+
+                r = address_new(&a);
+                if (r < 0)
+                        return r;
+
+                a->family = AF_INET;
+                a->in_addr.in = *address;
+                a->prefixlen = prefixlen;
+
+                return address_get(link, a, ret);
+        }
+
+        if (addresses_get_ipv4_address(link->addresses, address, ret) >= 0)
+                return 0;
+        return addresses_get_ipv4_address(link->addresses_foreign, address, ret);
+}
+
 int manager_has_address(Manager *manager, int family, const union in_addr_union *address, bool check_ready) {
+        Address *a;
         Link *link;
         int r;
 
@@ -514,18 +565,12 @@ int manager_has_address(Manager *manager, int family, const union in_addr_union
         assert(IN_SET(family, AF_INET, AF_INET6));
         assert(address);
 
-        if (family == AF_INET)
-                HASHMAP_FOREACH(link, manager->links) {
-                        Address *a;
-
-                        if (link_get_ipv4_address(link->addresses, &address->in, &a) >= 0)
+        if (family == AF_INET) {
+                HASHMAP_FOREACH(link, manager->links)
+                        if (link_get_ipv4_address(link, &address->in, 0, &a) >= 0)
                                 return !check_ready || address_is_ready(a);
-                        if (link_get_ipv4_address(link->addresses_foreign, &address->in, &a) >= 0)
-                                return !check_ready || address_is_ready(a);
-                }
-        else {
+        } else {
                 _cleanup_(address_freep) Address *tmp = NULL;
-                Address *a;
 
                 r = address_new(&tmp);
                 if (r < 0)
@@ -825,7 +870,6 @@ int link_drop_addresses(Link *link) {
 
 static int address_acquire(Link *link, const Address *original, Address **ret) {
         union in_addr_union in_addr = IN_ADDR_NULL;
-        struct in_addr broadcast = {};
         _cleanup_(address_freep) Address *na = NULL;
         int r;
 
@@ -847,16 +891,10 @@ static int address_acquire(Link *link, const Address *original, Address **ret) {
         if (r == 0)
                 return -EBUSY;
 
-        if (original->family == AF_INET) {
-                /* Pick first address in range for ourselves ... */
+        /* Pick first address in range for ourselves. */
+        if (original->family == AF_INET)
                 in_addr.in.s_addr = in_addr.in.s_addr | htobe32(1);
-
-                /* .. and use last as broadcast address */
-                if (original->prefixlen > 30)
-                        broadcast.s_addr = 0;
-                else
-                        broadcast.s_addr = in_addr.in.s_addr | htobe32(0xFFFFFFFFUL >> original->prefixlen);
-        } else if (original->family == AF_INET6)
+        else if (original->family == AF_INET6)
                 in_addr.in6.s6_addr[15] |= 1;
 
         r = address_new(&na);
@@ -867,8 +905,8 @@ static int address_acquire(Link *link, const Address *original, Address **ret) {
         if (r < 0)
                 return r;
 
-        na->broadcast = broadcast;
         na->in_addr = in_addr;
+        address_set_broadcast(na);
 
         r = set_ensure_put(&link->pool_addresses, &address_hash_ops, na);
         if (r < 0)
@@ -1119,6 +1157,32 @@ int link_request_static_addresses(Link *link) {
                 req->after_configure = static_address_after_configure;
         }
 
+        if (in4_addr_is_set(&link->network->dhcp_server_address)) {
+                _cleanup_(address_freep) Address *address = NULL;
+
+                r = address_new(&address);
+                if (r < 0)
+                        return log_oom();
+
+                address->family = AF_INET;
+                address->in_addr.in = link->network->dhcp_server_address;
+                address->prefixlen = link->network->dhcp_server_address_prefixlen;
+                address_set_broadcast(address);
+
+                /* The same address may be explicitly configured in [Address] or [Network] section.
+                 * Configure the DHCP server address only when it is not. */
+                if (!link_is_static_address_configured(link, address)) {
+                        Request *req;
+
+                        r = link_request_address(link, TAKE_PTR(address), true, &link->static_address_messages,
+                                                 static_address_handler, &req);
+                        if (r < 0)
+                                return r;
+
+                        req->after_configure = static_address_after_configure;
+                }
+        }
+
         if (link->static_address_messages == 0) {
                 link->static_addresses_configured = true;
                 link_check_ready(link);
@@ -1149,6 +1213,9 @@ int request_process_address(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
@@ -1957,10 +2024,9 @@ static int address_section_verify(Address *address) {
                                          address->section->filename, address->section->line);
         }
 
-        if (address_may_have_broadcast(address)) {
-                if (address->broadcast.s_addr == 0 && address->set_broadcast != 0)
-                        address->broadcast.s_addr = address->in_addr.in.s_addr | htobe32(0xfffffffflu >> address->prefixlen);
-        } else if (address->broadcast.s_addr != 0) {
+        if (address_may_have_broadcast(address))
+                address_set_broadcast(address);
+        else if (address->broadcast.s_addr != 0) {
                 log_warning("%s: broadcast address is set for IPv6 address or IPv4 address with prefixlength larger than 30. "
                             "Ignoring Broadcast= setting in the [Address] section from line %u.",
                             address->section->filename, address->section->line);

src/network/networkd-address.h

@@ -57,6 +57,7 @@ int address_remove_handler_internal(sd_netlink *rtnl, sd_netlink_message *m, Lin
 int address_remove(const Address *address, Link *link, link_netlink_message_handler_t callback);
 bool address_equal(const Address *a1, const Address *a2);
 bool address_is_ready(const Address *a);
+void address_set_broadcast(Address *a);
 
 int generate_ipv6_eui_64_address(const Link *link, struct in6_addr *ret);
 
@@ -65,7 +66,8 @@ DEFINE_NETWORK_SECTION_FUNCTIONS(Address, address_free);
 int link_drop_addresses(Link *link);
 int link_drop_foreign_addresses(Link *link);
 bool link_address_is_dynamic(const Link *link, const Address *address);
-int link_has_ipv6_address(Link *link, const struct in6_addr *address);
+int link_get_ipv6_address(Link *link, const struct in6_addr *address, Address **ret);
+int link_get_ipv4_address(Link *link, const struct in_addr *address, unsigned char prefixlen, Address **ret);
 int manager_has_address(Manager *manager, int family, const union in_addr_union *address, bool check_ready);
 
 void ipv4_dad_unref(Link *link);

src/network/networkd-dhcp-server.c

@@ -29,33 +29,70 @@ static bool link_dhcp4_server_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        if (link->network->bond)
-                return false;
-
         if (link->iftype == ARPHRD_CAN)
                 return false;
 
         return link->network->dhcp_server;
 }
 
-static Address* link_find_dhcp_server_address(Link *link) {
+void network_adjust_dhcp_server(Network *network) {
+        assert(network);
+
+        if (!network->dhcp_server)
+                return;
+
+        if (network->bond) {
+                log_warning("%s: DHCPServer= is enabled for bond slave. Disabling DHCP server.",
+                            network->filename);
+                network->dhcp_server = false;
+                return;
+        }
+
+        if (!in4_addr_is_set(&network->dhcp_server_address)) {
+                Address *address;
+                bool have = false;
+
+                ORDERED_HASHMAP_FOREACH(address, network->addresses_by_section) {
+                        if (section_is_invalid(address->section))
+                                continue;
+                        if (address->family == AF_INET &&
+                            !in4_addr_is_localhost(&address->in_addr.in) &&
+                            in4_addr_is_null(&address->in_addr_peer.in)) {
+                                have = true;
+                                break;
+                        }
+                }
+                if (!have) {
+                        log_warning("%s: DHCPServer= is enabled, but no static address configured. "
+                                    "Disabling DHCP server.",
+                                    network->filename);
+                        network->dhcp_server = false;
+                        return;
+                }
+        }
+}
+
+static int link_find_dhcp_server_address(Link *link, Address **ret) {
         Address *address;
 
         assert(link);
         assert(link->network);
 
-        /* The first statically configured address if there is any */
-        ORDERED_HASHMAP_FOREACH(address, link->network->addresses_by_section)
+        /* If ServerAddress= is specified, then use the address. */
+        if (in4_addr_is_set(&link->network->dhcp_server_address))
+                return link_get_ipv4_address(link, &link->network->dhcp_server_address,
+                                             link->network->dhcp_server_address_prefixlen, ret);
+
+        /* If not, then select one from static addresses. */
+        SET_FOREACH(address, link->static_addresses)
                 if (address->family == AF_INET &&
-                    in_addr_is_set(address->family, &address->in_addr))
-                        return address;
+                    !in4_addr_is_localhost(&address->in_addr.in) &&
+                    in4_addr_is_null(&address->in_addr_peer.in)) {
+                        *ret = address;
+                        return 0;
+                }
 
-        /* If that didn't work, find a suitable address we got from the pool */
-        SET_FOREACH(address, link->pool_addresses)
-                if (address->family == AF_INET)
-                        return address;
-
-        return NULL;
+        return -ENOENT;
 }
 
 static int link_push_uplink_to_dhcp_server(
@@ -277,10 +314,9 @@ int dhcp4_server_configure(Link *link) {
         if (r < 0)
                 return log_link_warning_errno(link, r, "Failed to set callback for DHCPv4 server instance: %m");
 
-        address = link_find_dhcp_server_address(link);
-        if (!address)
-                return log_link_error_errno(link, SYNTHETIC_ERRNO(EBUSY),
-                                            "Failed to find suitable address for DHCPv4 server instance.");
+        r = link_find_dhcp_server_address(link, &address);
+        if (r < 0)
+                return log_link_error_errno(link, r, "Failed to find suitable address for DHCPv4 server instance: %m");
 
         /* use the server address' subnet as the pool */
         r = sd_dhcp_server_configure_pool(link->dhcp_server, &address->in_addr.in, address->prefixlen,
@@ -429,7 +465,6 @@ int config_parse_dhcp_server_relay_agent_suboption(
         assert(lvalue);
         assert(rvalue);
 
-
         if (isempty(rvalue)) {
                 *suboption_value = mfree(*suboption_value);
                 return 0;
@@ -444,32 +479,6 @@ int config_parse_dhcp_server_relay_agent_suboption(
         return free_and_strdup(suboption_value, empty_to_null(p));
 }
 
-int config_parse_dhcp_server_relay_target(
-                const char *unit,
-                const char *filename,
-                unsigned line,
-                const char *section,
-                unsigned section_line,
-                const char *lvalue,
-                int ltype,
-                const char *rvalue,
-                void *data,
-                void *userdata) {
-
-        Network *network = userdata;
-        union in_addr_union a;
-        int r;
-
-        r = in_addr_from_string(AF_INET, rvalue, &a);
-        if (r < 0) {
-                log_syntax(unit, LOG_WARNING, filename, line, r,
-                           "Failed to parse %s= address '%s', ignoring: %m", lvalue, rvalue);
-                return 0;
-        }
-        network->dhcp_server_relay_target = a.in;
-        return r;
-}
-
 int config_parse_dhcp_server_emit(
                 const char *unit,
                 const char *filename,
@@ -518,3 +527,48 @@ int config_parse_dhcp_server_emit(
                 emit->addresses[emit->n_addresses++] = a.in;
         }
 }
+
+int config_parse_dhcp_server_address(
+                const char *unit,
+                const char *filename,
+                unsigned line,
+                const char *section,
+                unsigned section_line,
+                const char *lvalue,
+                int ltype,
+                const char *rvalue,
+                void *data,
+                void *userdata) {
+
+        Network *network = userdata;
+        union in_addr_union a;
+        unsigned char prefixlen;
+        int r;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+
+        if (isempty(rvalue)) {
+                network->dhcp_server_address = (struct in_addr) {};
+                network->dhcp_server_address_prefixlen = 0;
+                return 0;
+        }
+
+        r = in_addr_prefix_from_string(rvalue, AF_INET, &a, &prefixlen);
+        if (r < 0) {
+                log_syntax(unit, LOG_WARNING, filename, line, r,
+                           "Failed to parse %s=, ignoring assignment: %s", lvalue, rvalue);
+                return 0;
+        }
+        if (in4_addr_is_null(&a.in) || in4_addr_is_localhost(&a.in)) {
+                log_syntax(unit, LOG_WARNING, filename, line, 0,
+                           "DHCP server address cannot be the ANY address or a localhost address, "
+                           "ignoring assignment: %s", rvalue);
+                return 0;
+        }
+
+        network->dhcp_server_address = a.in;
+        network->dhcp_server_address_prefixlen = prefixlen;
+        return 0;
+}

src/network/networkd-dhcp-server.h

@@ -2,13 +2,14 @@
 #pragma once
 
 #include "conf-parser.h"
-#include "networkd-link.h"
-#include "networkd-util.h"
 
 typedef struct Link Link;
+typedef struct Network Network;
+
+void network_adjust_dhcp_server(Network *network);
 
 int dhcp4_server_configure(Link *link);
 
 CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_server_relay_agent_suboption);
-CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_server_relay_target);
 CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_server_emit);
+CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_server_address);

src/network/networkd-dhcp6.c

@@ -1888,47 +1888,3 @@ int config_parse_dhcp6_pd_subnet_id(
 
         return 0;
 }
-
-int config_parse_dhcp6_pd_token(
-                const char *unit,
-                const char *filename,
-                unsigned line,
-                const char *section,
-                unsigned section_line,
-                const char *lvalue,
-                int ltype,
-                const char *rvalue,
-                void *data,
-                void *userdata) {
-
-        struct in6_addr *addr = data;
-        union in_addr_union tmp;
-        int r;
-
-        assert(filename);
-        assert(lvalue);
-        assert(rvalue);
-        assert(data);
-
-        if (isempty(rvalue)) {
-                *addr = (struct in6_addr) {};
-                return 0;
-        }
-
-        r = in_addr_from_string(AF_INET6, rvalue, &tmp);
-        if (r < 0) {
-                log_syntax(unit, LOG_WARNING, filename, line, r,
-                           "Failed to parse DHCPv6 Prefix Delegation token, ignoring: %s", rvalue);
-                return 0;
-        }
-
-        if (in_addr_is_null(AF_INET6, &tmp)) {
-                log_syntax(unit, LOG_WARNING, filename, line, 0,
-                           "DHCPv6 Prefix Delegation token cannot be the ANY address, ignoring: %s", rvalue);
-                return 0;
-        }
-
-        *addr = tmp.in6;
-
-        return 0;
-}

src/network/networkd-dhcp6.h

@@ -41,7 +41,6 @@ CONFIG_PARSER_PROTOTYPE(config_parse_dhcp6_pd_hint);
 CONFIG_PARSER_PROTOTYPE(config_parse_dhcp6_mud_url);
 CONFIG_PARSER_PROTOTYPE(config_parse_dhcp6_client_start_mode);
 CONFIG_PARSER_PROTOTYPE(config_parse_dhcp6_pd_subnet_id);
-CONFIG_PARSER_PROTOTYPE(config_parse_dhcp6_pd_token);
 
 const char* dhcp6_client_start_mode_to_string(DHCP6ClientStartMode i) _const_;
 DHCP6ClientStartMode dhcp6_client_start_mode_from_string(const char *s) _pure_;

src/network/networkd-ipv4ll.c

@@ -31,9 +31,9 @@ static int address_new_from_ipv4ll(Link *link, Address **ret) {
         address->family = AF_INET;
         address->in_addr.in = addr;
         address->prefixlen = 16;
-        address->broadcast.s_addr = address->in_addr.in.s_addr | htobe32(UINT32_C(0xffffffff) >> address->prefixlen);
         address->scope = RT_SCOPE_LINK;
         address->route_metric = IPV4LL_ROUTE_METRIC;
+        address_set_broadcast(address);
 
         *ret = TAKE_PTR(address);
         return 0;

src/network/networkd-link.c

@@ -401,121 +401,6 @@ static int link_update_flags(Link *link, sd_netlink_message *m, bool force_updat
         return 0;
 }
 
-static int link_new(Manager *manager, sd_netlink_message *message, Link **ret) {
-        _cleanup_(link_unrefp) Link *link = NULL;
-        const char *ifname, *kind = NULL;
-        unsigned short iftype;
-        int r, ifindex;
-        uint16_t type;
-
-        assert(manager);
-        assert(message);
-        assert(ret);
-
-        /* check for link kind */
-        r = sd_netlink_message_enter_container(message, IFLA_LINKINFO);
-        if (r == 0) {
-                (void) sd_netlink_message_read_string(message, IFLA_INFO_KIND, &kind);
-                r = sd_netlink_message_exit_container(message);
-                if (r < 0)
-                        return r;
-        }
-
-        r = sd_netlink_message_get_type(message, &type);
-        if (r < 0)
-                return r;
-        else if (type != RTM_NEWLINK)
-                return -EINVAL;
-
-        r = sd_rtnl_message_link_get_ifindex(message, &ifindex);
-        if (r < 0)
-                return r;
-        else if (ifindex <= 0)
-                return -EINVAL;
-
-        r = sd_rtnl_message_link_get_type(message, &iftype);
-        if (r < 0)
-                return r;
-
-        r = sd_netlink_message_read_string(message, IFLA_IFNAME, &ifname);
-        if (r < 0)
-                return r;
-
-        link = new(Link, 1);
-        if (!link)
-                return -ENOMEM;
-
-        *link = (Link) {
-                .n_ref = 1,
-                .manager = manager,
-                .state = LINK_STATE_PENDING,
-                .ifindex = ifindex,
-                .iftype = iftype,
-
-                .n_dns = UINT_MAX,
-                .dns_default_route = -1,
-                .llmnr = _RESOLVE_SUPPORT_INVALID,
-                .mdns = _RESOLVE_SUPPORT_INVALID,
-                .dnssec_mode = _DNSSEC_MODE_INVALID,
-                .dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID,
-        };
-
-        link->ifname = strdup(ifname);
-        if (!link->ifname)
-                return -ENOMEM;
-
-        if (kind) {
-                link->kind = strdup(kind);
-                if (!link->kind)
-                        return -ENOMEM;
-        }
-
-        r = sd_netlink_message_read_u32(message, IFLA_MASTER, (uint32_t *)&link->master_ifindex);
-        if (r < 0)
-                log_link_debug_errno(link, r, "New device has no master, continuing without");
-
-        r = netlink_message_read_hw_addr(message, IFLA_ADDRESS, &link->hw_addr);
-        if (r < 0)
-                log_link_debug_errno(link, r, "Hardware address not found for new device, continuing without");
-
-        r = netlink_message_read_hw_addr(message, IFLA_BROADCAST, &link->bcast_addr);
-        if (r < 0)
-                log_link_debug_errno(link, r, "Broadcast address not found for new device, continuing without");
-
-        r = ethtool_get_permanent_macaddr(&manager->ethtool_fd, link->ifname, &link->permanent_mac);
-        if (r < 0)
-                log_link_debug_errno(link, r, "Permanent MAC address not found for new device, continuing without: %m");
-
-        r = ethtool_get_driver(&manager->ethtool_fd, link->ifname, &link->driver);
-        if (r < 0)
-                log_link_debug_errno(link, r, "Failed to get driver, continuing without: %m");
-
-        r = sd_netlink_message_read_strv(message, IFLA_PROP_LIST, IFLA_ALT_IFNAME, &link->alternative_names);
-        if (r < 0 && r != -ENODATA)
-                return r;
-
-        if (asprintf(&link->state_file, "/run/systemd/netif/links/%d", link->ifindex) < 0)
-                return -ENOMEM;
-
-        if (asprintf(&link->lease_file, "/run/systemd/netif/leases/%d", link->ifindex) < 0)
-                return -ENOMEM;
-
-        if (asprintf(&link->lldp_file, "/run/systemd/netif/lldp/%d", link->ifindex) < 0)
-                return -ENOMEM;
-
-        r = hashmap_ensure_put(&manager->links, NULL, INT_TO_PTR(link->ifindex), link);
-        if (r < 0)
-                return r;
-
-        r = link_update_flags(link, message, false);
-        if (r < 0)
-                return r;
-
-        *ret = TAKE_PTR(link);
-
-        return 0;
-}
-
 void link_ntp_settings_clear(Link *link) {
         link->ntp = strv_free(link->ntp);
 }
@@ -1771,24 +1656,31 @@ static void link_drop_from_master(Link *link, NetDev *netdev) {
         link_unref(set_remove(master->slaves, link));
 }
 
-static void link_detach_from_manager(Link *link) {
-        if (!link || !link->manager)
-                return;
+static void link_drop_requests(Link *link) {
+        Request *req;
 
-        link_unref(set_remove(link->manager->links_requesting_uuid, link));
-        link_clean(link);
+        assert(link);
+        assert(link->manager);
 
-        /* The following must be called at last. */
-        assert_se(hashmap_remove(link->manager->links, INT_TO_PTR(link->ifindex)) == link);
-        link_unref(link);
+        ORDERED_SET_FOREACH(req, link->manager->request_queue)
+                if (req->link == link)
+                        request_drop(req);
 }
 
-static void link_drop(Link *link) {
-        if (!link || link->state == LINK_STATE_LINGER)
-                return;
+
+static Link *link_drop(Link *link) {
+        if (!link)
+                return NULL;
+
+        assert(link->manager);
 
         link_set_state(link, LINK_STATE_LINGER);
 
+        /* Drop all references from other links and manager. Note that async netlink calls may have
+         * references to the link, and they will be dropped when we receive replies. */
+
+        link_drop_requests(link);
+
         link_free_carrier_maps(link);
 
         if (link->network) {
@@ -1797,10 +1689,14 @@ static void link_drop(Link *link) {
                 link_drop_from_master(link, link->network->bond);
         }
 
-        log_link_debug(link, "Link removed");
+        link_unref(set_remove(link->manager->links_requesting_uuid, link));
 
         (void) unlink(link->state_file);
-        link_detach_from_manager(link);
+        link_clean(link);
+
+        /* The following must be called at last. */
+        assert_se(hashmap_remove(link->manager->links, INT_TO_PTR(link->ifindex)) == link);
+        return link_unref(link);
 }
 
 int link_activate(Link *link) {
@@ -2101,17 +1997,6 @@ static int link_drop_config(Link *link) {
         return r;
 }
 
-static void link_drop_requests(Link *link) {
-        Request *req;
-
-        assert(link);
-        assert(link->manager);
-
-        ORDERED_SET_FOREACH(req, link->manager->request_queue)
-                if (req->link == link)
-                        request_drop(req);
-}
-
 int link_configure(Link *link) {
         int r;
 
@@ -2524,6 +2409,124 @@ static int link_initialized(Link *link, sd_device *device) {
         return 0;
 }
 
+static Link *link_drop_or_unref(Link *link) {
+        if (!link)
+                return NULL;
+        if (!link->manager)
+                return link_unref(link);
+        return link_drop(link);
+}
+
+DEFINE_TRIVIAL_CLEANUP_FUNC(Link*, link_drop_or_unref);
+
+static int link_new(Manager *manager, sd_netlink_message *message, Link **ret) {
+        _cleanup_(link_drop_or_unrefp) Link *link = NULL;
+        _cleanup_free_ char *ifname = NULL, *kind = NULL;
+        unsigned short iftype;
+        int r, ifindex;
+        uint16_t type;
+
+        assert(manager);
+        assert(message);
+        assert(ret);
+
+        r = sd_netlink_message_get_type(message, &type);
+        if (r < 0)
+                return r;
+        else if (type != RTM_NEWLINK)
+                return -EINVAL;
+
+        r = sd_rtnl_message_link_get_ifindex(message, &ifindex);
+        if (r < 0)
+                return r;
+        else if (ifindex <= 0)
+                return -EINVAL;
+
+        r = sd_rtnl_message_link_get_type(message, &iftype);
+        if (r < 0)
+                return r;
+
+        r = sd_netlink_message_read_string_strdup(message, IFLA_IFNAME, &ifname);
+        if (r < 0)
+                return r;
+
+        /* check for link kind */
+        r = sd_netlink_message_enter_container(message, IFLA_LINKINFO);
+        if (r >= 0) {
+                (void) sd_netlink_message_read_string_strdup(message, IFLA_INFO_KIND, &kind);
+                r = sd_netlink_message_exit_container(message);
+                if (r < 0)
+                        return r;
+        }
+
+        link = new(Link, 1);
+        if (!link)
+                return -ENOMEM;
+
+        *link = (Link) {
+                .n_ref = 1,
+                .state = LINK_STATE_PENDING,
+                .ifindex = ifindex,
+                .iftype = iftype,
+                .ifname = TAKE_PTR(ifname),
+                .kind = TAKE_PTR(kind),
+
+                .n_dns = UINT_MAX,
+                .dns_default_route = -1,
+                .llmnr = _RESOLVE_SUPPORT_INVALID,
+                .mdns = _RESOLVE_SUPPORT_INVALID,
+                .dnssec_mode = _DNSSEC_MODE_INVALID,
+                .dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID,
+        };
+
+        r = hashmap_ensure_put(&manager->links, NULL, INT_TO_PTR(link->ifindex), link);
+        if (r < 0)
+                return r;
+
+        link->manager = manager;
+
+        r = sd_netlink_message_read_u32(message, IFLA_MASTER, (uint32_t*) &link->master_ifindex);
+        if (r < 0)
+                log_link_debug_errno(link, r, "New device has no master, continuing without");
+
+        r = netlink_message_read_hw_addr(message, IFLA_ADDRESS, &link->hw_addr);
+        if (r < 0)
+                log_link_debug_errno(link, r, "Hardware address not found for new device, continuing without");
+
+        r = netlink_message_read_hw_addr(message, IFLA_BROADCAST, &link->bcast_addr);
+        if (r < 0)
+                log_link_debug_errno(link, r, "Broadcast address not found for new device, continuing without");
+
+        r = ethtool_get_permanent_macaddr(&manager->ethtool_fd, link->ifname, &link->permanent_mac);
+        if (r < 0)
+                log_link_debug_errno(link, r, "Permanent MAC address not found for new device, continuing without: %m");
+
+        r = ethtool_get_driver(&manager->ethtool_fd, link->ifname, &link->driver);
+        if (r < 0)
+                log_link_debug_errno(link, r, "Failed to get driver, continuing without: %m");
+
+        r = sd_netlink_message_read_strv(message, IFLA_PROP_LIST, IFLA_ALT_IFNAME, &link->alternative_names);
+        if (r < 0 && r != -ENODATA)
+                return r;
+
+        if (asprintf(&link->state_file, "/run/systemd/netif/links/%d", link->ifindex) < 0)
+                return -ENOMEM;
+
+        if (asprintf(&link->lease_file, "/run/systemd/netif/leases/%d", link->ifindex) < 0)
+                return -ENOMEM;
+
+        if (asprintf(&link->lldp_file, "/run/systemd/netif/lldp/%d", link->ifindex) < 0)
+                return -ENOMEM;
+
+        r = link_update_flags(link, message, false);
+        if (r < 0)
+                return r;
+
+        *ret = TAKE_PTR(link);
+
+        return 0;
+}
+
 static int link_add(Manager *m, sd_netlink_message *message, Link **ret) {
         _cleanup_(sd_device_unrefp) sd_device *device = NULL;
         char ifindex_str[2 + DECIMAL_STR_MAX(int)];

src/network/networkd-ndisc.c

@@ -541,7 +541,7 @@ static int ndisc_router_process_default(Link *link, sd_ndisc_router *rt) {
         if (r < 0)
                 return log_link_error_errno(link, r, "Failed to get gateway address from RA: %m");
 
-        if (link_has_ipv6_address(link, &gateway) > 0) {
+        if (link_get_ipv6_address(link, &gateway, NULL) >= 0) {
                 if (DEBUG_LOGGING) {
                         _cleanup_free_ char *buffer = NULL;
 
@@ -918,7 +918,7 @@ static int ndisc_router_process_route(Link *link, sd_ndisc_router *rt) {
         if (r < 0)
                 return log_link_error_errno(link, r, "Failed to get gateway address from RA: %m");
 
-        if (link_has_ipv6_address(link, &gateway) > 0) {
+        if (link_get_ipv6_address(link, &gateway, NULL) >= 0) {
                 if (DEBUG_LOGGING) {
                         _cleanup_free_ char *buf = NULL;
 

src/network/networkd-neighbor.c

@@ -479,6 +479,9 @@ int request_process_neighbor(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)

src/network/networkd-network-gperf.gperf

@@ -261,7 +261,8 @@ IPv6AcceptRA.PrefixAllowList,                config_parse_ndisc_address_filter,
 IPv6AcceptRA.PrefixDenyList,                 config_parse_ndisc_address_filter,                        0,                             offsetof(Network, ndisc_deny_listed_prefix)
 IPv6AcceptRA.RouteAllowList,                 config_parse_ndisc_address_filter,                        0,                             offsetof(Network, ndisc_allow_listed_route_prefix)
 IPv6AcceptRA.RouteDenyList,                  config_parse_ndisc_address_filter,                        0,                             offsetof(Network, ndisc_deny_listed_route_prefix)
-DHCPServer.RelayTarget,                      config_parse_dhcp_server_relay_target,                    0,                             0
+DHCPServer.ServerAddress,                    config_parse_dhcp_server_address,                         0,                             0
+DHCPServer.RelayTarget,                      config_parse_in_addr_non_null,                            AF_INET,                       offsetof(Network, dhcp_server_relay_target)
 DHCPServer.RelayAgentCircuitId,              config_parse_dhcp_server_relay_agent_suboption,           0,                             offsetof(Network, dhcp_server_relay_agent_circuit_id)
 DHCPServer.RelayAgentRemoteId,               config_parse_dhcp_server_relay_agent_suboption,           0,                             offsetof(Network, dhcp_server_relay_agent_remote_id)
 DHCPServer.MaxLeaseTimeSec,                  config_parse_sec,                                         0,                             offsetof(Network, dhcp_server_max_lease_time_usec)
@@ -314,7 +315,7 @@ DHCPv6PrefixDelegation.SubnetId,             config_parse_dhcp6_pd_subnet_id,
 DHCPv6PrefixDelegation.Announce,             config_parse_bool,                                        0,                             offsetof(Network, dhcp6_pd_announce)
 DHCPv6PrefixDelegation.Assign,               config_parse_bool,                                        0,                             offsetof(Network, dhcp6_pd_assign)
 DHCPv6PrefixDelegation.ManageTemporaryAddress, config_parse_bool,                                      0,                             offsetof(Network, dhcp6_pd_manage_temporary_address)
-DHCPv6PrefixDelegation.Token,                config_parse_dhcp6_pd_token,                              0,                             offsetof(Network, dhcp6_pd_token)
+DHCPv6PrefixDelegation.Token,                config_parse_in_addr_non_null,                            AF_INET6,                      offsetof(Network, dhcp6_pd_token)
 DHCPv6PrefixDelegation.RouteMetric,          config_parse_uint32,                                      0,                             offsetof(Network, dhcp6_pd_route_metric)
 IPv6SendRA.RouterLifetimeSec,                config_parse_sec,                                         0,                             offsetof(Network, router_lifetime_usec)
 IPv6SendRA.Managed,                          config_parse_bool,                                        0,                             offsetof(Network, router_managed)

src/network/networkd-network.c

@@ -240,6 +240,8 @@ int network_verify(Network *network) {
         network_drop_invalid_traffic_control(network);
         network_drop_invalid_sr_iov(network);
 
+        network_adjust_dhcp_server(network);
+
         return 0;
 }
 

src/network/networkd-network.h

@@ -189,10 +189,11 @@ struct Network {
         /* DHCP Server Support */
         bool dhcp_server;
         bool dhcp_server_bind_to_interface;
+        unsigned char dhcp_server_address_prefixlen;
+        struct in_addr dhcp_server_address;
         struct in_addr dhcp_server_relay_target;
         char *dhcp_server_relay_agent_circuit_id;
         char *dhcp_server_relay_agent_remote_id;
-
         NetworkDHCPServerEmitAddress dhcp_server_emit[_SD_DHCP_LEASE_SERVER_TYPE_MAX];
         bool dhcp_server_emit_router;
         bool dhcp_server_emit_timezone;

src/network/networkd-nexthop.c

@@ -751,6 +751,9 @@ int request_process_nexthop(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)

src/network/networkd-route.c

@@ -1622,6 +1622,9 @@ int request_process_route(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 assert(n_routes > 0);
 

src/network/networkd-routing-policy-rule.c

@@ -814,6 +814,9 @@ int request_process_routing_policy_rule(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)

src/rc-local-generator/rc-local-generator.c

@@ -24,7 +24,7 @@ static int add_symlink(const char *service, const char *where) {
         assert(service);
         assert(where);
 
-        from = strjoina(SYSTEM_DATA_UNIT_PATH "/", service);
+        from = strjoina(SYSTEM_DATA_UNIT_DIR "/", service);
         to = strjoina(arg_dest, "/", where, ".wants/", service);
 
         (void) mkdir_parents_label(to, 0755);

src/resolve/meson.build

@@ -158,20 +158,19 @@ if conf.get('ENABLE_RESOLVE') == 1
                      install_dir : dbussystemservicedir)
         install_data('org.freedesktop.resolve1.policy',
                      install_dir : polkitpolicydir)
-
-        resolved_conf = configure_file(
-                input : 'resolved.conf.in',
-                output : 'resolved.conf',
-                configuration : substs)
-        if install_sysconfdir_samples
-                install_data(resolved_conf,
-                             install_dir : pkgsysconfdir)
-        endif
-
         install_data('resolv.conf',
                      install_dir : rootlibexecdir)
 endif
 
+custom_target(
+        'resolved.conf',
+        input : 'resolved.conf.in',
+        output : 'resolved.conf',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : conf.get('ENABLE_RESOLVE') == 1 and install_sysconfdir_samples,
+        install_dir : pkgsysconfdir)
+
 ############################################################
 
 tests += [

src/resolve/resolved.conf.in

@@ -20,12 +20,12 @@
 # Google:     8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
 # Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
 #DNS=
-#FallbackDNS=@DNS_SERVERS@
+#FallbackDNS={{DNS_SERVERS}}
 #Domains=
-#DNSSEC=@DEFAULT_DNSSEC_MODE@
-#DNSOverTLS=@DEFAULT_DNS_OVER_TLS_MODE@
-#MulticastDNS=@DEFAULT_MDNS_MODE@
-#LLMNR=@DEFAULT_LLMNR_MODE@
+#DNSSEC={{DEFAULT_DNSSEC_MODE_STR}}
+#DNSOverTLS={{DEFAULT_DNS_OVER_TLS_MODE_STR}}
+#MulticastDNS={{DEFAULT_MDNS_MODE_STR}}
+#LLMNR={{DEFAULT_LLMNR_MODE_STR}}
 #Cache=yes
 #CacheFromLocalhost=no
 #DNSStubListener=yes

src/rpm/macros.systemd.in

@@ -5,25 +5,25 @@
 
 # RPM macros for packages installing systemd unit files
 
-%_systemd_util_dir @rootlibexecdir@
-%_unitdir @systemunitdir@
-%_userunitdir @userunitdir@
-%_presetdir @systempresetdir@
-%_userpresetdir @userpresetdir@
-%_udevhwdbdir @udevhwdbdir@
-%_udevrulesdir @udevrulesdir@
-%_journalcatalogdir @catalogdir@
-%_binfmtdir @binfmtdir@
-%_sysctldir @sysctldir@
-%_sysusersdir @sysusersdir@
-%_tmpfilesdir @tmpfilesdir@
-%_environmentdir @environmentdir@
-%_modulesloaddir @modulesloaddir@
-%_modprobedir @modprobedir@
-%_systemdgeneratordir @systemgeneratordir@
-%_systemdusergeneratordir @usergeneratordir@
-%_systemd_system_env_generator_dir @systemenvgeneratordir@
-%_systemd_user_env_generator_dir @userenvgeneratordir@
+%_systemd_util_dir {{ROOTLIBEXECDIR}}
+%_unitdir {{SYSTEM_DATA_UNIT_DIR}}
+%_userunitdir {{USER_DATA_UNIT_DIR}}
+%_presetdir {{SYSTEM_PRESET_DIR}}
+%_userpresetdir {{USER_PRESET_DIR}}
+%_udevhwdbdir {{UDEV_HWDB_DIR}}
+%_udevrulesdir {{UDEV_RULES_DIR}}
+%_journalcatalogdir {{SYSTEMD_CATALOG_DIR}}
+%_binfmtdir {{BINFMT_DIR}}
+%_sysctldir {{SYSCTL_DIR}}
+%_sysusersdir {{SYSUSERS_DIR}}
+%_tmpfilesdir {{TMPFILES_DIR}}
+%_environmentdir {{ENVIRONMENT_DIR}}
+%_modulesloaddir {{MODULESLOAD_DIR}}
+%_modprobedir {{MODPROBE_DIR}}
+%_systemdgeneratordir {{SYSTEM_GENERATOR_DIR}}
+%_systemdusergeneratordir {{USER_GENERATOR_DIR}}
+%_systemd_system_env_generator_dir {{SYSTEM_ENV_GENERATOR_DIR}}
+%_systemd_user_env_generator_dir {{USER_ENV_GENERATOR_DIR}}
 
 # Because we had one release with a typo...
 # This is temporary (Remove after systemd 240 is released)
@@ -46,9 +46,9 @@ OrderWithRequires(postun): systemd \
 
 %systemd_post() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# systemd_post}} \
-if [ $1 -eq 1 ] && [ -x @bindir@/systemctl ]; then \
+if [ $1 -eq 1 ] && [ -x %{_bindir}/systemctl ]; then \
     # Initial installation \
-    @bindir@/systemctl --no-reload preset %{?*} || : \
+    %{_bindir}/systemctl --no-reload preset %{?*} || : \
 fi \
 %{nil}
 
@@ -56,21 +56,21 @@ fi \
 
 %systemd_preun() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# systemd_preun}} \
-if [ $1 -eq 0 ] && [ -x @bindir@/systemctl ]; then \
+if [ $1 -eq 0 ] && [ -x %{_bindir}/systemctl ]; then \
     # Package removal, not upgrade \
     if [ -d /run/systemd/system ]; then \
-          @bindir@/systemctl --no-reload disable --now %{?*} || : \
+          %{_bindir}/systemctl --no-reload disable --now %{?*} || : \
     else \
-          @bindir@/systemctl --no-reload disable %{?*} || : \
+          %{_bindir}/systemctl --no-reload disable %{?*} || : \
     fi \
 fi \
 %{nil}
 
 %systemd_user_preun() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# systemd_user_preun}} \
-if [ $1 -eq 0 ] && [ -x @bindir@/systemctl ]; then \
+if [ $1 -eq 0 ] && [ -x %{_bindir}/systemctl ]; then \
     # Package removal, not upgrade \
-    @bindir@/systemctl --global disable %{?*} || : \
+    %{_bindir}/systemctl --global disable %{?*} || : \
 fi \
 %{nil}
 
@@ -84,10 +84,10 @@ fi \
 
 %systemd_postun_with_restart() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# systemd_postun_with_restart}} \
-if [ $1 -ge 1 ] && [ -x @bindir@/systemctl ]; then \
+if [ $1 -ge 1 ] && [ -x %{_bindir}/systemctl ]; then \
     # Package upgrade, not uninstall \
     for unit in %{?*}; do \
-         @bindir@/systemctl set-property $unit Markers=+needs-restart || : \
+         %{_bindir}/systemctl set-property $unit Markers=+needs-restart || : \
     done \
 fi \
 %{nil}
@@ -105,17 +105,17 @@ fi \
 # Deprecated. Use %tmpfiles_create_package instead
 %tmpfiles_create() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# tmpfiles_create}} \
-[ -x @bindir@/systemd-tmpfiles ] && @bindir@/systemd-tmpfiles --create %{?*} || : \
+[ -x %{_bindir}/systemd-tmpfiles ] && %{_bindir}/systemd-tmpfiles --create %{?*} || : \
 %{nil}
 
 # Deprecated. Use %sysusers_create_package instead
 %sysusers_create() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# sysusers_create}} \
-[ -x @bindir@/systemd-sysusers ] && @bindir@/systemd-sysusers %{?*} || : \
+[ -x %{_bindir}/systemd-sysusers ] && %{_bindir}/systemd-sysusers %{?*} || : \
 %{nil}
 
 %sysusers_create_inline() \
-[ -x @bindir@/systemd-sysusers ] && @bindir@/systemd-sysusers - <<SYSTEMD_INLINE_EOF || : \
+[ -x %{_bindir}/systemd-sysusers ] && %{_bindir}/systemd-sysusers - <<SYSTEMD_INLINE_EOF || : \
 %{?*} \
 SYSTEMD_INLINE_EOF\
 %{nil}
@@ -162,10 +162,10 @@ SYSTEMD_INLINE_EOF\
 
 %sysctl_apply() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# sysctl_apply}} \
-[ -x @rootlibexecdir@/systemd-sysctl ] && @rootlibexecdir@/systemd-sysctl %{?*} || : \
+[ -x {{ROOTLIBEXECDIR}}/systemd-sysctl ] && {{ROOTLIBEXECDIR}}/systemd-sysctl %{?*} || : \
 %{nil}
 
 %binfmt_apply() \
 %{expand:%%{?__systemd_someargs_%#:%%__systemd_someargs_%# binfmt_apply}} \
-[ -x @rootlibexecdir@/systemd-binfmt ] && @rootlibexecdir@/systemd-binfmt %{?*} || : \
+[ -x {{ROOTLIBEXECDIR}}/systemd-binfmt ] && {{ROOTLIBEXECDIR}}/systemd-binfmt %{?*} || : \
 %{nil}

src/rpm/meson.build

@@ -1,18 +1,22 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-configure_file(
-        input : 'macros.systemd.in',
-        output : 'macros.systemd',
-        configuration : substs,
-        install_dir : rpmmacrosdir == 'no' ? '' : rpmmacrosdir)
+in_files = [
+        ['macros.systemd',      rpmmacrosdir != 'no'],
+        ['triggers.systemd',    false],
+        ['triggers.systemd.sh', false]]
 
-# Those doesn't get installed anywhere, one of them needs to included in the
-# rpm spec file definition.
-configure_file(
-        input : 'triggers.systemd.in',
-        output : 'triggers.systemd',
-        configuration : substs)
-configure_file(
-        input : 'triggers.systemd.sh.in',
-        output : 'triggers.systemd.sh',
-        configuration : substs)
+# The last two don't get installed anywhere, one of them needs to included in
+# the rpm spec file definition instead.
+
+foreach tuple : in_files
+        file = tuple[0]
+        custom_target(
+                file,
+                input : file + '.in',
+                output : file,
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
+                capture : true,
+                install : tuple[1],
+                install_dir : rpmmacrosdir,
+                build_by_default : true)
+endforeach

src/rpm/triggers.systemd.in

@@ -8,7 +8,7 @@
 #
 # Minimum rpm version supported: 4.14.0
 
-%transfiletriggerin -P 900900 -p <lua> -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerin -P 900900 -p <lua> -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 -- This script will run after any package is initially installed or
 -- upgraded. We care about the case where a package is initially
 -- installed, because other cases are covered by the *un scriptlets,
@@ -29,7 +29,7 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerpostun -P 1000100 -p <lua> -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerpostun -P 1000100 -p <lua> -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 -- On removal, we need to run daemon-reload after any units have been
 -- removed.
 -- On upgrade, we need to run daemon-reload after any new unit files
@@ -44,7 +44,7 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerpostun -P 10000 -p <lua> -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerpostun -P 10000 -p <lua> -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 -- We restart remaining services that should be restarted here.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
@@ -55,8 +55,8 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 100700 -p <lua> -- @sysusersdir@
--- This script will process files installed in @sysusersdir@ to create
+%transfiletriggerin -P 100700 -p <lua> -- {{SYSUSERS_DIR}}
+-- This script will process files installed in {{SYSUSERS_DIR}} to create
 -- specified users automatically. The priority is set such that it
 -- will run before the tmpfiles file trigger.
 if posix.access("/run/systemd/system") then
@@ -68,9 +68,9 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 1000700 udev -p <lua> -- @udevhwdbdir@
+%transfiletriggerin -P 1000700 udev -p <lua> -- {{UDEV_HWDB_DIR}}
 -- This script will automatically invoke hwdb update if files have been
--- installed or updated in @udevhwdbdir@.
+-- installed or updated in {{UDEV_HWDB_DIR}}.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
     if pid == 0 then
@@ -80,9 +80,9 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 1000700 -p <lua> -- @catalogdir@
+%transfiletriggerin -P 1000700 -p <lua> -- {{SYSTEMD_CATALOG_DIR}}
 -- This script will automatically invoke journal catalog update if files
--- have been installed or updated in @catalogdir@.
+-- have been installed or updated in {{SYSTEMD_CATALOG_DIR}}.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
     if pid == 0 then
@@ -92,20 +92,20 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 1000700 -p <lua> -- @binfmtdir@
+%transfiletriggerin -P 1000700 -p <lua> -- {{BINFMT_DIR}}
 -- This script will automatically apply binfmt rules if files have been
--- installed or updated in @binfmtdir@.
+-- installed or updated in {{BINFMT_DIR}}.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
     if pid == 0 then
-        assert(posix.exec("@rootlibexecdir@/systemd-binfmt"))
+        assert(posix.exec("{{ROOTLIBEXECDIR}}/systemd-binfmt"))
     elseif pid > 0 then
         posix.wait(pid)
     end
 end
 
-%transfiletriggerin -P 1000600 -p <lua> -- @tmpfilesdir@
--- This script will process files installed in @tmpfilesdir@ to create
+%transfiletriggerin -P 1000600 -p <lua> -- {{TMPFILES_DIR}}
+-- This script will process files installed in {{TMPFILES_DIR}} to create
 -- tmpfiles automatically. The priority is set such that it will run
 -- after the sysusers file trigger, but before any other triggers.
 if posix.access("/run/systemd/system") then
@@ -117,9 +117,9 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 1000600 udev -p <lua> -- @udevrulesdir@
+%transfiletriggerin -P 1000600 udev -p <lua> -- {{UDEV_RULES_DIR}}
 -- This script will automatically update udev with new rules if files
--- have been installed or updated in @udevrulesdir@.
+-- have been installed or updated in {{UDEV_RULES_DIR}}.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
     if pid == 0 then
@@ -129,13 +129,13 @@ if posix.access("/run/systemd/system") then
     end
 end
 
-%transfiletriggerin -P 1000500 -p <lua> -- @sysctldir@
+%transfiletriggerin -P 1000500 -p <lua> -- {{SYSCTL_DIR}}
 -- This script will automatically apply sysctl rules if files have been
--- installed or updated in @sysctldir@.
+-- installed or updated in {{SYSCTL_DIR}}.
 if posix.access("/run/systemd/system") then
     pid = posix.fork()
     if pid == 0 then
-        assert(posix.exec("@rootlibexecdir@/systemd-sysctl"))
+        assert(posix.exec("{{ROOTLIBEXECDIR}}/systemd-sysctl"))
     elseif pid > 0 then
         posix.wait(pid)
     end

src/rpm/triggers.systemd.sh.in

@@ -9,7 +9,7 @@
 #
 # Minimum rpm version supported: 4.14.0
 
-%transfiletriggerin -P 900900 -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerin -P 900900 -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 # This script will run after any package is initially installed or
 # upgraded. We care about the case where a package is initially
 # installed, because other cases are covered by the *un scriptlets,
@@ -19,7 +19,7 @@ if test -d "/run/systemd/system"; then
   %{_bindir}/systemctl reload-or-restart --marked || :
 fi
 
-%transfiletriggerpostun -P 1000100 -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerpostun -P 1000100 -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 # On removal, we need to run daemon-reload after any units have been
 # removed.
 # On upgrade, we need to run daemon-reload after any new unit files
@@ -29,61 +29,61 @@ if test -d "/run/systemd/system"; then
   %{_bindir}/systemctl daemon-reload || :
 fi
 
-%transfiletriggerpostun -P 10000 -- @systemunitdir@ /etc/systemd/system
+%transfiletriggerpostun -P 10000 -- {{SYSTEM_DATA_UNIT_DIR}} /etc/systemd/system
 # We restart remaining services that should be restarted here.
 if test -d "/run/systemd/system"; then
   %{_bindir}/systemctl reload-or-restart --marked || :
 fi
 
-%transfiletriggerin -P 1000700 -- @sysusersdir@
-# This script will process files installed in @sysusersdir@ to create
+%transfiletriggerin -P 1000700 -- {{SYSUSERS_DIR}}
+# This script will process files installed in {{SYSUSERS_DIR}} to create
 # specified users automatically. The priority is set such that it
 # will run before the tmpfiles file trigger.
 if test -d "/run/systemd/system"; then
   %{_bindir}/systemd-sysusers || :
 fi
 
-%transfiletriggerin -P 1000700 udev -- @udevhwdbdir@
+%transfiletriggerin -P 1000700 udev -- {{UDEV_HWDB_DIR}}
 # This script will automatically invoke hwdb update if files have been
-# installed or updated in @udevhwdbdir@.
+# installed or updated in {{UDEV_HWDB_DIR}}.
 if test -d "/run/systemd/system"; then
   %{_bindir}/systemd-hwdb update || :
 fi
 
-%transfiletriggerin -P 1000700 -- @catalogdir@
+%transfiletriggerin -P 1000700 -- {{SYSTEMD_CATALOG_DIR}}
 # This script will automatically invoke journal catalog update if files
-# have been installed or updated in @catalogdir@.
+# have been installed or updated in {{SYSTEMD_CATALOG_DIR}}.
 if test -d "/run/systemd/system"; then
   %{_bindir}/journalctl --update-catalog || :
 fi
 
-%transfiletriggerin -P 1000700 -- @binfmtdir@
+%transfiletriggerin -P 1000700 -- {{BINFMT_DIR}}
 # This script will automatically apply binfmt rules if files have been
-# installed or updated in @binfmtdir@.
+# installed or updated in {{BINFMT_DIR}}.
 if test -d "/run/systemd/system"; then
   # systemd-binfmt might fail if binfmt_misc kernel module is not loaded
   # during install
-  @rootlibexecdir@/systemd-binfmt || :
+  {{ROOTLIBEXECDIR}}/systemd-binfmt || :
 fi
 
-%transfiletriggerin -P 1000600 -- @tmpfilesdir@
-# This script will process files installed in @tmpfilesdir@ to create
+%transfiletriggerin -P 1000600 -- {{TMPFILES_DIR}}
+# This script will process files installed in {{TMPFILES_DIR}} to create
 # tmpfiles automatically. The priority is set such that it will run
 # after the sysusers file trigger, but before any other triggers.
 if test -d "/run/systemd/system"; then
   %{_bindir}/systemd-tmpfiles --create || :
 fi
 
-%transfiletriggerin -P 1000600 udev -- @udevrulesdir@
+%transfiletriggerin -P 1000600 udev -- {{UDEV_RULES_DIR}}
 # This script will automatically update udev with new rules if files
-# have been installed or updated in @udevrulesdir@.
+# have been installed or updated in {{UDEV_RULES_DIR}}.
 if test -e /run/udev/control; then
   %{_bindir}/udevadm control --reload || :
 fi
 
-%transfiletriggerin -P 1000500 -- @sysctldir@
+%transfiletriggerin -P 1000500 -- {{SYSCTL_DIR}}
 # This script will automatically apply sysctl rules if files have been
-# installed or updated in @sysctldir@.
+# installed or updated in {{SYSCTL_DIR}}.
 if test -d "/run/systemd/system"; then
-  @rootlibexecdir@/systemd-sysctl || :
+  {{ROOTLIBEXECDIR}}/systemd-sysctl || :
 fi

src/shared/conf-parser.c

@@ -16,6 +16,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
+#include "in-addr-util.h"
 #include "log.h"
 #include "macro.h"
 #include "missing_network.h"
@@ -1359,5 +1360,57 @@ int config_parse_hwaddrs(
         }
 }
 
+int config_parse_in_addr_non_null(
+                const char *unit,
+                const char *filename,
+                unsigned line,
+                const char *section,
+                unsigned section_line,
+                const char *lvalue,
+                int ltype,
+                const char *rvalue,
+                void *data,
+                void *userdata) {
+
+        /* data must be a pointer to struct in_addr or in6_addr, and the type is determined by ltype. */
+        struct in_addr *ipv4 = data;
+        struct in6_addr *ipv6 = data;
+        union in_addr_union a;
+        int r;
+
+        assert(filename);
+        assert(lvalue);
+        assert(rvalue);
+        assert(data);
+        assert(IN_SET(ltype, AF_INET, AF_INET6));
+
+        if (isempty(rvalue)) {
+                if (ltype == AF_INET)
+                        *ipv4 = (struct in_addr) {};
+                else
+                        *ipv6 = (struct in6_addr) {};
+                return 0;
+        }
+
+        r = in_addr_from_string(ltype, rvalue, &a);
+        if (r < 0) {
+                log_syntax(unit, LOG_WARNING, filename, line, r,
+                           "Failed to parse %s=, ignoring assignment: %s", lvalue, rvalue);
+                return 0;
+        }
+
+        if (!in_addr_is_set(ltype, &a)) {
+                log_syntax(unit, LOG_WARNING, filename, line, 0,
+                           "%s= cannot be the ANY address, ignoring: %s", lvalue, rvalue);
+                return 0;
+        }
+
+        if (ltype == AF_INET)
+                *ipv4 = a.in;
+        else
+                *ipv6 = a.in6;
+        return 0;
+}
+
 DEFINE_CONFIG_PARSE(config_parse_percent, parse_percent, "Failed to parse percent value");
 DEFINE_CONFIG_PARSE(config_parse_permyriad, parse_permyriad, "Failed to parse permyriad value");

src/shared/conf-parser.h

@@ -149,6 +149,7 @@ CONFIG_PARSER_PROTOTYPE(config_parse_rlimit);
 CONFIG_PARSER_PROTOTYPE(config_parse_vlanprotocol);
 CONFIG_PARSER_PROTOTYPE(config_parse_hwaddr);
 CONFIG_PARSER_PROTOTYPE(config_parse_hwaddrs);
+CONFIG_PARSER_PROTOTYPE(config_parse_in_addr_non_null);
 CONFIG_PARSER_PROTOTYPE(config_parse_percent);
 CONFIG_PARSER_PROTOTYPE(config_parse_permyriad);
 

src/shared/generator.c

@@ -185,7 +185,7 @@ int generator_write_fsck_deps(
                 lnk = strjoina(dir, "/" SPECIAL_LOCAL_FS_TARGET ".wants/" SPECIAL_FSCK_ROOT_SERVICE);
 
                 (void) mkdir_parents(lnk, 0755);
-                if (symlink(SYSTEM_DATA_UNIT_PATH "/" SPECIAL_FSCK_ROOT_SERVICE, lnk) < 0)
+                if (symlink(SYSTEM_DATA_UNIT_DIR "/" SPECIAL_FSCK_ROOT_SERVICE, lnk) < 0)
                         return log_error_errno(errno, "Failed to create symlink %s: %m", lnk);
 
         } else {
@@ -561,7 +561,7 @@ int generator_hook_up_growfs(
 int generator_enable_remount_fs_service(const char *dir) {
         /* Pull in systemd-remount-fs.service */
         return generator_add_symlink(dir, SPECIAL_LOCAL_FS_TARGET, "wants",
-                                     SYSTEM_DATA_UNIT_PATH "/" SPECIAL_REMOUNT_FS_SERVICE);
+                                     SYSTEM_DATA_UNIT_DIR "/" SPECIAL_REMOUNT_FS_SERVICE);
 }
 
 int generator_write_blockdev_dependency(

src/shared/install.c

@@ -247,7 +247,7 @@ static int path_is_vendor_or_generator(const LookupPaths *p, const char *path) {
         if (path_is_generator(p, rpath))
                 return true;
 
-        return path_equal(rpath, SYSTEM_DATA_UNIT_PATH);
+        return path_equal(rpath, SYSTEM_DATA_UNIT_DIR);
 }
 
 static const char* config_path_from_flags(const LookupPaths *paths, UnitFileFlags flags) {

src/system-update-generator/system-update-generator.c

@@ -30,7 +30,7 @@ static int generate_symlink(void) {
         }
 
         p = strjoina(arg_dest, "/" SPECIAL_DEFAULT_TARGET);
-        if (symlink(SYSTEM_DATA_UNIT_PATH "/system-update.target", p) < 0)
+        if (symlink(SYSTEM_DATA_UNIT_DIR "/system-update.target", p) < 0)
                 return log_error_errno(errno, "Failed to create symlink %s: %m", p);
 
         return 1;

src/timesync/meson.build

@@ -34,15 +34,16 @@ libtimesyncd_core = static_library(
         include_directories : includes,
         link_with : [timesyncd_link_with])
 
+custom_target(
+        'timesyncd.conf',
+        input : 'timesyncd.conf.in',
+        output : 'timesyncd.conf',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : conf.get('ENABLE_TIMESYNCD') == 1 and install_sysconfdir_samples,
+        install_dir : pkgsysconfdir)
+
 if conf.get('ENABLE_TIMESYNCD') == 1
-        timesyncd_conf = configure_file(
-                input : 'timesyncd.conf.in',
-                output : 'timesyncd.conf',
-                configuration : substs)
-        if install_sysconfdir_samples
-                install_data(timesyncd_conf,
-                             install_dir : pkgsysconfdir)
-        endif
         install_data('org.freedesktop.timesync1.conf',
                      install_dir : dbuspolicydir)
         install_data('org.freedesktop.timesync1.service',

src/timesync/timesyncd.conf.in

@@ -14,7 +14,7 @@
 
 [Time]
 #NTP=
-#FallbackNTP=@NTP_SERVERS@
+#FallbackNTP={{NTP_SERVERS}}
 #RootDistanceMaxSec=5
 #PollIntervalMinSec=32
 #PollIntervalMaxSec=2048

src/udev/meson.build

@@ -158,11 +158,14 @@ if install_sysconfdir_samples
                      install_dir : join_paths(sysconfdir, 'udev'))
 endif
 
-configure_file(
+custom_target(
+        'udev.pc',
         input : 'udev.pc.in',
         output : 'udev.pc',
-        configuration : substs,
-        install_dir : pkgconfigdatadir == 'no' ? '' : pkgconfigdatadir)
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : pkgconfigdatadir != 'no',
+        install_dir : pkgconfigdatadir)
 
 if install_sysconfdir
         meson.add_install_script('sh', '-c',

src/udev/udev.pc.in

@@ -9,7 +9,7 @@
 
 Name: udev
 Description: udev
-Version: @PROJECT_VERSION@
+Version: {{PROJECT_VERSION}}
 
-udev_dir=@udevlibexecdir@
+udev_dir={{UDEVLIBEXECDIR}}
 udevdir=${udev_dir}

src/vconsole/90-vconsole.rules.in

@@ -9,4 +9,4 @@
 
 # Each vtcon keeps its own state of fonts.
 #
-ACTION=="add", SUBSYSTEM=="vtconsole", KERNEL=="vtcon*", RUN+="@rootlibexecdir@/systemd-vconsole-setup"
+ACTION=="add", SUBSYSTEM=="vtconsole", KERNEL=="vtcon*", RUN+="{{ROOTLIBEXECDIR}}/systemd-vconsole-setup"

src/vconsole/meson.build

@@ -1,10 +1,10 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-if conf.get('ENABLE_VCONSOLE') == 1
-        vconsole_rules = configure_file(
-                input : '90-vconsole.rules.in',
-                output : '90-vconsole.rules',
-                configuration : substs)
-        install_data(vconsole_rules,
-                     install_dir : udevrulesdir)
-endif
+custom_target(
+        '90-vconsole.rules',
+        input : '90-vconsole.rules.in',
+        output : '90-vconsole.rules',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : conf.get('ENABLE_VCONSOLE') == 1,
+        install_dir : udevrulesdir)

sysctl.d/50-coredump.conf.in

@@ -13,7 +13,7 @@
 # the core dump.
 #
 # See systemd-coredump(8) and core(5).
-kernel.core_pattern=|@rootlibexecdir@/systemd-coredump %P %u %g %s %t %c %h
+kernel.core_pattern=|{{ROOTLIBEXECDIR}}/systemd-coredump %P %u %g %s %t %c %h
 
 # Allow 16 coredumps to be dispatched in parallel by the kernel.
 # We collect metadata from /proc/%P/, and thus need to make sure the crashed

sysctl.d/meson.build

@@ -5,8 +5,6 @@ install_data(
         '50-default.conf',
         install_dir : sysctldir)
 
-in_files = []
-
 # Kernel determines PID_MAX_LIMIT by
 # #define PID_MAX_LIMIT (CONFIG_BASE_SMALL ? PAGE_SIZE * 8 : \
 #         (sizeof(long) > 4 ? 4 * 1024 * 1024 : PID_MAX_DEFAULT))
@@ -14,18 +12,14 @@ if cc.sizeof('long') > 4
         install_data('50-pid-max.conf', install_dir : sysctldir)
 endif
 
-if conf.get('ENABLE_COREDUMP') == 1
-        in_files += ['50-coredump.conf']
-endif
-
-foreach file : in_files
-        gen = configure_file(
-                input : file + '.in',
-                output : file,
-                configuration : substs)
-        install_data(gen,
-                     install_dir : sysctldir)
-endforeach
+custom_target(
+        '50-coredump.conf',
+        input : '50-coredump.conf.in',
+        output : '50-coredump.conf',
+        command : [meson_render_jinja2, config_h, '@INPUT@'],
+        capture : true,
+        install : conf.get('ENABLE_COREDUMP') == 1,
+        install_dir : sysctldir)
 
 if install_sysconfdir
         meson.add_install_script('sh', '-c',

sysusers.d/basic.conf.in

@@ -9,7 +9,7 @@
 u root    0     "Super User" /root
 
 # The nobody user for NFS file systems
-u @NOBODY_USER_NAME@  65534 "Nobody"     -
+u {{NOBODY_USER_NAME}}  65534 "Nobody"     -
 
 # Administrator group: can *see* more than normal users
 g adm     -     -            -
@@ -19,7 +19,7 @@ g wheel   -     -            -
 
 # Access to certain kernel and userspace facilities
 g kmem    -     -            -
-g tty     @TTY_GID@     -            -
+g tty     {{TTY_GID}}     -            -
 g utmp    -     -            -
 
 # Hardware access groups
@@ -36,4 +36,4 @@ g tape    -     -            -
 g video   -     -            -
 
 # Default group for normal users
-g users   @USERS_GID@     -            -
+g users   {{USERS_GID}}     -            -

sysusers.d/meson.build

@@ -4,32 +4,19 @@ if enable_sysusers
         install_data('README', install_dir : sysusersdir)
 endif
 
-in_files = ['basic.conf']
+in_files = [['basic.conf',          enable_sysusers],
+            ['systemd.conf',        enable_sysusers],
+            ['systemd-remote.conf', enable_sysusers and
+                                    conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1]]
 
-foreach file : in_files
-        gen = configure_file(
-                input : file + '.in',
-                output : file,
-                configuration : substs)
-        if enable_sysusers
-                install_data(gen,
-                             install_dir : sysusersdir)
-        endif
-endforeach
-
-m4_files = ['systemd.conf']
-
-if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-        m4_files += ['systemd-remote.conf']
-endif
-
-foreach file : m4_files
+foreach tuple : in_files
+        file = tuple[0]
         custom_target(
-                'sysusers.d_' + file,
-                input : file + '.m4',
+                file,
+                input : file + '.in',
                 output: file,
-                command : [meson_apply_m4, config_h, '@INPUT@'],
+                command : [meson_render_jinja2, config_h, '@INPUT@'],
                 capture : true,
-                install : enable_sysusers,
+                install : tuple[1],
                 install_dir : sysusersdir)
 endforeach

sysusers.d/systemd-remote.conf.in

@@ -5,6 +5,6 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-m4_ifdef(`HAVE_MICROHTTPD',
+{% if HAVE_MICROHTTPD %}
 u systemd-journal-remote  - "systemd Journal Remote"
-)m4_dnl
+{% endif %}

sysusers.d/systemd.conf.in

@@ -6,18 +6,18 @@
 #  (at your option) any later version.
 
 g systemd-journal   - -
-m4_ifdef(`ENABLE_NETWORKD',
+{% if ENABLE_NETWORKD %}
 u systemd-network   - "systemd Network Management"
-)m4_dnl
-m4_ifdef(`ENABLE_OOMD',
+{% endif %}
+{% if ENABLE_OOMD %}
 u systemd-oom       - "systemd Userspace OOM Killer"
-)m4_dnl
-m4_ifdef(`ENABLE_RESOLVE',
+{% endif %}
+{% if ENABLE_RESOLVE %}
 u systemd-resolve   - "systemd Resolver"
-)m4_dnl
-m4_ifdef(`ENABLE_TIMESYNCD',
+{% endif %}
+{% if ENABLE_TIMESYNCD %}
 u systemd-timesync  - "systemd Time Synchronization"
-)m4_dnl
-m4_ifdef(`ENABLE_COREDUMP',
+{% endif %}
+{% if ENABLE_COREDUMP %}
 u systemd-coredump  - "systemd Core Dumper"
-)m4_dnl
+{% endif %}

test/TEST-06-SELINUX/test.sh

@@ -48,7 +48,7 @@ test_append_files() {
         cp systemd_test.fc "$workspace/systemd-test-module"
         dracut_install -o sesearch
         dracut_install runcon
-        dracut_install checkmodule semodule semodule_package m4 make load_policy sefcontext_compile
+        dracut_install checkmodule semodule semodule_package make load_policy sefcontext_compile
         dracut_install -o /usr/libexec/selinux/hll/pp # Fedora/RHEL/...
         dracut_install -o /usr/lib/selinux/hll/pp     # Debian/Ubuntu/...
     )

test/fuzz/fuzz-network-parser/directives.network

@@ -364,6 +364,7 @@ BindToInterface=
 RelayTarget=
 RelayAgentCircuitId=
 RelayAgentRemoteId=
+ServerAddress=
 [NextHop]
 Id=
 Gateway=