sys-apps/systemd: move patches for 233 to a tarball

Package-Manager: Portage-2.3.19_p1, Repoman-2.3.6_p35

8 files changed, 2 insertions, 1179 deletions

diff --git a/sys-apps/systemd/Manifest b/sys-apps/systemd/Manifest
index ac065dd7613e..78aba9661e69 100644
--- a/sys-apps/systemd/Manifest
+++ b/sys-apps/systemd/Manifest
@@ -1,4 +1,5 @@
 DIST systemd-233-man.tar.gz 31386 BLAKE2B e4947e658db3efeec6b5a6adf340d2cc8e8aff2a14db4932720f90c3dc898b1e78595db983948373a2e28191fb3b0aad234f80feb91ee8ae4b607a44038a9cae SHA512 cc5215d3590ffc3c9203a64c14d6adeb0148c421c1396b8c1e43dcb58763b687ce99bdee327dd8a00abab7198171e73b22109a3f2032e4cec6adf2dcc85acf40
+DIST systemd-233-patches.tar.gz 12553 BLAKE2B 5d19f2dc82cc6cbd9b2e9393f932dfa3c88a981358b282fe56d43cd432d0ee0c0245e9c13d5460b94d83908b84a382dad3348b999f2356ab3ef2ae2c542a867d SHA512 3081f4cf64542ba64a28fe2eff11d8040af42255eb99b5210db9d583fc4b4360a4a4bb8769a1e43d38474d69ead681974cb98d4605968b38f98fd3d9b40bf211
 DIST systemd-233.tar.gz 4660737 BLAKE2B 38cdd74543447b3c02391b328428fed169fe2cf2df6e9341dcaf2f7d3d977612ec102301e144c1cada90d61e9e9bda3b2faaef708c8ff4bd0b52b143760a83b2 SHA512 5ad5329ea116d973cf67096f7e7ad28e9ea0905696e9451291f1d25e5064f4a9bfcfae87e912996c6a38397e9f4a148d4ccecfa9b70f7ecdf04deadb61784c8e
 DIST systemd-235.tar.gz 6586406 BLAKE2B f2e46a6c51fc9445800c4b7eee66f23ae83b42c2fedf2304acf612e6cb99122afe67f1b93cf72ed022b52384975afb92ab38cfb4efc6026384602c973d2eb98e SHA512 243f2eb5340fa37dd1286eaa63e83387bda9e03953af266cd6196a37535a13491482caf14c6ab10608bba4ed23b6c41923608e52017e0c26988ed72ddd2b9993
 DIST systemd-236.tar.gz 6759035 BLAKE2B 0fc26bd67fb6cc3b0565c763fc26e38186c4b05c3d38652b73a2189dfbfb46382dba239f7f6f889eec57ad1d8f69d4098745c8f4ca16a707aa23b7771f2328f3 SHA512 1a9672960e03e05c09e41fb8cfe9b0f25e867fd43f37f8371515ddddfdbd4270afd746a6da733f6d1d3b2cc43db1ecc7a9f2245f2dac2ec233db74e9e70e4f6d
diff --git a/sys-apps/systemd/files/233-0001-Avoid-strict-DM-interface-version-dependencies-5519.patch b/sys-apps/systemd/files/233-0001-Avoid-strict-DM-interface-version-dependencies-5519.patch
deleted file mode 100644
index be41fc4ec22c..000000000000
--- a/sys-apps/systemd/files/233-0001-Avoid-strict-DM-interface-version-dependencies-5519.patch
+++ /dev/null
@@ -1,456 +0,0 @@
-From dac3407f02116b94866224e0b5ecd46a5fa1c161 Mon Sep 17 00:00:00 2001
-From: Michael Biebl <mbiebl@gmail.com>
-Date: Thu, 2 Mar 2017 19:11:37 +0100
-Subject: [PATCH] Avoid strict DM interface version dependencies (#5519)
-
-Compiling against the dm-ioctl.h header as provided by the Linux kernel
-will embed the DM interface version number. Running an older kernel can
-result in an error like this on shutdown:
-
-Could not detach DM dm-11: ioctl mismatch, kernel(4.34.4), user(4.35.4)
-
-Work around this by shipping a local copy of dm-ioctl.h. We need at
-least the version from 3.13 for DM_DEFERRED_REMOVE [1], so bump the
-requirements in README accordingly.
-
-[1] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c140a246dc0bc085b98eddde978060fcec1080c
-
-Fixes: #5492
----
- Makefile.am                      |   1 +
- README                           |   2 +-
- src/core/umount.c                |   2 +-
- src/shared/dissect-image.c       |   2 +-
- src/shared/linux-3.13/dm-ioctl.h | 355 +++++++++++++++++++++++++++++++++++++++
- 5 files changed, 359 insertions(+), 3 deletions(-)
- create mode 100644 src/shared/linux-3.13/dm-ioctl.h
-
-diff --git a/Makefile.am b/Makefile.am
-index 2a5610740..65de9f16d 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1018,6 +1018,7 @@ libshared_la_SOURCES = \
- 	src/shared/gpt.h \
- 	src/shared/udev-util.h \
- 	src/shared/linux/auto_dev-ioctl.h \
-+	src/shared/linux-3.13/dm-ioctl.h \
- 	src/shared/initreq.h \
- 	src/shared/dns-domain.c \
- 	src/shared/dns-domain.h \
-diff --git a/README b/README
-index a4a649395..30b5f7187 100644
---- a/README
-+++ b/README
-@@ -35,7 +35,7 @@ LICENSE:
-         - except src/udev/* which is (currently still) GPLv2, GPLv2+
- 
- REQUIREMENTS:
--        Linux kernel >= 3.12
-+        Linux kernel >= 3.13
-         Linux kernel >= 4.2 for unified cgroup hierarchy support
- 
-         Kernel Config Options:
-diff --git a/src/core/umount.c b/src/core/umount.c
-index 2f4b12bdb..454383e7e 100644
---- a/src/core/umount.c
-+++ b/src/core/umount.c
-@@ -19,7 +19,6 @@
- 
- #include <errno.h>
- #include <fcntl.h>
--#include <linux/dm-ioctl.h>
- #include <linux/loop.h>
- #include <string.h>
- #include <sys/mount.h>
-@@ -31,6 +30,7 @@
- #include "escape.h"
- #include "fd-util.h"
- #include "fstab-util.h"
-+#include "linux-3.13/dm-ioctl.h"
- #include "list.h"
- #include "mount-setup.h"
- #include "path-util.h"
-diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
-index 39e724c51..1c9d21566 100644
---- a/src/shared/dissect-image.c
-+++ b/src/shared/dissect-image.c
-@@ -20,7 +20,6 @@
- #ifdef HAVE_LIBCRYPTSETUP
- #include <libcryptsetup.h>
- #endif
--#include <linux/dm-ioctl.h>
- #include <sys/mount.h>
- 
- #include "architecture.h"
-@@ -32,6 +31,7 @@
- #include "fs-util.h"
- #include "gpt.h"
- #include "hexdecoct.h"
-+#include "linux-3.13/dm-ioctl.h"
- #include "mount-util.h"
- #include "path-util.h"
- #include "stat-util.h"
-diff --git a/src/shared/linux-3.13/dm-ioctl.h b/src/shared/linux-3.13/dm-ioctl.h
-new file mode 100644
-index 000000000..c8a430209
---- /dev/null
-+++ b/src/shared/linux-3.13/dm-ioctl.h
-@@ -0,0 +1,355 @@
-+/*
-+ * Copyright (C) 2001 - 2003 Sistina Software (UK) Limited.
-+ * Copyright (C) 2004 - 2009 Red Hat, Inc. All rights reserved.
-+ *
-+ * This file is released under the LGPL.
-+ */
-+
-+#ifndef _LINUX_DM_IOCTL_V4_H
-+#define _LINUX_DM_IOCTL_V4_H
-+
-+#include <linux/types.h>
-+
-+#define DM_DIR "mapper"		/* Slashes not supported */
-+#define DM_CONTROL_NODE "control"
-+#define DM_MAX_TYPE_NAME 16
-+#define DM_NAME_LEN 128
-+#define DM_UUID_LEN 129
-+
-+/*
-+ * A traditional ioctl interface for the device mapper.
-+ *
-+ * Each device can have two tables associated with it, an
-+ * 'active' table which is the one currently used by io passing
-+ * through the device, and an 'inactive' one which is a table
-+ * that is being prepared as a replacement for the 'active' one.
-+ *
-+ * DM_VERSION:
-+ * Just get the version information for the ioctl interface.
-+ *
-+ * DM_REMOVE_ALL:
-+ * Remove all dm devices, destroy all tables.  Only really used
-+ * for debug.
-+ *
-+ * DM_LIST_DEVICES:
-+ * Get a list of all the dm device names.
-+ *
-+ * DM_DEV_CREATE:
-+ * Create a new device, neither the 'active' or 'inactive' table
-+ * slots will be filled.  The device will be in suspended state
-+ * after creation, however any io to the device will get errored
-+ * since it will be out-of-bounds.
-+ *
-+ * DM_DEV_REMOVE:
-+ * Remove a device, destroy any tables.
-+ *
-+ * DM_DEV_RENAME:
-+ * Rename a device or set its uuid if none was previously supplied.
-+ *
-+ * DM_SUSPEND:
-+ * This performs both suspend and resume, depending which flag is
-+ * passed in.
-+ * Suspend: This command will not return until all pending io to
-+ * the device has completed.  Further io will be deferred until
-+ * the device is resumed.
-+ * Resume: It is no longer an error to issue this command on an
-+ * unsuspended device.  If a table is present in the 'inactive'
-+ * slot, it will be moved to the active slot, then the old table
-+ * from the active slot will be _destroyed_.  Finally the device
-+ * is resumed.
-+ *
-+ * DM_DEV_STATUS:
-+ * Retrieves the status for the table in the 'active' slot.
-+ *
-+ * DM_DEV_WAIT:
-+ * Wait for a significant event to occur to the device.  This
-+ * could either be caused by an event triggered by one of the
-+ * targets of the table in the 'active' slot, or a table change.
-+ *
-+ * DM_TABLE_LOAD:
-+ * Load a table into the 'inactive' slot for the device.  The
-+ * device does _not_ need to be suspended prior to this command.
-+ *
-+ * DM_TABLE_CLEAR:
-+ * Destroy any table in the 'inactive' slot (ie. abort).
-+ *
-+ * DM_TABLE_DEPS:
-+ * Return a set of device dependencies for the 'active' table.
-+ *
-+ * DM_TABLE_STATUS:
-+ * Return the targets status for the 'active' table.
-+ *
-+ * DM_TARGET_MSG:
-+ * Pass a message string to the target at a specific offset of a device.
-+ *
-+ * DM_DEV_SET_GEOMETRY:
-+ * Set the geometry of a device by passing in a string in this format:
-+ *
-+ * "cylinders heads sectors_per_track start_sector"
-+ *
-+ * Beware that CHS geometry is nearly obsolete and only provided
-+ * for compatibility with dm devices that can be booted by a PC
-+ * BIOS.  See struct hd_geometry for range limits.  Also note that
-+ * the geometry is erased if the device size changes.
-+ */
-+
-+/*
-+ * All ioctl arguments consist of a single chunk of memory, with
-+ * this structure at the start.  If a uuid is specified any
-+ * lookup (eg. for a DM_INFO) will be done on that, *not* the
-+ * name.
-+ */
-+struct dm_ioctl {
-+	/*
-+	 * The version number is made up of three parts:
-+	 * major - no backward or forward compatibility,
-+	 * minor - only backwards compatible,
-+	 * patch - both backwards and forwards compatible.
-+	 *
-+	 * All clients of the ioctl interface should fill in the
-+	 * version number of the interface that they were
-+	 * compiled with.
-+	 *
-+	 * All recognised ioctl commands (ie. those that don't
-+	 * return -ENOTTY) fill out this field, even if the
-+	 * command failed.
-+	 */
-+	__u32 version[3];	/* in/out */
-+	__u32 data_size;	/* total size of data passed in
-+				 * including this struct */
-+
-+	__u32 data_start;	/* offset to start of data
-+				 * relative to start of this struct */
-+
-+	__u32 target_count;	/* in/out */
-+	__s32 open_count;	/* out */
-+	__u32 flags;		/* in/out */
-+
-+	/*
-+	 * event_nr holds either the event number (input and output) or the
-+	 * udev cookie value (input only).
-+	 * The DM_DEV_WAIT ioctl takes an event number as input.
-+	 * The DM_SUSPEND, DM_DEV_REMOVE and DM_DEV_RENAME ioctls
-+	 * use the field as a cookie to return in the DM_COOKIE
-+	 * variable with the uevents they issue.
-+	 * For output, the ioctls return the event number, not the cookie.
-+	 */
-+	__u32 event_nr;      	/* in/out */
-+	__u32 padding;
-+
-+	__u64 dev;		/* in/out */
-+
-+	char name[DM_NAME_LEN];	/* device name */
-+	char uuid[DM_UUID_LEN];	/* unique identifier for
-+				 * the block device */
-+	char data[7];		/* padding or data */
-+};
-+
-+/*
-+ * Used to specify tables.  These structures appear after the
-+ * dm_ioctl.
-+ */
-+struct dm_target_spec {
-+	__u64 sector_start;
-+	__u64 length;
-+	__s32 status;		/* used when reading from kernel only */
-+
-+	/*
-+	 * Location of the next dm_target_spec.
-+	 * - When specifying targets on a DM_TABLE_LOAD command, this value is
-+	 *   the number of bytes from the start of the "current" dm_target_spec
-+	 *   to the start of the "next" dm_target_spec.
-+	 * - When retrieving targets on a DM_TABLE_STATUS command, this value
-+	 *   is the number of bytes from the start of the first dm_target_spec
-+	 *   (that follows the dm_ioctl struct) to the start of the "next"
-+	 *   dm_target_spec.
-+	 */
-+	__u32 next;
-+
-+	char target_type[DM_MAX_TYPE_NAME];
-+
-+	/*
-+	 * Parameter string starts immediately after this object.
-+	 * Be careful to add padding after string to ensure correct
-+	 * alignment of subsequent dm_target_spec.
-+	 */
-+};
-+
-+/*
-+ * Used to retrieve the target dependencies.
-+ */
-+struct dm_target_deps {
-+	__u32 count;	/* Array size */
-+	__u32 padding;	/* unused */
-+	__u64 dev[0];	/* out */
-+};
-+
-+/*
-+ * Used to get a list of all dm devices.
-+ */
-+struct dm_name_list {
-+	__u64 dev;
-+	__u32 next;		/* offset to the next record from
-+				   the _start_ of this */
-+	char name[0];
-+};
-+
-+/*
-+ * Used to retrieve the target versions
-+ */
-+struct dm_target_versions {
-+        __u32 next;
-+        __u32 version[3];
-+
-+        char name[0];
-+};
-+
-+/*
-+ * Used to pass message to a target
-+ */
-+struct dm_target_msg {
-+	__u64 sector;	/* Device sector */
-+
-+	char message[0];
-+};
-+
-+/*
-+ * If you change this make sure you make the corresponding change
-+ * to dm-ioctl.c:lookup_ioctl()
-+ */
-+enum {
-+	/* Top level cmds */
-+	DM_VERSION_CMD = 0,
-+	DM_REMOVE_ALL_CMD,
-+	DM_LIST_DEVICES_CMD,
-+
-+	/* device level cmds */
-+	DM_DEV_CREATE_CMD,
-+	DM_DEV_REMOVE_CMD,
-+	DM_DEV_RENAME_CMD,
-+	DM_DEV_SUSPEND_CMD,
-+	DM_DEV_STATUS_CMD,
-+	DM_DEV_WAIT_CMD,
-+
-+	/* Table level cmds */
-+	DM_TABLE_LOAD_CMD,
-+	DM_TABLE_CLEAR_CMD,
-+	DM_TABLE_DEPS_CMD,
-+	DM_TABLE_STATUS_CMD,
-+
-+	/* Added later */
-+	DM_LIST_VERSIONS_CMD,
-+	DM_TARGET_MSG_CMD,
-+	DM_DEV_SET_GEOMETRY_CMD
-+};
-+
-+#define DM_IOCTL 0xfd
-+
-+#define DM_VERSION       _IOWR(DM_IOCTL, DM_VERSION_CMD, struct dm_ioctl)
-+#define DM_REMOVE_ALL    _IOWR(DM_IOCTL, DM_REMOVE_ALL_CMD, struct dm_ioctl)
-+#define DM_LIST_DEVICES  _IOWR(DM_IOCTL, DM_LIST_DEVICES_CMD, struct dm_ioctl)
-+
-+#define DM_DEV_CREATE    _IOWR(DM_IOCTL, DM_DEV_CREATE_CMD, struct dm_ioctl)
-+#define DM_DEV_REMOVE    _IOWR(DM_IOCTL, DM_DEV_REMOVE_CMD, struct dm_ioctl)
-+#define DM_DEV_RENAME    _IOWR(DM_IOCTL, DM_DEV_RENAME_CMD, struct dm_ioctl)
-+#define DM_DEV_SUSPEND   _IOWR(DM_IOCTL, DM_DEV_SUSPEND_CMD, struct dm_ioctl)
-+#define DM_DEV_STATUS    _IOWR(DM_IOCTL, DM_DEV_STATUS_CMD, struct dm_ioctl)
-+#define DM_DEV_WAIT      _IOWR(DM_IOCTL, DM_DEV_WAIT_CMD, struct dm_ioctl)
-+
-+#define DM_TABLE_LOAD    _IOWR(DM_IOCTL, DM_TABLE_LOAD_CMD, struct dm_ioctl)
-+#define DM_TABLE_CLEAR   _IOWR(DM_IOCTL, DM_TABLE_CLEAR_CMD, struct dm_ioctl)
-+#define DM_TABLE_DEPS    _IOWR(DM_IOCTL, DM_TABLE_DEPS_CMD, struct dm_ioctl)
-+#define DM_TABLE_STATUS  _IOWR(DM_IOCTL, DM_TABLE_STATUS_CMD, struct dm_ioctl)
-+
-+#define DM_LIST_VERSIONS _IOWR(DM_IOCTL, DM_LIST_VERSIONS_CMD, struct dm_ioctl)
-+
-+#define DM_TARGET_MSG	 _IOWR(DM_IOCTL, DM_TARGET_MSG_CMD, struct dm_ioctl)
-+#define DM_DEV_SET_GEOMETRY	_IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
-+
-+#define DM_VERSION_MAJOR	4
-+#define DM_VERSION_MINOR	27
-+#define DM_VERSION_PATCHLEVEL	0
-+#define DM_VERSION_EXTRA	"-ioctl (2013-10-30)"
-+
-+/* Status bits */
-+#define DM_READONLY_FLAG	(1 << 0) /* In/Out */
-+#define DM_SUSPEND_FLAG		(1 << 1) /* In/Out */
-+#define DM_PERSISTENT_DEV_FLAG	(1 << 3) /* In */
-+
-+/*
-+ * Flag passed into ioctl STATUS command to get table information
-+ * rather than current status.
-+ */
-+#define DM_STATUS_TABLE_FLAG	(1 << 4) /* In */
-+
-+/*
-+ * Flags that indicate whether a table is present in either of
-+ * the two table slots that a device has.
-+ */
-+#define DM_ACTIVE_PRESENT_FLAG   (1 << 5) /* Out */
-+#define DM_INACTIVE_PRESENT_FLAG (1 << 6) /* Out */
-+
-+/*
-+ * Indicates that the buffer passed in wasn't big enough for the
-+ * results.
-+ */
-+#define DM_BUFFER_FULL_FLAG	(1 << 8) /* Out */
-+
-+/*
-+ * This flag is now ignored.
-+ */
-+#define DM_SKIP_BDGET_FLAG	(1 << 9) /* In */
-+
-+/*
-+ * Set this to avoid attempting to freeze any filesystem when suspending.
-+ */
-+#define DM_SKIP_LOCKFS_FLAG	(1 << 10) /* In */
-+
-+/*
-+ * Set this to suspend without flushing queued ios.
-+ * Also disables flushing uncommitted changes in the thin target before
-+ * generating statistics for DM_TABLE_STATUS and DM_DEV_WAIT.
-+ */
-+#define DM_NOFLUSH_FLAG		(1 << 11) /* In */
-+
-+/*
-+ * If set, any table information returned will relate to the inactive
-+ * table instead of the live one.  Always check DM_INACTIVE_PRESENT_FLAG
-+ * is set before using the data returned.
-+ */
-+#define DM_QUERY_INACTIVE_TABLE_FLAG	(1 << 12) /* In */
-+
-+/*
-+ * If set, a uevent was generated for which the caller may need to wait.
-+ */
-+#define DM_UEVENT_GENERATED_FLAG	(1 << 13) /* Out */
-+
-+/*
-+ * If set, rename changes the uuid not the name.  Only permitted
-+ * if no uuid was previously supplied: an existing uuid cannot be changed.
-+ */
-+#define DM_UUID_FLAG			(1 << 14) /* In */
-+
-+/*
-+ * If set, all buffers are wiped after use. Use when sending
-+ * or requesting sensitive data such as an encryption key.
-+ */
-+#define DM_SECURE_DATA_FLAG		(1 << 15) /* In */
-+
-+/*
-+ * If set, a message generated output data.
-+ */
-+#define DM_DATA_OUT_FLAG		(1 << 16) /* Out */
-+
-+/*
-+ * If set with DM_DEV_REMOVE or DM_REMOVE_ALL this indicates that if
-+ * the device cannot be removed immediately because it is still in use
-+ * it should instead be scheduled for removal when it gets closed.
-+ *
-+ * On return from DM_DEV_REMOVE, DM_DEV_STATUS or other ioctls, this
-+ * flag indicates that the device is scheduled to be removed when it
-+ * gets closed.
-+ */
-+#define DM_DEFERRED_REMOVE		(1 << 17) /* In/Out */
-+
-+#endif				/* _LINUX_DM_IOCTL_H */
--- 
-2.12.0
-
diff --git a/sys-apps/systemd/files/233-0002-core-load-fragment-refuse-units-with-errors-in-RootD.patch b/sys-apps/systemd/files/233-0002-core-load-fragment-refuse-units-with-errors-in-RootD.patch
deleted file mode 100644
index fe30ef9ff617..000000000000
--- a/sys-apps/systemd/files/233-0002-core-load-fragment-refuse-units-with-errors-in-RootD.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 433e7893c6c0f6cbc98d8911fc5149ee9beedb79 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Thu, 6 Jul 2017 13:54:42 -0400
-Subject: [PATCH 2/3] core/load-fragment: refuse units with errors in
- RootDirectory/RootImage/DynamicUser
-
-Behaviour of the service is completely different with the option off, so the
-service would probably mess up state on disk and do unexpected things.
----
- src/core/load-fragment-gperf.gperf.m4 |  6 +++---
- src/core/load-fragment.c              |  7 +++++--
- src/shared/conf-parser.c              | 16 +++++++++++-----
- 3 files changed, 19 insertions(+), 10 deletions(-)
-
-diff --git a/src/core/load-fragment-gperf.gperf.m4 b/src/core/load-fragment-gperf.gperf.m4
-index cb9e6fea2..d0868bf40 100644
---- a/src/core/load-fragment-gperf.gperf.m4
-+++ b/src/core/load-fragment-gperf.gperf.m4
-@@ -18,8 +18,8 @@ struct ConfigPerfItem;
- m4_dnl Define the context options only once
- m4_define(`EXEC_CONTEXT_CONFIG_ITEMS',
- `$1.WorkingDirectory,            config_parse_working_directory,     0,                             offsetof($1, exec_context)
--$1.RootDirectory,                config_parse_unit_path_printf,      0,                             offsetof($1, exec_context.root_directory)
--$1.RootImage,                    config_parse_unit_path_printf,      0,                             offsetof($1, exec_context.root_image)
-+$1.RootDirectory,                config_parse_unit_path_printf,      true,                          offsetof($1, exec_context.root_directory)
-+$1.RootImage,                    config_parse_unit_path_printf,      true,                          offsetof($1, exec_context.root_image)
- $1.User,                         config_parse_user_group,            0,                             offsetof($1, exec_context.user)
- $1.Group,                        config_parse_user_group,            0,                             offsetof($1, exec_context.group)
- $1.SupplementaryGroups,          config_parse_user_group_strv,       0,                             offsetof($1, exec_context.supplementary_groups)
-@@ -35,7 +35,7 @@ $1.UMask,                        config_parse_mode,                  0,
- $1.Environment,                  config_parse_environ,               0,                             offsetof($1, exec_context.environment)
- $1.EnvironmentFile,              config_parse_unit_env_file,         0,                             offsetof($1, exec_context.environment_files)
- $1.PassEnvironment,              config_parse_pass_environ,          0,                             offsetof($1, exec_context.pass_environment)
--$1.DynamicUser,                  config_parse_bool,                  0,                             offsetof($1, exec_context.dynamic_user)
-+$1.DynamicUser,                  config_parse_bool,                  true,                          offsetof($1, exec_context.dynamic_user)
- $1.StandardInput,                config_parse_exec_input,            0,                             offsetof($1, exec_context)
- $1.StandardOutput,               config_parse_exec_output,           0,                             offsetof($1, exec_context)
- $1.StandardError,                config_parse_exec_output,           0,                             offsetof($1, exec_context)
-diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
-index 5b7471c0d..ae4ec5cf0 100644
---- a/src/core/load-fragment.c
-+++ b/src/core/load-fragment.c
-@@ -242,6 +242,7 @@ int config_parse_unit_path_printf(
-         _cleanup_free_ char *k = NULL;
-         Unit *u = userdata;
-         int r;
-+        bool fatal = ltype;
- 
-         assert(filename);
-         assert(lvalue);
-@@ -250,8 +251,10 @@ int config_parse_unit_path_printf(
- 
-         r = unit_full_printf(u, rvalue, &k);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers on %s, ignoring: %m", rvalue);
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r,
-+                           "Failed to resolve unit specifiers on %s%s: %m",
-+                           fatal ? "" : ", ignoring", rvalue);
-+                return fatal ? -ENOEXEC : 0;
-         }
- 
-         return config_parse_path(unit, filename, line, section, section_line, lvalue, ltype, k, data, userdata);
-diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
-index 265ac83dc..ffb905fb6 100644
---- a/src/shared/conf-parser.c
-+++ b/src/shared/conf-parser.c
-@@ -614,6 +614,7 @@ int config_parse_bool(const char* unit,
- 
-         int k;
-         bool *b = data;
-+        bool fatal = ltype;
- 
-         assert(filename);
-         assert(lvalue);
-@@ -622,8 +623,10 @@ int config_parse_bool(const char* unit,
- 
-         k = parse_boolean(rvalue);
-         if (k < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, k, "Failed to parse boolean value, ignoring: %s", rvalue);
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, k,
-+                           "Failed to parse boolean value%s: %s",
-+                           fatal ? "" : ", ignoring", rvalue);
-+                return fatal ? -ENOEXEC : 0;
-         }
- 
-         *b = !!k;
-@@ -714,6 +717,7 @@ int config_parse_path(
-                 void *userdata) {
- 
-         char **s = data, *n;
-+        bool fatal = ltype;
- 
-         assert(filename);
-         assert(lvalue);
-@@ -722,12 +726,14 @@ int config_parse_path(
- 
-         if (!utf8_is_valid(rvalue)) {
-                 log_syntax_invalid_utf8(unit, LOG_ERR, filename, line, rvalue);
--                return 0;
-+                return fatal ? -ENOEXEC : 0;
-         }
- 
-         if (!path_is_absolute(rvalue)) {
--                log_syntax(unit, LOG_ERR, filename, line, 0, "Not an absolute path, ignoring: %s", rvalue);
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, 0,
-+                           "Not an absolute path%s: %s",
-+                           fatal ? "" : ", ignoring", rvalue);
-+                return fatal ? -ENOEXEC : 0;
-         }
- 
-         n = strdup(rvalue);
--- 
-2.13.2
-
diff --git a/sys-apps/systemd/files/233-0003-core-load-fragment-refuse-units-with-errors-in-certa.patch b/sys-apps/systemd/files/233-0003-core-load-fragment-refuse-units-with-errors-in-certa.patch
deleted file mode 100644
index 28961b4b1e36..000000000000
--- a/sys-apps/systemd/files/233-0003-core-load-fragment-refuse-units-with-errors-in-certa.patch
+++ /dev/null
@@ -1,339 +0,0 @@
-From f135524cd4cd6b71e7f6073b02389da30c6e94d9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Thu, 6 Jul 2017 13:28:19 -0400
-Subject: [PATCH 3/3] core/load-fragment: refuse units with errors in certain
- directives
-
-If an error is encountered in any of the Exec* lines, WorkingDirectory,
-SELinuxContext, ApparmorProfile, SmackProcessLabel, Service (in .socket
-units), User, or Group, refuse to load the unit. If the config stanza
-has support, ignore the failure if '-' is present.
-
-For those configuration directives, even if we started the unit, it's
-pretty likely that it'll do something unexpected (like write files
-in a wrong place, or with a wrong context, or run with wrong permissions,
-etc). It seems better to refuse to start the unit and have the admin
-clean up the configuration without giving the service a chance to mess
-up stuff.
-
-Note that all "security" options that restrict what the unit can do
-(Capabilities, AmbientCapabilities, Restrict*, SystemCallFilter, Limit*,
-PrivateDevices, Protect*, etc) are _not_ treated like this. Such options are
-only supplementary, and are not always available depending on the architecture
-and compilation options, so unit authors have to make sure that the service
-runs correctly without them anyway.
-
-Fixes #6237, #6277.
----
- src/core/load-fragment.c  | 116 ++++++++++++++++++++++++++++------------------
- src/test/test-unit-file.c |  14 +++---
- 2 files changed, 78 insertions(+), 52 deletions(-)
-
-diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
-index ae4ec5cf0..f38240af3 100644
---- a/src/core/load-fragment.c
-+++ b/src/core/load-fragment.c
-@@ -637,26 +637,36 @@ int config_parse_exec(
- 
-                 r = unit_full_printf(u, f, &path);
-                 if (r < 0) {
--                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers on %s, ignoring: %m", f);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, r,
-+                                   "Failed to resolve unit specifiers on %s%s: %m",
-+                                   f, ignore ? ", ignoring" : "");
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
- 
-                 if (isempty(path)) {
-                         /* First word is either "-" or "@" with no command. */
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Empty path in command line, ignoring: \"%s\"", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Empty path in command line%s: \"%s\"",
-+                                   ignore ? ", ignoring" : "", rvalue);
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
-                 if (!string_is_safe(path)) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Executable path contains special characters, ignoring: %s", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Executable path contains special characters%s: %s",
-+                                   ignore ? ", ignoring" : "", rvalue);
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
-                 if (!path_is_absolute(path)) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Executable path is not absolute, ignoring: %s", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Executable path is not absolute%s: %s",
-+                                   ignore ? ", ignoring" : "", rvalue);
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
-                 if (endswith(path, "/")) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Executable path specifies a directory, ignoring: %s", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Executable path specifies a directory%s: %s",
-+                                   ignore ? ", ignoring" : "", rvalue);
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
- 
-                 if (!separate_argv0) {
-@@ -709,12 +719,14 @@ int config_parse_exec(
-                         if (r == 0)
-                                 break;
-                         if (r < 0)
--                                return 0;
-+                                return ignore ? 0 : -ENOEXEC;
- 
-                         r = unit_full_printf(u, word, &resolved);
-                         if (r < 0) {
--                                log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to resolve unit specifiers on %s, ignoring: %m", word);
--                                return 0;
-+                                log_syntax(unit, LOG_ERR, filename, line, r,
-+                                           "Failed to resolve unit specifiers on %s%s: %m",
-+                                           word, ignore ? ", ignoring" : "");
-+                                return ignore ? 0 : -ENOEXEC;
-                         }
- 
-                         if (!GREEDY_REALLOC(n, nbufsize, nlen + 2))
-@@ -725,8 +737,10 @@ int config_parse_exec(
-                 }
- 
-                 if (!n || !n[0]) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Empty executable name or zeroeth argument, ignoring: %s", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Empty executable name or zeroeth argument%s: %s",
-+                                   ignore ? ", ignoring" : "", rvalue);
-+                        return ignore ? 0 : -ENOEXEC;
-                 }
- 
-                 nce = new0(ExecCommand, 1);
-@@ -1333,8 +1347,10 @@ int config_parse_exec_selinux_context(
- 
-         r = unit_full_printf(u, rvalue, &k);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve specifiers, ignoring: %m");
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r,
-+                           "Failed to resolve specifiers%s: %m",
-+                           ignore ? ", ignoring" : "");
-+                return ignore ? 0 : -ENOEXEC;
-         }
- 
-         free(c->selinux_context);
-@@ -1381,8 +1397,10 @@ int config_parse_exec_apparmor_profile(
- 
-         r = unit_full_printf(u, rvalue, &k);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve specifiers, ignoring: %m");
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r,
-+                           "Failed to resolve specifiers%s: %m",
-+                           ignore ? ", ignoring" : "");
-+                return ignore ? 0 : -ENOEXEC;
-         }
- 
-         free(c->apparmor_profile);
-@@ -1429,8 +1447,10 @@ int config_parse_exec_smack_process_label(
- 
-         r = unit_full_printf(u, rvalue, &k);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve specifiers, ignoring: %m");
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r,
-+                           "Failed to resolve specifiers%s: %m",
-+                           ignore ? ", ignoring" : "");
-+                return ignore ? 0 : -ENOEXEC;
-         }
- 
-         free(c->smack_process_label);
-@@ -1648,19 +1668,19 @@ int config_parse_socket_service(
- 
-         r = unit_name_printf(UNIT(s), rvalue, &p);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve specifiers, ignoring: %s", rvalue);
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve specifiers: %s", rvalue);
-+                return -ENOEXEC;
-         }
- 
-         if (!endswith(p, ".service")) {
--                log_syntax(unit, LOG_ERR, filename, line, 0, "Unit must be of type service, ignoring: %s", rvalue);
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, 0, "Unit must be of type service: %s", rvalue);
-+                return -ENOEXEC;
-         }
- 
-         r = manager_load_unit(UNIT(s)->manager, p, NULL, &error, &x);
-         if (r < 0) {
--                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to load unit %s, ignoring: %s", rvalue, bus_error_message(&error, r));
--                return 0;
-+                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to load unit %s: %s", rvalue, bus_error_message(&error, r));
-+                return -ENOEXEC;
-         }
- 
-         unit_ref_set(&s->service, x);
-@@ -1911,13 +1931,13 @@ int config_parse_user_group(
- 
-                 r = unit_full_printf(u, rvalue, &k);
-                 if (r < 0) {
--                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers in %s, ignoring: %m", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers in %s: %m", rvalue);
-+                        return -ENOEXEC;
-                 }
- 
-                 if (!valid_user_group_name_or_id(k)) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid user/group name or numeric ID, ignoring: %s", k);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid user/group name or numeric ID: %s", k);
-+                        return -ENOEXEC;
-                 }
- 
-                 n = k;
-@@ -1975,19 +1995,19 @@ int config_parse_user_group_strv(
-                 if (r == -ENOMEM)
-                         return log_oom();
-                 if (r < 0) {
--                        log_syntax(unit, LOG_ERR, filename, line, r, "Invalid syntax, ignoring: %s", rvalue);
--                        break;
-+                        log_syntax(unit, LOG_ERR, filename, line, r, "Invalid syntax: %s", rvalue);
-+                        return -ENOEXEC;
-                 }
- 
-                 r = unit_full_printf(u, word, &k);
-                 if (r < 0) {
--                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers in %s, ignoring: %m", word);
--                        continue;
-+                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers in %s: %m", word);
-+                        return -ENOEXEC;
-                 }
- 
-                 if (!valid_user_group_name_or_id(k)) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid user/group name or numeric ID, ignoring: %s", k);
--                        continue;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid user/group name or numeric ID: %s", k);
-+                        return -ENOEXEC;
-                 }
- 
-                 r = strv_push(users, k);
-@@ -2146,25 +2166,28 @@ int config_parse_working_directory(
- 
-                 r = unit_full_printf(u, rvalue, &k);
-                 if (r < 0) {
--                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to resolve unit specifiers in working directory path '%s', ignoring: %m", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, r,
-+                                   "Failed to resolve unit specifiers in working directory path '%s'%s: %m",
-+                                   rvalue, missing_ok ? ", ignoring" : "");
-+                        return missing_ok ? 0 : -ENOEXEC;
-                 }
- 
-                 path_kill_slashes(k);
- 
-                 if (!utf8_is_valid(k)) {
-                         log_syntax_invalid_utf8(unit, LOG_ERR, filename, line, rvalue);
--                        return 0;
-+                        return missing_ok ? 0 : -ENOEXEC;
-                 }
- 
-                 if (!path_is_absolute(k)) {
--                        log_syntax(unit, LOG_ERR, filename, line, 0, "Working directory path '%s' is not absolute, ignoring.", rvalue);
--                        return 0;
-+                        log_syntax(unit, LOG_ERR, filename, line, 0,
-+                                   "Working directory path '%s' is not absolute%s.",
-+                                   rvalue, missing_ok ? ", ignoring" : "");
-+                        return missing_ok ? 0 : -ENOEXEC;
-                 }
- 
--                free_and_replace(c->working_directory, k);
--
-                 c->working_directory_home = false;
-+                free_and_replace(c->working_directory, k);
-         }
- 
-         c->working_directory_missing_ok = missing_ok;
-@@ -4444,8 +4467,11 @@ int unit_load_fragment(Unit *u) {
-                         return r;
- 
-                 r = load_from_path(u, k);
--                if (r < 0)
-+                if (r < 0) {
-+                        if (r == -ENOEXEC)
-+                                log_unit_notice(u, "Unit configuration has fatal error, unit will not be started.");
-                         return r;
-+                }
- 
-                 if (u->load_state == UNIT_STUB) {
-                         SET_FOREACH(t, u->names, i) {
-diff --git a/src/test/test-unit-file.c b/src/test/test-unit-file.c
-index 12f48bf43..fd797b587 100644
---- a/src/test/test-unit-file.c
-+++ b/src/test/test-unit-file.c
-@@ -146,7 +146,7 @@ static void test_config_parse_exec(void) {
-         r = config_parse_exec(NULL, "fake", 4, "section", 1,
-                               "LValue", 0, "/RValue/ argv0 r1",
-                               &c, u);
--        assert_se(r == 0);
-+        assert_se(r == -ENOEXEC);
-         assert_se(c1->command_next == NULL);
- 
-         log_info("/* honour_argv0 */");
-@@ -161,7 +161,7 @@ static void test_config_parse_exec(void) {
-         r = config_parse_exec(NULL, "fake", 3, "section", 1,
-                               "LValue", 0, "@/RValue",
-                               &c, u);
--        assert_se(r == 0);
-+        assert_se(r == -ENOEXEC);
-         assert_se(c1->command_next == NULL);
- 
-         log_info("/* no command, whitespace only, reset */");
-@@ -220,7 +220,7 @@ static void test_config_parse_exec(void) {
-                               "-@/RValue argv0 r1 ; ; "
-                               "/goo/goo boo",
-                               &c, u);
--        assert_se(r >= 0);
-+        assert_se(r == -ENOEXEC);
-         c1 = c1->command_next;
-         check_execcommand(c1, "/RValue", "argv0", "r1", NULL, true);
- 
-@@ -374,7 +374,7 @@ static void test_config_parse_exec(void) {
-                 r = config_parse_exec(NULL, "fake", 4, "section", 1,
-                                       "LValue", 0, path,
-                                       &c, u);
--                assert_se(r == 0);
-+                assert_se(r == -ENOEXEC);
-                 assert_se(c1->command_next == NULL);
-         }
- 
-@@ -401,21 +401,21 @@ static void test_config_parse_exec(void) {
-         r = config_parse_exec(NULL, "fake", 4, "section", 1,
-                               "LValue", 0, "/path\\",
-                               &c, u);
--        assert_se(r == 0);
-+        assert_se(r == -ENOEXEC);
-         assert_se(c1->command_next == NULL);
- 
-         log_info("/* missing ending ' */");
-         r = config_parse_exec(NULL, "fake", 4, "section", 1,
-                               "LValue", 0, "/path 'foo",
-                               &c, u);
--        assert_se(r == 0);
-+        assert_se(r == -ENOEXEC);
-         assert_se(c1->command_next == NULL);
- 
-         log_info("/* missing ending ' with trailing backslash */");
-         r = config_parse_exec(NULL, "fake", 4, "section", 1,
-                               "LValue", 0, "/path 'foo\\",
-                               &c, u);
--        assert_se(r == 0);
-+        assert_se(r == -ENOEXEC);
-         assert_se(c1->command_next == NULL);
- 
-         log_info("/* invalid space between modifiers */");
--- 
-2.13.2
-
diff --git a/sys-apps/systemd/files/233-CVE-2017-9445.patch b/sys-apps/systemd/files/233-CVE-2017-9445.patch
deleted file mode 100644
index 22a366ceba07..000000000000
--- a/sys-apps/systemd/files/233-CVE-2017-9445.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-From 29bb43cc46412366fc939c66331a916de07bfac4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Sun, 18 Jun 2017 16:07:57 -0400
-Subject: [PATCH 1/4] resolved: simplify alloc size calculation
-
-The allocation size was calculated in a complicated way, and for values
-close to the page size we would actually allocate less than requested.
-
-Reported by Chris Coulson <chris.coulson@canonical.com>.
-
-CVE-2017-9445
----
- src/resolve/resolved-dns-packet.c | 8 +-------
- src/resolve/resolved-dns-packet.h | 2 --
- 2 files changed, 1 insertion(+), 9 deletions(-)
-
-diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
-index 652970284..2034e3c8c 100644
---- a/src/resolve/resolved-dns-packet.c
-+++ b/src/resolve/resolved-dns-packet.c
-@@ -47,13 +47,7 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
- 
-         assert(ret);
- 
--        if (mtu <= UDP_PACKET_HEADER_SIZE)
--                a = DNS_PACKET_SIZE_START;
--        else
--                a = mtu - UDP_PACKET_HEADER_SIZE;
--
--        if (a < DNS_PACKET_HEADER_SIZE)
--                a = DNS_PACKET_HEADER_SIZE;
-+        a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
- 
-         /* round up to next page size */
-         a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
-diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
-index 2c92392e4..3abcaf8cf 100644
---- a/src/resolve/resolved-dns-packet.h
-+++ b/src/resolve/resolved-dns-packet.h
-@@ -66,8 +66,6 @@ struct DnsPacketHeader {
- /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */
- #define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096
- 
--#define DNS_PACKET_SIZE_START 512
--
- struct DnsPacket {
-         int n_ref;
-         DnsProtocol protocol;
--- 
-2.13.1
-
-
-From cd3d8a7ebc01cd6913eaa9a591f7d606038a7588 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Tue, 27 Jun 2017 14:20:00 -0400
-Subject: [PATCH 2/4] resolved: do not allocate packets with minimum size
-
-dns_packet_new() is sometimes called with mtu == 0, and in that case we should
-allocate more than the absolute minimum (which is the dns packet header size),
-otherwise we have to resize immediately again after appending the first data to
-the packet.
-
-This partially reverts the previous commit.
----
- src/resolve/resolved-dns-packet.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
-index 2034e3c8c..9d806ab33 100644
---- a/src/resolve/resolved-dns-packet.c
-+++ b/src/resolve/resolved-dns-packet.c
-@@ -28,6 +28,9 @@
- 
- #define EDNS0_OPT_DO (1<<15)
- 
-+#define DNS_PACKET_SIZE_START 512
-+assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE)
-+
- typedef struct DnsPacketRewinder {
-         DnsPacket *packet;
-         size_t saved_rindex;
-@@ -47,7 +50,14 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
- 
-         assert(ret);
- 
--        a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
-+        /* When dns_packet_new() is called with mtu == 0, allocate more than the
-+         * absolute minimum (which is the dns packet header size), to avoid
-+         * resizing immediately again after appending the first data to the packet.
-+         */
-+        if (mtu < UDP_PACKET_HEADER_SIZE)
-+                a = DNS_PACKET_SIZE_START;
-+        else
-+                a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
- 
-         /* round up to next page size */
-         a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
--- 
-2.13.1
-
-
-From a03fc1acd66d23e239f2545e9a6887c7d0aad7c5 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Tue, 27 Jun 2017 16:59:06 -0400
-Subject: [PATCH 3/4] resolved: define various packet sizes as unsigned
-
-This seems like the right thing to do, and apparently at least some compilers
-warn about signed/unsigned comparisons with DNS_PACKET_SIZE_MAX.
----
- src/resolve/resolved-dns-packet.c | 2 +-
- src/resolve/resolved-dns-packet.h | 6 +++---
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
-index 9d806ab33..e2285b440 100644
---- a/src/resolve/resolved-dns-packet.c
-+++ b/src/resolve/resolved-dns-packet.c
-@@ -28,7 +28,7 @@
- 
- #define EDNS0_OPT_DO (1<<15)
- 
--#define DNS_PACKET_SIZE_START 512
-+#define DNS_PACKET_SIZE_START 512u
- assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE)
- 
- typedef struct DnsPacketRewinder {
-diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
-index 3abcaf8cf..5dff272fd 100644
---- a/src/resolve/resolved-dns-packet.h
-+++ b/src/resolve/resolved-dns-packet.h
-@@ -58,13 +58,13 @@ struct DnsPacketHeader {
- /* The various DNS protocols deviate in how large a packet can grow,
-    but the TCP transport has a 16bit size field, hence that appears to
-    be the absolute maximum. */
--#define DNS_PACKET_SIZE_MAX 0xFFFF
-+#define DNS_PACKET_SIZE_MAX 0xFFFFu
- 
- /* RFC 1035 say 512 is the maximum, for classic unicast DNS */
--#define DNS_PACKET_UNICAST_SIZE_MAX 512
-+#define DNS_PACKET_UNICAST_SIZE_MAX 512u
- 
- /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */
--#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096
-+#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096u
- 
- struct DnsPacket {
-         int n_ref;
--- 
-2.13.1
diff --git a/sys-apps/systemd/files/233-format-warnings.patch b/sys-apps/systemd/files/233-format-warnings.patch
deleted file mode 100644
index 7bb08f0a3201..000000000000
--- a/sys-apps/systemd/files/233-format-warnings.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 3e7d14d78c4d15ec7789299216cbf5c58e61547b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Sat, 3 Jun 2017 05:41:17 -0400
-Subject: [PATCH] sd-bus: silence format warnings in kdbus code (#6072)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The code is mostly correct, but gcc is trying to outsmart us, and emits a
-warning for a "llu vs lu" mismatch, even though they are the same size (on alpha):
-
-src/libsystemd/sd-bus/bus-control.c: In function ‘kernel_get_list’:
-src/libsystemd/sd-bus/bus-control.c:267:42: error: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘__u64 {aka long unsigned int}’ [-Werror=format=]
-                         if (asprintf(&n, ":1.%llu", name->id) < 0) {
-                                          ^
-src/libsystemd/sd-bus/bus-control.c: In function ‘bus_get_name_creds_kdbus’:
-src/libsystemd/sd-bus/bus-control.c:714:47: error: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘__u64 {aka long unsigned int}’ [-Werror=format=]
-                 if (asprintf(&c->unique_name, ":1.%llu", conn_info->id) < 0) {
-                                               ^
-This is hard to work around properly, because kdbus.h uses __u64 which is
-defined-differently-despite-being-the-same-size then uint64_t. Thus the simple
-solution of using %PRIu64 fails on amd64:
-
-src/libsystemd/sd-bus/bus-control.c:714:47: error: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘__u64 {aka long long unsigned int}’ [-Werror=format=]
-                 if (asprintf(&c->unique_name, ":1.%"PRIu64, conn_info->id) < 0) {
-                                               ^~~~~~
-
-Let's just avoid the whole issue for now by silencing the warning.
-After the next release, we should just get rid of the kdbus code.
-
-Fixes #5561.
----
- src/libsystemd/sd-bus/bus-control.c | 6 ++++++
- src/libsystemd/sd-bus/bus-kernel.c  | 2 ++
- 2 files changed, 8 insertions(+)
-
-diff --git a/src/libsystemd/sd-bus/bus-control.c b/src/libsystemd/sd-bus/bus-control.c
-index 9e58ffbd8..303ae0f23 100644
---- a/src/libsystemd/sd-bus/bus-control.c
-+++ b/src/libsystemd/sd-bus/bus-control.c
-@@ -264,10 +264,13 @@ static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
-                 if ((flags & KDBUS_LIST_UNIQUE) && name->id != previous_id && !(name->flags & KDBUS_HELLO_ACTIVATOR)) {
-                         char *n;
- 
-+#pragma GCC diagnostic push
-+#pragma GCC diagnostic ignored "-Wformat"
-                         if (asprintf(&n, ":1.%llu", name->id) < 0) {
-                                 r = -ENOMEM;
-                                 goto fail;
-                         }
-+#pragma GCC diagnostic pop
- 
-                         r = strv_consume(x, n);
-                         if (r < 0)
-@@ -711,10 +714,13 @@ int bus_get_name_creds_kdbus(
-         }
- 
-         if (mask & SD_BUS_CREDS_UNIQUE_NAME) {
-+#pragma GCC diagnostic push
-+#pragma GCC diagnostic ignored "-Wformat"
-                 if (asprintf(&c->unique_name, ":1.%llu", conn_info->id) < 0) {
-                         r = -ENOMEM;
-                         goto fail;
-                 }
-+#pragma GCC diagnostic pop
- 
-                 c->mask |= SD_BUS_CREDS_UNIQUE_NAME;
-         }
-diff --git a/src/libsystemd/sd-bus/bus-kernel.c b/src/libsystemd/sd-bus/bus-kernel.c
-index c82caeb3f..ca6aee7c0 100644
---- a/src/libsystemd/sd-bus/bus-kernel.c
-+++ b/src/libsystemd/sd-bus/bus-kernel.c
-@@ -51,6 +51,8 @@
- #include "user-util.h"
- #include "util.h"
- 
-+#pragma GCC diagnostic ignored "-Wformat"
-+
- #define UNIQUE_NAME_MAX (3+DECIMAL_STR_MAX(uint64_t))
- 
- int bus_kernel_parse_unique_name(const char *s, uint64_t *id) {
--- 
-2.13.2
-
diff --git a/sys-apps/systemd/files/CVE-2017-9217.patch b/sys-apps/systemd/files/CVE-2017-9217.patch
deleted file mode 100644
index 68d0f36d4913..000000000000
--- a/sys-apps/systemd/files/CVE-2017-9217.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From a924f43f30f9c4acaf70618dd2a055f8b0f166be Mon Sep 17 00:00:00 2001
-From: Evgeny Vereshchagin <evvers@ya.ru>
-Date: Wed, 24 May 2017 08:56:48 +0300
-Subject: [PATCH] resolved: bugfix of null pointer p->question dereferencing
- (#6020)
-
-See https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1621396
----
- src/resolve/resolved-dns-packet.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
-index 652970284..240ee448f 100644
---- a/src/resolve/resolved-dns-packet.c
-+++ b/src/resolve/resolved-dns-packet.c
-@@ -2269,6 +2269,9 @@ int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
-         if (r < 0)
-                 return r;
- 
-+        if (!p->question)
-+                return 0;
-+
-         if (p->question->n_keys != 1)
-                 return 0;
- 
--- 
-2.15.0.rc2
-
diff --git a/sys-apps/systemd/systemd-233-r6.ebuild b/sys-apps/systemd/systemd-233-r6.ebuild
index 42b0a4eb4c68..de147be79bd2 100644
--- a/sys-apps/systemd/systemd-233-r6.ebuild
+++ b/sys-apps/systemd/systemd-233-r6.ebuild
@@ -8,6 +8,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/systemd/systemd/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://dev.gentoo.org/~floppym/dist/${P}-patches.tar.gz
 		!doc? ( https://dev.gentoo.org/~floppym/dist/${P}-man.tar.gz )"
 	KEYWORDS="alpha amd64 arm ~arm64 ia64 ppc ppc64 ~sparc x86"
 fi
@@ -153,13 +154,7 @@ src_prepare() {
 	sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die
 
 	local PATCHES=(
-		"${FILESDIR}/233-0001-Avoid-strict-DM-interface-version-dependencies-5519.patch"
-		"${FILESDIR}/233-CVE-2017-9445.patch"
-		"${FILESDIR}/233-format-warnings.patch"
-		"${FILESDIR}/233-0002-core-load-fragment-refuse-units-with-errors-in-RootD.patch"
-		"${FILESDIR}/233-0003-core-load-fragment-refuse-units-with-errors-in-certa.patch"
 		"${FILESDIR}/CVE-2017-15908.patch"
-		"${FILESDIR}/CVE-2017-9217.patch"
 	)
 
 	if ! use vanilla; then