Merge ~3v1n0/ubuntu/+source/openssh:ubuntu/drop-libsystemd into ubuntu/+source/openssh:ubuntu/devel

[Marco Trevisan (Treviño)]

[Nick Rosbrook (enr0n)]

It seems that this is not preserving important delta in the Ubuntu patch for systemd socket activation. Please see inline comments for specifics.

review: Needs Fixing

[Marco Trevisan (Treviño) (3v1n0)]

> It seems that this is not preserving important delta in the Ubuntu patch for
> systemd socket activation. Please see inline comments for specifics.

Yeah, I noticed this too late, after that I had submitted this, let me fix this.

[Marco Trevisan (Treviño) (3v1n0)]

> > It seems that this is not preserving important delta in the Ubuntu patch for
> > systemd socket activation. Please see inline comments for specifics.
>
> Yeah, I noticed this too late, after that I had submitted this, let me fix
> this.

All this is handled and now the delta should be correct.

I've changed slightly the behavior of get_systemd_listen_fds () from debian to return `-errno` in the fd cases failures cases so that we can keep fail early.

[Marco Trevisan (Treviño) (3v1n0)]

Addressed the comments

[Nick Rosbrook (enr0n)]

Thanks, systemd-socket-activation.patch looks good to me now.

On a practical note, I was working on preparing an openssh upload for some other things. Would you mind if I upload this with my other changes when ready?

review: Approve

[Marco Trevisan (Treviño) (3v1n0)]

> On a practical note, I was working on preparing an openssh upload for some
> other things. Would you mind if I upload this with my other changes when
> ready?

As you prefer, I was wondering if could also be material for noble though, since we'd put us in an even safer position.

But it's your call.

[Nick Rosbrook (enr0n)]

> > On a practical note, I was working on preparing an openssh upload for some
> > other things. Would you mind if I upload this with my other changes when
> > ready?
>
> As you prefer, I was wondering if could also be material for noble though,
> since we'd put us in an even safer position.
>
> But it's your call.

I meant that I am planning on doing a Noble upload (probably later today).

[Marco Trevisan (Treviño) (3v1n0)]

> I meant that I am planning on doing a Noble upload (probably later today).

Fair enough then, do it whenever is more convenient to you!

Unmerged commits

dbc4b57... by Marco Trevisan (Treviño) on 2024-04-03

Update changelog

6d38e12... by Marco Trevisan (Treviño) on 2024-04-03

debian: Remove dependency on libsystemd

As per the xz backdoor we learned that the least dependencies sshd have
the best it is, so avoid to plug libsystemd (which also brings various
other dependencies) inside sshd for no reason.

Use both the upstream patch for notification support and the socket
activation refactor by Colin Watson.

diff --git a/debian/changelog b/debian/changelog
index 803393e..6c2e833 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+openssh (1:9.6p1-3ubuntu13) UNRELEASED; urgency=medium
+
+  * debian: Remove dependency on libsystemd
+    As per the xz backdoor we learned that the least dependencies sshd have,
+    the best it is, so avoid to plug libsystemd (which also brings various
+    other dependencies) inside sshd for no reason:
+
+    - d/p/systemd-readiness.patch: Use upstream patch with no libsystemd
+      dependency
+    - d/p/systemd-socket-activation.patch: Import patch from debian that
+      mimics the libsystemd sd_listen_fds() code, as refactored by Colin
+      Watson.
+    - d/control: Remove dependencies on  libsystemd-dev | libelogind-dev
+    - d/rules: Drop --with-systemd flag (new options are used by default)
+
+ -- Marco Trevisan (Treviño) <[e-mail]>  Wed, 03 Apr 2024 16:41:15 +0200
+
 openssh (1:9.6p1-3ubuntu12) noble; urgency=medium
 
   * No-change rebuild for CVE-2024-3094
diff --git a/debian/control b/debian/control
index 58e9a89..abdb97e 100644
--- a/debian/control
+++ b/debian/control
@@ -16,7 +16,6 @@ Build-Depends: debhelper (>= 13.1~),
                libpam0g-dev | libpam-dev,
                libselinux1-dev [linux-any],
                libssl-dev (>= 1.1.1),
-               libsystemd-dev [linux-any] | libelogind-dev [linux-any],
                libwrap0-dev | libwrap-dev,
                pkg-config,
                zlib1g-dev,
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
index 59f63ab..799bd81 100644
--- a/debian/patches/systemd-readiness.patch
+++ b/debian/patches/systemd-readiness.patch
@@ -1,84 +1,223 @@
-From 997c7d972b8ad436dff3b9a482f7ce988b50114c Mon Sep 17 00:00:00 2001
-From: Michael Biebl <[e-mail]>
-Date: Mon, 21 Dec 2015 16:08:47 +0000
-Subject: Add systemd readiness notification support
+From: Damien Miller <[e-mail]>
+Date: Wed, 3 Apr 2024 14:40:32 +1100
+Subject: notify systemd on listen and reload
 
+Standalone implementation that does not depend on libsystemd.
+With assistance from Luca Boccassi, and feedback/testing from Colin
+Watson. bz2641
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c
 Bug-Debian: https://bugs.debian.org/778913
-Forwarded: no
-Last-Update: 2017-08-22
+Last-Update: 2024-04-03
 
 Patch-Name: systemd-readiness.patch
 ---
- configure.ac | 24 ++++++++++++++++++++++++
- sshd.c       |  9 +++++++++
- 2 files changed, 33 insertions(+)
+ configure.ac                |  1 +
+ openbsd-compat/port-linux.c | 97 ++++++++++++++++++++++++++++++++++++++++++++-
+ openbsd-compat/port-linux.h |  5 +++
+ platform.c                  | 11 +++++
+ platform.h                  |  1 +
+ sshd.c                      |  2 +
+ 6 files changed, 115 insertions(+), 2 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index badfacf8f..5662c9e3a 100644
+index badfacf..a431c8a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4922,6 +4922,29 @@ AC_SUBST([GSSLIBS])
- AC_SUBST([K5LIBS])
- AC_SUBST([CHANNELLIBS])
+@@ -931,6 +931,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+ 	AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
+ 	AC_DEFINE([USE_BTMP])
+ 	AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
++	AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload])
+ 	inet6_default_4in6=yes
+ 	case `uname -r` in
+ 	1.*|2.0.*)
+diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
+index 0394f48..8e28245 100644
+--- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c
+@@ -21,16 +21,23 @@
  
-+# Check whether user wants systemd support
-+SYSTEMD_MSG="no"
-+AC_ARG_WITH(systemd,
-+	[  --with-systemd          Enable systemd support],
-+	[ if test "x$withval" != "xno" ; then
-+		AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
-+		if test "$PKGCONFIG" != "no"; then
-+			AC_MSG_CHECKING([for libsystemd])
-+			if $PKGCONFIG --exists libsystemd; then
-+				SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
-+				SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
-+				CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
-+				SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
-+				AC_MSG_RESULT([yes])
-+				AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
-+				SYSTEMD_MSG="yes"
-+			else
-+				AC_MSG_RESULT([no])
-+			fi
-+		fi
-+	fi ]
-+)
-+
- # Looking for programs, paths and files
+ #include "includes.h"
  
- PRIVSEP_PATH=/var/empty
-@@ -5731,6 +5754,7 @@ echo "                   libldns support: $LDNS_MSG"
- echo "  Solaris process contract support: $SPC_MSG"
- echo "           Solaris project support: $SP_MSG"
- echo "         Solaris privilege support: $SPP_MSG"
-+echo "                   systemd support: $SYSTEMD_MSG"
- echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
- echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
- echo "                  BSD Auth support: $BSD_AUTH_MSG"
-diff --git a/sshd.c b/sshd.c
-index d56ba490b..356bd6c02 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -88,6 +88,10 @@
- #include <prot.h>
+-#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
++#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) || \
++    defined(SYSTEMD_NOTIFY)
++#include <sys/socket.h>
++#include <sys/un.h>
++
+ #include <errno.h>
++#include <inttypes.h>
+ #include <stdarg.h>
+ #include <string.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <time.h>
+ 
+ #include "log.h"
+ #include "xmalloc.h"
+ #include "port-linux.h"
++#include "misc.h"
+ 
+ #ifdef WITH_SELINUX
+ #include <selinux/selinux.h>
+@@ -317,4 +324,90 @@ oom_adjust_restore(void)
+ 	return;
+ }
+ #endif /* LINUX_OOM_ADJUST */
+-#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
++
++#ifdef SYSTEMD_NOTIFY
++
++static void ssh_systemd_notify(const char *, ...)
++    __attribute__((__format__ (printf, 1, 2))) __attribute__((__nonnull__ (1)));
++
++static void
++ssh_systemd_notify(const char *fmt, ...)
++{
++	char *s = NULL;
++	const char *path;
++	struct stat sb;
++	struct sockaddr_un addr;
++	int fd = -1;
++	va_list ap;
++
++	if ((path = getenv("NOTIFY_SOCKET")) == NULL || strlen(path) == 0)
++		return;
++
++	va_start(ap, fmt);
++	xvasprintf(&s, fmt, ap);
++	va_end(ap);
++
++	/* Only AF_UNIX is supported, with path or abstract sockets */
++	if (path[0] != '/' && path[0] != '@') {
++		error_f("socket \"%s\" is not compatible with AF_UNIX", path);
++		goto out;
++	}
++
++	if (path[0] == '/' && stat(path, &sb) != 0) {
++		error_f("socket \"%s\" stat: %s", path, strerror(errno));
++		goto out;
++	}
++
++	memset(&addr, 0, sizeof(addr));
++	addr.sun_family = AF_UNIX;
++	if (strlcpy(addr.sun_path, path,
++	    sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) {
++		error_f("socket path \"%s\" too long", path);
++		goto out;
++	}
++	/* Support for abstract socket */
++	if (addr.sun_path[0] == '@')
++		addr.sun_path[0] = 0;
++	if ((fd = socket(PF_UNIX, SOCK_DGRAM, 0)) == -1) {
++		error_f("socket \"%s\": %s", path, strerror(errno));
++		goto out;
++	}
++	if (connect(fd, &addr, sizeof(addr)) != 0) {
++		error_f("socket \"%s\" connect: %s", path, strerror(errno));
++		goto out;
++	}
++	if (write(fd, s, strlen(s)) != (ssize_t)strlen(s)) {
++		error_f("socket \"%s\" write: %s", path, strerror(errno));
++		goto out;
++	}
++	debug_f("socket \"%s\" notified %s", path, s);
++ out:
++	if (fd != -1)
++		close(fd);
++	free(s);
++}
++
++void
++ssh_systemd_notify_ready(void)
++{
++	ssh_systemd_notify("READY=1");
++}
++
++void
++ssh_systemd_notify_reload(void)
++{
++	struct timespec now;
++
++	monotime_ts(&now);
++	if (now.tv_sec < 0 || now.tv_nsec < 0) {
++		error_f("monotime returned negative value");
++		ssh_systemd_notify("RELOADING=1");
++	} else {
++		ssh_systemd_notify("RELOADING=1\nMONOTONIC_USEC=%llu",
++		    ((uint64_t)now.tv_sec * 1000000ULL) +
++		    ((uint64_t)now.tv_nsec / 1000ULL));
++	}
++}
++#endif /* SYSTEMD_NOTIFY */
++
++#endif /* WITH_SELINUX || LINUX_OOM_ADJUST || SYSTEMD_NOTIFY */
+diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
+index c881294..6c4c371 100644
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -30,4 +30,9 @@ void oom_adjust_restore(void);
+ void oom_adjust_setup(void);
  #endif
  
-+#ifdef HAVE_SYSTEMD
-+#include <systemd/sd-daemon.h>
++#ifdef SYSTEMD_NOTIFY
++void ssh_systemd_notify_ready(void);
++void ssh_systemd_notify_reload(void);
 +#endif
 +
- #include "xmalloc.h"
- #include "ssh.h"
- #include "ssh2.h"
-@@ -2101,6 +2105,11 @@ main(int ac, char **av)
- 			}
- 		}
+ #endif /* ! _PORT_LINUX_H */
+diff --git a/platform.c b/platform.c
+index 70c3a9b..163a54a 100644
+--- a/platform.c
++++ b/platform.c
+@@ -44,6 +44,14 @@ platform_pre_listen(void)
+ #endif
+ }
  
-+#ifdef HAVE_SYSTEMD
-+		/* Signal systemd that we are ready to accept connections */
-+		sd_notify(0, "READY=1");
++void
++platform_post_listen(void)
++{
++#ifdef SYSTEMD_NOTIFY
++	ssh_systemd_notify_ready();
 +#endif
++}
++
+ void
+ platform_pre_fork(void)
+ {
+@@ -55,6 +63,9 @@ platform_pre_fork(void)
+ void
+ platform_pre_restart(void)
+ {
++#ifdef SYSTEMD_NOTIFY
++	ssh_systemd_notify_reload();
++#endif
+ #ifdef LINUX_OOM_ADJUST
+ 	oom_adjust_restore();
+ #endif
+diff --git a/platform.h b/platform.h
+index 027fdfb..1b77c3e 100644
+--- a/platform.h
++++ b/platform.h
+@@ -21,6 +21,7 @@
+ void platform_pre_listen(void);
+ void platform_pre_fork(void);
+ void platform_pre_restart(void);
++void platform_post_listen(void);
+ void platform_post_fork_parent(pid_t child_pid);
+ void platform_post_fork_child(void);
+ int  platform_privileged_uidswap(void);
+diff --git a/sshd.c b/sshd.c
+index d56ba49..ca47e7e 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -2085,6 +2085,8 @@ main(int ac, char **av)
+ 		ssh_signal(SIGTERM, sigterm_handler);
+ 		ssh_signal(SIGQUIT, sigterm_handler);
+ 
++		platform_post_listen();
 +
- 		/* Accept a connection and return in a forked child */
- 		server_accept_loop(&sock_in, &sock_out,
- 		    &newsock, config_s);
+ 		/*
+ 		 * Write out the pid file after the sigterm handler
+ 		 * is setup and the listen sockets are bound
diff --git a/debian/patches/systemd-socket-activation.patch b/debian/patches/systemd-socket-activation.patch
index 8e1ce7c..c7682d0 100644
--- a/debian/patches/systemd-socket-activation.patch
+++ b/debian/patches/systemd-socket-activation.patch
@@ -1,23 +1,53 @@
+From: Steve Langasek <[e-mail]>
+Date: Thu, 1 Sep 2022 16:03:37 +0100
+Subject: Support systemd socket activation
+
 Description: support systemd socket activation
  Unlike inetd socket activation, with systemd socket activation the
  supervisor passes the listened-on socket to the child process and lets
  the child process handle the accept().  This lets us do delayed start
  of the sshd daemon without becoming incompatible with config options
  like ClientAliveCountMax.
+
 Author: Steve Langasek <[e-mail]>
 Author: Nick Rosbrook <[e-mail]>
+Author: Colin Watson <[e-mail]>
+Author: Marco Trevisan <[e-mail]>
 Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2011458
-Last-Update: 2023-05-25
+Last-Update: 2024-04-03
 
+---
+ configure.ac |   1 +
+ sshd.c       | 176 ++++++++++++++++++++++++++++++++++++++++++++++++++++-------
+ 2 files changed, 156 insertions(+), 21 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index a431c8a..64a44cb 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -932,6 +932,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
+ 	AC_DEFINE([USE_BTMP])
+ 	AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
+ 	AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload])
++	AC_DEFINE([SYSTEMD_SOCKET_ACTIVATION], [1], [Have sshd accept systemd socket activation])
+ 	inet6_default_4in6=yes
+ 	case `uname -r` in
+ 	1.*|2.0.*)
+diff --git a/sshd.c b/sshd.c
+index ca47e7e..9999c71 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -139,11 +139,14 @@
+@@ -135,11 +135,18 @@ int allow_severity;
  int deny_severity;
  #endif /* LIBWRAP */
  
 +/* This will only get set if we build with systemd. */
 +static int systemd_num_listen_fds;
 +
++#ifdef SYSTEMD_SOCKET_ACTIVATION
++#define SYSTEMD_LISTEN_FDS_START 3
++#endif
++
  /* Re-exec fds */
 -#define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
 -#define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
@@ -30,7 +60,7 @@ Last-Update: 2023-05-25
  
  extern char *__progname;
  
-@@ -194,6 +197,7 @@
+@@ -190,6 +197,7 @@ static char **rexec_argv;
   */
  #define	MAX_LISTEN_SOCKS	16
  static int listen_socks[MAX_LISTEN_SOCKS];
@@ -38,7 +68,7 @@ Last-Update: 2023-05-25
  static int num_listen_socks = 0;
  
  /* Daemon's agent connection */
-@@ -279,12 +283,16 @@
+@@ -275,12 +283,16 @@ static char *listener_proctitle;
   * Close all listening sockets
   */
  static void
@@ -57,7 +87,7 @@ Last-Update: 2023-05-25
  	num_listen_socks = 0;
  }
  
-@@ -322,7 +330,7 @@
+@@ -318,7 +330,7 @@ sighup_restart(void)
  	if (options.pid_file != NULL)
  		unlink(options.pid_file);
  	platform_pre_restart();
@@ -66,11 +96,50 @@ Last-Update: 2023-05-25
  	close_startup_pipes();
  	ssh_signal(SIGHUP, SIG_IGN); /* will be restored after exec */
  	execv(saved_argv[0], saved_argv);
-@@ -1020,6 +1028,65 @@
+@@ -1016,6 +1028,104 @@ server_accept_inetd(int *sock_in, int *sock_out)
  	debug("inetd sockets after dupping: %d, %d", *sock_in, *sock_out);
  }
  
-+#ifdef HAVE_SYSTEMD
++#ifdef SYSTEMD_SOCKET_ACTIVATION
++/*
++ * Get file descriptors passed by systemd; this implements the protocol
++ * described in the NOTES section of sd_listen_fds(3).
++ */
++static int
++get_systemd_listen_fds(void)
++{
++	const char *listen_pid_str, *listen_fds_str;
++	pid_t listen_pid;
++	int listen_fds;
++	const char *errstr = NULL;
++	int fd;
++
++	listen_pid_str = getenv("LISTEN_PID");
++	if (listen_pid_str == NULL)
++		return 0;
++	listen_pid = (pid_t)strtonum(listen_pid_str, 2, INT_MAX, &errstr);
++	if (errstr != NULL)
++		return -errno;
++	if (getpid() != listen_pid)
++		return 0;
++
++	listen_fds_str = getenv("LISTEN_FDS");
++	if (listen_fds_str == NULL)
++		return 0;
++	listen_fds = (int)strtonum(listen_fds_str, 1,
++	    INT_MAX - SYSTEMD_LISTEN_FDS_START, &errstr);
++	if (errstr != NULL)
++		return -errno;
++
++	for (fd = SYSTEMD_LISTEN_FDS_START;
++	    fd < SYSTEMD_LISTEN_FDS_START + listen_fds; fd++) {
++		if (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)
++			return -errno;
++	}
++
++	return listen_fds;
++}
++
 +/*
 + * Configure our socket fds that were passed from systemd
 + */
@@ -132,7 +201,7 @@ Last-Update: 2023-05-25
  /*
   * Listen for TCP connections
   */
-@@ -1104,17 +1171,26 @@
+@@ -1100,17 +1210,26 @@ server_listen(void)
  	srclimit_init(options.max_startups, options.per_source_max_startups,
  	    options.per_source_masklen_ipv4, options.per_source_masklen_ipv6);
  
@@ -142,17 +211,12 @@ Last-Update: 2023-05-25
 -		free(options.listen_addrs[i].rdomain);
 -		memset(&options.listen_addrs[i], 0,
 -		    sizeof(options.listen_addrs[i]));
--	}
--	free(options.listen_addrs);
--	options.listen_addrs = NULL;
--	options.num_listen_addrs = 0;
--
-+#ifdef HAVE_SYSTEMD
++#ifdef SYSTEMD_SOCKET_ACTIVATION
 +	if (systemd_num_listen_fds > 0)
 +	{
 +		int i;
 +		for (i = 0; i < systemd_num_listen_fds; i++)
-+			setup_systemd_socket(SD_LISTEN_FDS_START + i);
++			setup_systemd_socket(SYSTEMD_LISTEN_FDS_START + i);
 +	} else
 +#endif
 +	{
@@ -166,11 +230,15 @@ Last-Update: 2023-05-25
 +		free(options.listen_addrs);
 +		options.listen_addrs = NULL;
 +		options.num_listen_addrs = 0;
-+	}
+ 	}
+-	free(options.listen_addrs);
+-	options.listen_addrs = NULL;
+-	options.num_listen_addrs = 0;
+-
  	if (!num_listen_socks)
  		fatal("Cannot bind any address.");
  }
-@@ -1169,7 +1245,7 @@
+@@ -1165,7 +1284,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
  		if (received_sigterm) {
  			logit("Received signal %d; terminating.",
  			    (int) received_sigterm);
@@ -179,7 +247,7 @@ Last-Update: 2023-05-25
  			if (options.pid_file != NULL)
  				unlink(options.pid_file);
  			exit(received_sigterm == SIGTERM ? 0 : 255);
-@@ -1183,7 +1259,7 @@
+@@ -1179,7 +1298,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
  		if (received_sighup) {
  			if (!lameduck) {
  				debug("Received SIGHUP; waiting for children");
@@ -188,7 +256,7 @@ Last-Update: 2023-05-25
  				lameduck = 1;
  			}
  			if (listening <= 0) {
-@@ -1310,7 +1386,7 @@
+@@ -1306,7 +1425,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
  				 * connection without forking.
  				 */
  				debug("Server will not fork when running in debugging mode.");
@@ -197,7 +265,7 @@ Last-Update: 2023-05-25
  				*sock_in = *newsock;
  				*sock_out = *newsock;
  				close(startup_p[0]);
-@@ -1344,7 +1420,7 @@
+@@ -1340,7 +1459,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
  				platform_post_fork_child();
  				startup_pipe = startup_p[1];
  				close_startup_pipes();
@@ -206,18 +274,18 @@ Last-Update: 2023-05-25
  				*sock_in = *newsock;
  				*sock_out = *newsock;
  				log_init(__progname,
-@@ -1715,6 +1791,21 @@
+@@ -1711,6 +1830,21 @@ main(int ac, char **av)
  			break;
  		}
  	}
 +
-+#ifdef HAVE_SYSTEMD
-+        /* We should call sd_listen_fds() exactly once. If we call
-+         * sd_listen_fds() more than once, then FD_CLOEXEC will be
++#ifdef SYSTEMD_SOCKET_ACTIVATION
++        /* We should call get_systemd_listen_fds() exactly once. If we call
++         * get_systemd_listen_fds() more than once, then FD_CLOEXEC will be
 +         * re-configured for the passed fds, which will cause problems during
 +         * re-execution. The FD_CLOEXEC flag will be cleared by
 +         * setup_systemd_socket(). */
-+        r = sd_listen_fds(0);
++        r = get_systemd_listen_fds();
 +        if (r < 0)
 +                fatal("Failed to get systemd socket fds: %s", strerror(-r));
 +
diff --git a/debian/rules b/debian/rules
index 54d82cb..1870fbe 100755
--- a/debian/rules
+++ b/debian/rules
@@ -80,7 +80,6 @@ confflags += --with-ssl-engine
 ifeq ($(DEB_HOST_ARCH_OS),linux)
 confflags += --with-selinux
 confflags += --with-audit=linux
-confflags += --with-systemd
 confflags += --with-security-key-builtin
 endif