staging-nixos merge for 2025-11-12

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -385,6 +385,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
   - In all other cases, you'll need to set this option to `true` yourself.
   - `boot.isNspawnContainer` being `true` implies [](#opt-boot.isContainer) being `true`.
 
+- `users.users.*.linger` now defaults to `null` rather than `false`, meaning NixOS will not attempt to enable or disable lingering for that user account, instead allowing for imperative control over lingering using the `loginctl` commands. In practice, this is unlikely to make a difference for most people, as new users are created without lingering configured. There is a new, related option, `users.manageLingering`, which can be used to prevent NixOS attempting to manage lingering entirely.
+
 - Due to [deprecation of gnome-session X11 support](https://blogs.gnome.org/alatiera/2025/06/08/the-x11-session-removal/), `services.desktopManager.pantheon` now defaults to pantheon-wayland session. The X11 session has been removed, see [this issue](https://github.com/elementary/session-settings/issues/91) for details.
 
 - `bcachefs` file systems will now use the out-of-tree module for supported kernels. The in-tree module has been removed, and users will need to switch to kernels that support the out-of-tree module.

nixos/modules/config/users-groups.nix

@@ -11,6 +11,7 @@ let
     any
     attrNames
     attrValues
+    boolToString
     concatMap
     concatMapStringsSep
     concatStrings
@@ -43,6 +44,7 @@ let
     stringLength
     trace
     types
+    versionOlder
     xor
     ;
 
@@ -455,16 +457,21 @@ let
         };
 
         linger = mkOption {
-          type = types.bool;
-          default = false;
+          type = types.nullOr types.bool;
+          example = true;
+          default = null;
           description = ''
-            Whether to enable lingering for this user. If true, systemd user
-            units will start at boot, rather than starting at login and stopping
-            at logout. This is the declarative equivalent of running
-            `loginctl enable-linger` for this user.
-
-            If false, user units will not be started until the user logs in, and
-            may be stopped on logout depending on the settings in `logind.conf`.
+            Whether to enable or disable lingering for this user.  Without
+            lingering, user units will not be started until the user logs in,
+            and may be stopped on logout depending on the settings in
+            `logind.conf`.
+
+            By default, NixOS will not manage lingering, new users will default
+            to not lingering, and lingering can be configured imperatively using
+            `loginctl enable-linger` or `loginctl disable-linger`. Setting
+            this option to `true` or `false` is the declarative equivalent of
+            running `loginctl enable-linger` or `loginctl disable-linger`
+            respectively.
           '';
         };
       };
@@ -661,8 +668,6 @@ let
       shells = mapAttrsToList (_: u: u.shell) cfg.users;
     in
     filter types.shellPackage.check shells;
-
-  lingeringUsers = map (u: u.name) (attrValues (flip filterAttrs cfg.users (n: u: u.linger)));
 in
 {
   imports = [
@@ -710,6 +715,13 @@ in
       '';
     };
 
+    users.manageLingering = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to manage whether users linger or not.";
+      example = false;
+    };
+
     users.users = mkOption {
       default = { };
       type = with types; attrsOf (submodule userOpts);
@@ -894,32 +906,52 @@ in
         else
           ""; # keep around for backwards compatibility
 
-      systemd.services.linger-users = lib.mkIf ((length lingeringUsers) > 0) {
+      systemd.services.linger-users = lib.mkIf cfg.manageLingering {
         wantedBy = [ "multi-user.target" ];
         after = [ "systemd-logind.service" ];
         requires = [ "systemd-logind.service" ];
 
         script =
           let
-            lingerDir = "/var/lib/systemd/linger";
-            lingeringUsersFile = builtins.toFile "lingering-users" (
-              concatStrings (map (s: "${s}\n") (sort (a: b: a < b) lingeringUsers))
-            ); # this sorting is important for `comm` to work correctly
+            lingeringUsers = filterAttrs (n: v: v.linger == true) cfg.users;
+            nonLingeringUsers = filterAttrs (n: v: v.linger == false) cfg.users;
+            lingeringUserNames = mapAttrsToList (n: v: v.name) lingeringUsers;
+            nonLingeringUserNames = mapAttrsToList (n: v: v.name) nonLingeringUsers;
           in
           ''
-            mkdir -vp ${lingerDir}
-            cd ${lingerDir}
-            for user in $(ls); do
-              if ! id "$user" >/dev/null; then
-                echo "Removing linger for missing user $user"
-                rm --force -- "$user"
-              fi
+            ${lib.strings.toShellVars { inherit lingeringUserNames nonLingeringUserNames; }}
+
+            user_configured () {
+                # Use `id` to check if the user exists rather than checking the
+                # NixOS configuration, as it may be that the user has been
+                # manually configured, which is permitted if users.mutableUsers
+                # is true (the default).
+                id "$1" >/dev/null
+            }
+
+            shopt -s dotglob nullglob
+            for user in *; do
+                if ! user_configured "$user"; then
+                    # systemd has this user configured to linger despite them not
+                    # existing.
+                    echo "Removing linger for missing user $user" >&2
+                    rm -- "$user"
+                fi
             done
-            ls | sort | comm -3 -1 ${lingeringUsersFile} - | xargs -r ${pkgs.systemd}/bin/loginctl disable-linger
-            ls | sort | comm -3 -2 ${lingeringUsersFile} - | xargs -r ${pkgs.systemd}/bin/loginctl  enable-linger
+
+            if (( ''${#nonLingeringUserNames[*]} > 0 )); then
+                ${config.systemd.package}/bin/loginctl disable-linger "''${nonLingeringUserNames[@]}"
+            fi
+            if (( ''${#lingeringUserNames[*]} > 0 )); then
+                ${config.systemd.package}/bin/loginctl enable-linger "''${lingeringUserNames[@]}"
+            fi
           '';
 
-        serviceConfig.Type = "oneshot";
+        serviceConfig = {
+          Type = "oneshot";
+          StateDirectory = "systemd/linger";
+          WorkingDirectory = "/var/lib/systemd/linger";
+        };
       };
 
       # Warn about user accounts with deprecated password hashing schemes
@@ -1163,6 +1195,22 @@ in
                 users.groups.${user.name} = {};
               '';
             }
+            {
+              assertion = user.linger != null -> cfg.manageLingering;
+              message = ''
+                users.manageLingering is set to false, but
+                users.users.${user.name}.linger is configured.
+
+                If you want NixOS to manage whether user accounts linger or
+                not, you must set users.manageLingering to true.  This is the
+                default setting.
+
+                If you do not want NixOS to manage whether user accounts linger
+                or not, you must set users.users.${user.name}.linger to null.
+                This is the default setting provided system.stateVersion is at
+                least "25.11".
+              '';
+            }
           ]
           ++ (map
             (shell: {

nixos/modules/profiles/bashless.nix

@@ -32,6 +32,7 @@
   boot.kexec.enable = lib.mkDefault false;
   # Relies on bash scripts
   powerManagement.enable = lib.mkDefault false;
+  users.manageLingering = lib.mkDefault false;
   # Relies on the gzip command which depends on bash
   services.logrotate.enable = lib.mkDefault false;
 

nixos/tests/all-tests.nix

@@ -1519,6 +1519,7 @@ in
   systemd-sysusers-password-option-override-ordering = runTest ./systemd-sysusers-password-option-override-ordering.nix;
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
+  systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
   systemtap = handleTest ./systemtap.nix { };

nixos/tests/systemd-user-linger-purge.nix

@@ -0,0 +1,37 @@
+# This test checks #418101, where lingering users would not be cleared up if
+# the configuration is updated to remove lingering from all users.
+rec {
+  name = "systemd-user-linger-purge";
+
+  nodes.machine = {
+    users.users = {
+      bob = {
+        isNormalUser = true;
+        linger = false;
+        uid = 1001;
+      };
+    };
+  };
+
+  testScript =
+    let
+      uidStrings = builtins.mapAttrs (k: v: builtins.toString v.uid) nodes.machine.users.users;
+    in
+    ''
+      machine.fail("test -e /var/lib/systemd/linger/bob")
+      machine.fail("systemctl status user-${uidStrings.bob}.slice")
+
+      with subtest("missing users have linger purged"):
+          machine.succeed("touch /var/lib/systemd/linger/alice")
+          machine.systemctl("restart linger-users")
+          machine.succeed("test ! -e /var/lib/systemd/linger/alice")
+
+      with subtest("mutable users can linger"):
+          machine.succeed("useradd alice")
+          machine.succeed("test ! -e /var/lib/systemd/linger/alice")
+          machine.succeed("loginctl enable-linger alice")
+          machine.succeed("test -e /var/lib/systemd/linger/alice")
+          machine.systemctl("restart linger-users")
+          machine.succeed("test -e /var/lib/systemd/linger/alice")
+    '';
+}

nixos/tests/systemd-user-linger.nix

@@ -1,37 +1,39 @@
-{ lib, ... }:
-{
+rec {
   name = "systemd-user-linger";
 
-  nodes.machine =
-    { ... }:
-    {
-      users.users = {
-        alice = {
-          isNormalUser = true;
-          linger = true;
-          uid = 1000;
-        };
+  nodes.machine = {
+    users.users = {
+      alice = {
+        isNormalUser = true;
+        linger = true;
+        uid = 1000;
+      };
 
-        bob = {
-          isNormalUser = true;
-          linger = false;
-          uid = 10001;
-        };
+      bob = {
+        isNormalUser = true;
+        linger = false;
+        uid = 1001;
       };
     };
+  };
 
   testScript =
-    { ... }:
+    let
+      uidStrings = builtins.mapAttrs (k: v: builtins.toString v.uid) nodes.machine.users.users;
+    in
     ''
       machine.wait_for_file("/var/lib/systemd/linger/alice")
-      machine.succeed("systemctl status user-1000.slice")
+      machine.succeed("systemctl status user-${uidStrings.alice}.slice")
 
       machine.fail("test -e /var/lib/systemd/linger/bob")
-      machine.fail("systemctl status user-1001.slice")
+      machine.fail("systemctl status user-${uidStrings.bob}.slice")
 
-      with subtest("missing users have linger purged"):
-          machine.succeed("touch /var/lib/systemd/linger/missing")
+      with subtest("mutable users can linger"):
+          machine.succeed("useradd clare")
+          machine.succeed("test ! -e /var/lib/systemd/linger/clare")
+          machine.succeed("loginctl enable-linger clare")
+          machine.succeed("test -e /var/lib/systemd/linger/clare")
           machine.systemctl("restart linger-users")
-          machine.succeed("test ! -e /var/lib/systemd/linger/missing")
+          machine.succeed("test -e /var/lib/systemd/linger/clare")
     '';
 }

pkgs/by-name/bt/btrfs-progs/package.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.17";
+  version = "6.17.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-J31pbJ15cT/1r7U8fv69zq0uamAHeJsXQuxBH05Moik=";
+    hash = "sha256-pL4Kbrs8R2Qn+12Xss8CewzNtrDFX/FjIzIMHoy3dlg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd

@@ -18,13 +18,11 @@ nixos-rebuild - reconfigure a NixOS machine
 # SYNOPSIS
 
 ; document here only non-deprecated flags
-_nixos-rebuild_ \[--verbose] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS]++
-	\[--include INCLUDE] [--quiet] [--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file]++
-	\[--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file] [--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT]++
-	\[--no-build-output] [--use-substitutes] [--help] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader] [--profile-name PROFILE_NAME]++
-	\[--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
-	\[--image-variant VARIANT]++
-	\[--build-host BUILD_HOST] [--target-host TARGET_HOST]++
+_nixos-rebuild_ \[--verbose] [--quiet] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS] [--include INCLUDE]++
+	\[--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file] [--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file]++
+	\[--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT] [--no-build-output] [--use-substitutes] [--help] [--debug] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader]++
+	\[--profile-name PROFILE_NAME] [--specialisation SPECIALISATION] [--rollback] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
+	\[--build-host BUILD_HOST] [--target-host TARGET_HOST] [--no-build-nix] [--image-variant IMAGE_VARIANT]++
 	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-image,build-vm,build-vm-with-bootloader,list-generations}]
 
 # DESCRIPTION
@@ -260,9 +258,10 @@ It must be one of the following:
 	When set, *nixos-rebuild* prefixes activation commands with sudo.
 	Setting this option allows deploying as a non-root user.
 
-*--ask-sudo-password*
+*--ask-sudo-password*, *-S*
 	When set, *nixos-rebuild* will ask for sudo password for remote
 	activation (i.e.: on *--target-host*) at the start of the build process.
+	Implies *--sudo*.
 
 *--file* _path_, *-f* _path_
 	Enable and build the NixOS system from the specified file. The file must
@@ -305,9 +304,9 @@ Flake-related options:
 Builder options:
 
 *--verbose,*  *-v*,  *--quiet*,  *--log-format*,  *--no-build-output*, *-Q*,
-*--max-jobs*, *-j*, *--cores*, *--keep-going*, *-k*, *--keep-failed*, *-K*,
-*--fallback*, *--include*, *-I*, *--option*, *--repair*, *--builders*,
-*--print-build-logs*, *-L*, *--show-trace*
+*--no-link*, *--max-jobs*, *-j*, *--cores*, *--keep-going*, *-k*,
+*--keep-failed*, *-K*, *--fallback*, *--include*, *-I*, *--option*, *--repair*,
+*--builders*, *--print-build-logs*, *-L*, *--show-trace*
 
 See the Nix manual, *nix flake lock --help* or *nix-build --help* for details.