[gentoo-hardened] systemd transition

[Tóth Attila]

I've just want to report about the progress I've made converting from
openrc to systemd. I've converted my laptop first and working on the
server.

I could not remove udev and emerge systemd in a single turn. Maybe it's
just my config - I don't know. But if you remove udev, you can run into
difficulties while trying to compile. So what I did was to ebuild systemd
until the install stage, remove udev, qmerge systemd, and do an udev
reload right after. That basically kept me running into any device related
problems while the short time period udev is not there.

I reconfigured grsecurity's PROC protection part and put polkitd into the
group I provide access to the proc filesystem.

Packages merged smoothly (I blocked all Gnome 3.8 related packages because
of the systemd dependency).

I still have problems with gdm. Maybe some retained fragments of some
really old version of the daemon. I'm rolling these systems for a decade
now. Also experienced problems with lxdm. X started up fine for the
display manager, but when I tried to log in, the screen stalled. No panel
ever appeared. No useful error messages I could find anywhere. So I fell
back to the good old slim. It works fine and loads the LX environment for
me. That was it.

It took some time for me to accommodate grsecurity rules for the new init.
It wasn't so bad. At least it wasn't harder compared to the transition to
openrc.

Now the conversion of the server has been mostly finished. I'm still
struggling with missing unit files. Like: squid, opendkim, sshguard,
iptables, dcc, some milters. Not to mention unrealircd or anope.
Fortunately other distros already gathered experience and the adventurous
traveler can find some sample files in many cases (but not all).

The preferred way seems to be to star-up a service in a non-forking mode.
Systemd remains connected and collects the output it pumps in its journald
(the administrator can also attach its favorite syslog-ng for further
processing). Some daemons have no-daemon option.
One exception is ekeyd. I'm studying the Suse way of making it
systemd-ready. Sshguard can be either run in the regular forking mode or
some modifications must be applied.

I think conversion is feasible, but the many services are not prepared
right now and require extra effort.

I haven't rebooted yet, so I'm curious how the bonding configuration will
work for the first time with this new init system. I hope I should not
turn to the remote management card to fix that...

I hope these few lines provide some information for the curious or help
the decision of others. I also hope I don't have to change init system in
a couple of years after openrc and systemd. As I'm growing up I can show
less enthusiasm for such intrusive changes nowdays...

BR: Dw.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057
Attila Toth MD, Radiologist, [phone]