core/exec-invoke: fallback to set TTY specified by TTYPath= to PAM

Follow-up for 2b0087e5b171e2292c07bacef8908bf4d5339a4b.
Fixes #38486.

.github/workflows/mkosi.yml

@@ -65,6 +65,17 @@ jobs:
             no_qemu: 0
             no_kvm: 0
             shim: 0
+          - distro: debian
+            release: stable
+            runner: ubuntu-24.04
+            sanitizers: ""
+            llvm: 0
+            cflags: "-Og"
+            relabel: no
+            vm: 0
+            no_qemu: 0
+            no_kvm: 0
+            shim: 0
           - distro: debian
             release: testing
             runner: ubuntu-24.04

hwdb.d/60-keyboard.hwdb

@@ -285,6 +285,9 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnASUS:pn*:*
  KEYBOARD_KEY_ee=volumedown
  KEYBOARD_KEY_ef=mute
 
+evdev:name:Asus WMI hotkeys:dmi:bvn*:bvr*:bd*:svnASUS*:pn*M1607KA*:*
+ KEYBOARD_KEY_7e=prog2                                  # Fn+F8, launch emoji keyboard
+
 # Asus TF103C misses the home button in its PNP0C40 GPIO resources
 # causing the volume-button mappings to be off by one, correct this
 evdev:name:gpio-keys:phys:gpio-keys/input0:ev:3:dmi:*:svnASUSTeKCOMPUTERINC.:pnTF103C*:*

src/core/exec-invoke.c

@@ -1228,6 +1228,61 @@ static int attach_to_subcgroup(
         return 0;
 }
 
+static int exec_context_get_tty_for_pam(const ExecContext *context, char **ret) {
+        _cleanup_free_ char *tty = NULL;
+        int r;
+
+        assert(context);
+        assert(ret);
+
+        /* First, let's get TTY from STDIN. We may already set STDIN in setup_output(). */
+        r = getttyname_malloc(STDIN_FILENO, &tty);
+        if (r == -ENOMEM)
+                return log_oom_debug();
+        if (r >= 0) {
+                _cleanup_free_ char *q = path_join("/dev/", tty);
+                if (!q)
+                        return log_oom_debug();
+
+                log_debug("Got TTY '%s' from STDIN.", q);
+                *ret = TAKE_PTR(q);
+                return 1;
+        }
+
+        /* Next, let's try to use the TTY specified in TTYPath=. */
+        const char *t = exec_context_tty_path(context);
+        if (!t) {
+                *ret = NULL;
+                return 0;
+        }
+
+        /* If /dev/console is specified, resolve it. */
+        if (tty_is_console(t)) {
+                r = resolve_dev_console(&tty);
+                if (r < 0) {
+                        log_debug_errno(r, "Failed to resolve /dev/console, ignoring: %m");
+                        *ret = NULL;
+                        return 0;
+                }
+
+                log_debug("Got TTY '%s' from /dev/console.", tty);
+                *ret = TAKE_PTR(tty);
+                return 1;
+        }
+
+        /* Otherwise, use the specified TTY as is. */
+        if (path_startswith(t, "/dev/"))
+                tty = strdup(t);
+        else
+                tty = path_join("/dev/", t);
+        if (!tty)
+                return log_oom_debug();
+
+        log_debug("Got TTY '%s' from TTYPath= setting.", tty);
+        *ret = TAKE_PTR(tty);
+        return 1;
+}
+
 static int setup_pam(
                 const ExecContext *context,
                 const CGroupContext *cgroup_context,
@@ -1289,17 +1344,10 @@ static int setup_pam(
                 goto fail;
         }
 
-        if (getttyname_malloc(STDIN_FILENO, &tty) >= 0) {
-                _cleanup_free_ char *q = path_join("/dev", tty);
-                if (!q) {
-                        r = -ENOMEM;
-                        goto fail;
-                }
-
-                free_and_replace(tty, q);
-        }
-
-        if (tty) {
+        r = exec_context_get_tty_for_pam(context, &tty);
+        if (r < 0)
+                goto fail;
+        if (r > 0) {
                 pam_code = pam_set_item(handle, PAM_TTY, tty);
                 if (pam_code != PAM_SUCCESS)
                         goto fail;

src/core/service.c

@@ -5636,6 +5636,22 @@ int service_determine_exec_selinux_label(Service *s, char **ret) {
         return 0;
 }
 
+static int service_cgroup_freezer_action(Unit *u, FreezerAction action) {
+        Service *s = ASSERT_PTR(SERVICE(u));
+        int r;
+
+        r = unit_cgroup_freezer_action(u, action);
+        if (r <= 0)
+                return r;
+
+        if (action == FREEZER_FREEZE)
+                service_stop_watchdog(s);
+        else if (action == FREEZER_THAW)
+                service_reset_watchdog(s);
+
+        return r;
+}
+
 static const char* const service_restart_table[_SERVICE_RESTART_MAX] = {
         [SERVICE_RESTART_NO]          = "no",
         [SERVICE_RESTART_ON_SUCCESS]  = "on-success",
@@ -5773,7 +5789,7 @@ const UnitVTable service_vtable = {
         .live_mount = service_live_mount,
         .can_live_mount = service_can_live_mount,
 
-        .freezer_action = unit_cgroup_freezer_action,
+        .freezer_action = service_cgroup_freezer_action,
 
         .serialize = service_serialize,
         .deserialize_item = service_deserialize_item,

test/units/TEST-38-FREEZER.sh

@@ -360,6 +360,26 @@ testcase_preserve_state() {
     echo
 }
 
+testcase_watchdog() {
+    local unit="wd.service"
+
+    systemd-run --collect --unit "$unit" --property WatchdogSec=4s --property Type=notify \
+        /bin/bash -c 'systemd-notify --ready; while true; do systemd-notify WATCHDOG=1; sleep 1; done'
+
+    systemctl freeze "$unit"
+
+    check_freezer_state "$unit" "frozen"
+    sleep 6
+    check_freezer_state "$unit" "frozen"
+
+    systemctl thaw "$unit"
+    sleep 6
+    check_freezer_state "$unit" "running"
+    systemctl is-active "$unit"
+
+    systemctl stop "$unit"
+}
+
 if [[ -e /sys/fs/cgroup/system.slice/cgroup.freeze ]]; then
     start_test_service
     run_testcases