In the systemd unit file of bluez-5.64, there is:
ProtectSystem=full
ReadWritePaths=/var/lib/bluetooth
The combination of these two options make systemd to bind mount /
recursively and read-only to /run/systemd/unit-root in a new mount
namespace, then bind mount /var/lib/bluetooth to
/run/systemd/unit-root/var/lib/bluetooth, then run bluez in the chroot
at /run/systemd/unit-root in the separate namespace.
This helps to reduce the potential damage if a bluez security
vulnerability is exposed. But, if /var/lib/bluetooth does not exist,
systemd will fail to bind mount it and complain:
bluetooth.service: bluetooth.service: Failed to set up mount
namespacing: /run/systemd/unit-root/var/lib/bluetooth: No such
file or directory
As a simple workaround, just create this directory at installation. A
more elegant solution will be shipped in bluez-5.65:
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=0905a06
Q: Why -m700?
A: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=edc69d2
Update to gjs-1.72.1
Update to tracker3-3.3.2
Update to gnome-bluetooth-42.2
Update to epiphany-42.3
Update to libadwaita-1.1.3
Update to libhandy-1.6.3
Update to gnome-desktop-42.3
Update to URI-5.12 (Perl Module)
Update to xf86-input-synaptics-1.9.2 (Xorg Driver)
Update to hdparm-9.64
Update to wayland-protocols-1.26
Update to libdrm-2.4.112
Update to node.js-16.16.0
Update to php-8.1.8
Add security patch for Dovecot (fixes CVE-2022-30550)
Update to seamonkey-2.53.13
Update to gnupg-2.3.7
Mark git as a security update
In some cases --upgrade or --force-reinstall is needed when installing
a python module. Add some notes describing these options.
If one of the above options is used, --no-deps may be needed to avoid
reinstalling package dependencies. Note this option also.
Note than only "setting" CC=gcc CXX=g++ will not work:
CC=gcc
CXX=g++
sh ../js/src/configure.in ...
will not pass CC=gcc and CXX=g++ to sh. It's needed to export CC and
CXX:
CC=gcc
CXX=g++
export CC CXX
sh ../js/src/configure.in ...
Or, explicitly pass them:
CC=gcc CXX=g++ h ../js/src/configure.in ...
