units: Fix the missing dependency in systemd-pcrproduct

NvPCR need to read from /var/lib/nvpcr and the current unit file is
executed before /var is mounted. This adds the dep back so its always
runs after /var is mounted like systemd-tpm2-setup.service

src/boot/stub.c

@@ -1302,9 +1302,9 @@ static EFI_STATUS run(EFI_HANDLE image) {
 
         /* Combine the initrds into one */
         _cleanup_pages_ Pages initrd_pages = {};
-        struct iovec final_initrd;
+        struct iovec final_initrd = {};
         if (n_all_initrds > 1) {
-                /* There will always be a base initrd, if this counter is higher, we need to combine them */
+                /* If there is more then 1 initrd we need to combine them */
                 err = combine_initrds(all_initrds, n_all_initrds, &initrd_pages, &final_initrd.iov_len);
                 if (err != EFI_SUCCESS)
                         return err;
@@ -1313,7 +1313,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
 
                 /* Given these might be large let's free them explicitly before we pass control to Linux */
                 initrds_free(&initrds);
-        } else
+        } else if (n_all_initrds == 1)
                 final_initrd = all_initrds[0];
 
         struct iovec kernel = IOVEC_MAKE(

src/cryptsetup/cryptsetup-generator.c

@@ -536,13 +536,13 @@ static int create_disk(
                 }
 
                 fprintf(f,
-                        "ExecStartPost=" LIBEXECDIR "/systemd-makefs '%s' '/dev/mapper/%s'\n",
+                        "ExecStartPost=" SYSTEMD_MAKEFS_PATH " '%s' '/dev/mapper/%s'\n",
                         tmp_fstype_escaped ?: "ext4", name_escaped);
         }
 
         if (swap)
                 fprintf(f,
-                        "ExecStartPost=" LIBEXECDIR "/systemd-makefs swap '/dev/mapper/%s'\n",
+                        "ExecStartPost=" SYSTEMD_MAKEFS_PATH " swap '/dev/mapper/%s'\n",
                         name_escaped);
 
         r = fflush_and_check(f);

src/integritysetup/integritysetup-generator.c

@@ -104,8 +104,8 @@ static int create_disk(
                 "Type=oneshot\n"
                 "RemainAfterExit=yes\n"
                 "TimeoutSec=infinity\n"
-                "ExecStart=" LIBEXECDIR "/systemd-integritysetup attach '%s' '%s' '%s' '%s'\n"
-                "ExecStop=" LIBEXECDIR "/systemd-integritysetup detach '%s'\n",
+                "ExecStart=" SYSTEMD_INTEGRITYSETUP_PATH " attach '%s' '%s' '%s' '%s'\n"
+                "ExecStop=" SYSTEMD_INTEGRITYSETUP_PATH " detach '%s'\n",
                 name_escaped, device, empty_to_dash(key_file_escaped), empty_to_dash(options),
                 name_escaped);
 

src/network/bpf/sysctl-monitor/sysctl-monitor.bpf.c

@@ -2,6 +2,7 @@
 
 #include "vmlinux.h"
 
+#include <errno.h>
 #include <bpf/bpf_helpers.h>
 
 #include "sysctl-write-event.h"
@@ -104,7 +105,7 @@ int sysctl_monitor(struct bpf_sysctl *ctx) {
                 return 1;
 
         r = bpf_get_current_comm(we.comm, sizeof(we.comm));
-        if (r < 0) {
+        if (r < 0 && r != -EINVAL) { /* -EINVAL: the process is already vanished */
                 we.errorcode = r;
                 goto send_event;
         }

src/network/networkd-sysctl.c

@@ -76,13 +76,13 @@ static int sysctl_event_handler(void *ctx, void *data, size_t data_sz) {
                 log_struct(LOG_WARNING,
                            LOG_MESSAGE_ID(SD_MESSAGE_SYSCTL_CHANGED_STR),
                            LOG_ITEM("OBJECT_PID=" PID_FMT, we->pid),
-                           LOG_ITEM("OBJECT_COMM=%s", we->comm),
+                           LOG_ITEM("OBJECT_COMM=%s", empty_to_na(we->comm)),
                            LOG_ITEM("SYSCTL=%s", path),
                            LOG_ITEM("OLDVALUE=%s", we->current),
                            LOG_ITEM("NEWVALUE=%s", we->newvalue),
                            LOG_ITEM("OURVALUE=%s", value),
                            LOG_MESSAGE("Foreign process '%s[" PID_FMT "]' changed sysctl '%s' from '%s' to '%s', conflicting with our setting to '%s'.",
-                                       we->comm, we->pid, path, we->current, we->newvalue, value));
+                                       empty_to_na(we->comm), we->pid, path, we->current, we->newvalue, value));
 
         return 0;
 }

units/systemd-pcrproduct.service.in

@@ -14,6 +14,7 @@ DefaultDependencies=no
 Conflicts=shutdown.target
 After=tpm2.target
 Before=sysinit.target shutdown.target
+RequiresMountsFor=/var/lib/systemd/nvpcr
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki