Merge ~enr0n/ubuntu/+source/systemd:ubuntu-lunar-sru into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-lunar

[Nick Rosbrook]

SRU several bug fixes to Lunar.

[Lukas Märdian (slyon)]

Thanks, lgtm.

I left an inline question about the systemd.postinst cleanup. Might be unrelated, but maybe should not be dropped as part of a SRU. Also, regarding dropping of the UBUNTU-wait-online-exit-if-no-links-are-managed.patch see the GKE email that I forwarded to you... Should be fine to drop it in the Lunar SRU, IMO, but might need extra considerations for Jammy.

review: Approve

[Lukas Märdian (slyon)]

Added an inline comment reply.

[Nick Rosbrook (enr0n)]

Thanks for your review! I will take a look at the email thread you sent before proceeding.

diff --git a/debian/patches/debian/UBUNTU-wait-online-exit-if-no-links-are-managed.patch b/debian/patches/debian/UBUNTU-wait-online-exit-if-no-links-are-managed.patch
deleted file mode 100644
index 204b67f..0000000
--- a/debian/patches/debian/UBUNTU-wait-online-exit-if-no-links-are-managed.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Dimitri John Ledkov <[e-mail]>
-Date: Mon, 26 Mar 2018 13:17:01 +0100
-Subject: wait-online: exit, if no links are managed.
-
-(cherry picked from commit 19d11f607ac0f8b1e31f72a8e9d3d44371b9dadb)
----
- src/network/wait-online/manager.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/src/network/wait-online/manager.c
-+++ b/src/network/wait-online/manager.c
-@@ -116,6 +116,7 @@
- 
- bool manager_configured(Manager *m) {
-         bool one_ready = false;
-+        bool none_managed = true;
-         const char *ifname;
-         Link *l;
-         int r;
-@@ -166,13 +167,17 @@
-                                                                          _LINK_OPERSTATE_INVALID });
-                 if (r < 0 && !m->any)
-                         return false;
-+                if (l->state && STR_IN_SET(l->state, "configured", "failed")) {
-+                        log_info("managing: %s", l->ifname);
-+                        none_managed = false;
-+                }
-                 if (r > 0)
-                         /* we wait for at least one link to be ready,
-                          * regardless of who manages it */
-                         one_ready = true;
-         }
- 
--        return one_ready;
-+        return one_ready || none_managed;
- }
- 
- static int manager_process_link(sd_netlink *rtnl, sd_netlink_message *mm, void *userdata) {
diff --git a/debian/patches/lp2009743/network-dhcp4-do-not-ignore-the-gateway-even-if-the-desti.patch b/debian/patches/lp2009743/network-dhcp4-do-not-ignore-the-gateway-even-if-the-desti.patch
new file mode 100644
index 0000000..e412f97
--- /dev/null
+++ b/debian/patches/lp2009743/network-dhcp4-do-not-ignore-the-gateway-even-if-the-desti.patch
@@ -0,0 +1,60 @@
+From: Yu Watanabe <[e-mail]>
+Date: Fri, 7 Jul 2023 06:31:04 +0900
+Subject: network/dhcp4: do not ignore the gateway even if the destination is
+ in the same network
+
+Origin: upstream, https://github.com/systemd/systemd-stable/commit/2ed806724288c69da272907d91149570d874133d
+Bug-Ubuntu: https://launchpad.net/bugs/2009743
+
+Fixes #28280.
+
+(cherry picked from commit 77451f654a89d822cd288883edfac315949d1cb6)
+(cherry picked from commit 234b51fb730d1b36ebcc32fc26725a12b08cd818)
+---
+ src/network/networkd-dhcp4.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/src/network/networkd-dhcp4.c b/src/network/networkd-dhcp4.c
+index 9a22b6f..eef7633 100644
+--- a/src/network/networkd-dhcp4.c
++++ b/src/network/networkd-dhcp4.c
+@@ -275,7 +275,8 @@ static int dhcp4_request_route_to_gateway(Link *link, const struct in_addr *gw)
+ static int dhcp4_request_route_auto(
+                 Route *in,
+                 Link *link,
+-                const struct in_addr *gw) {
++                const struct in_addr *gw,
++                bool force_use_gw) {
+
+         _cleanup_(route_freep) Route *route = in;
+         struct in_addr address, netmask, prefix;
+@@ -320,7 +321,8 @@ static int dhcp4_request_route_auto(
+                 route->gw = IN_ADDR_NULL;
+                 route->prefsrc.in = address;
+
+-        } else if (route->dst_prefixlen >= prefixlen &&
++        } else if (!force_use_gw &&
++                   route->dst_prefixlen >= prefixlen &&
+                    (route->dst.in.s_addr & netmask.s_addr) == prefix.s_addr) {
+                 if (in4_addr_is_set(gw))
+                         log_link_debug(link, "DHCP: requested route destination "IPV4_ADDRESS_FMT_STR"/%u is in the assigned network "
+@@ -470,7 +472,9 @@ static int dhcp4_request_static_routes(Link *link, struct in_addr *ret_default_g
+                     in4_addr_is_null(&default_gw))
+                         default_gw = gw;
+
+-                r = dhcp4_request_route_auto(TAKE_PTR(route), link, &gw);
++                /* Do not ignore the gateway given by the classless route option even if the destination is
++                 * in the same network. See issue #28280. */
++                r = dhcp4_request_route_auto(TAKE_PTR(route), link, &gw, /* force_use_gw = */ n_classless_routes > 0);
+                 if (r < 0)
+                         return r;
+         }
+@@ -606,7 +610,7 @@ static int dhcp4_request_routes_to_servers(
+                 route->dst.in = servers[i];
+                 route->dst_prefixlen = 32;
+
+-                r = dhcp4_request_route_auto(TAKE_PTR(route), link, gw);
++                r = dhcp4_request_route_auto(TAKE_PTR(route), link, gw, /* force_use_gw = */ false);
+                 if (r < 0)
+                         return r;
+         }
diff --git a/debian/patches/lp2009743/test-network-add-one-more-testcase-for-DHCPv4-classless-r.patch b/debian/patches/lp2009743/test-network-add-one-more-testcase-for-DHCPv4-classless-r.patch
new file mode 100644
index 0000000..330d6ec
--- /dev/null
+++ b/debian/patches/lp2009743/test-network-add-one-more-testcase-for-DHCPv4-classless-r.patch
@@ -0,0 +1,36 @@
+From: Yu Watanabe <[e-mail]>
+Date: Fri, 7 Jul 2023 06:57:04 +0900
+Subject: test-network: add one more testcase for DHCPv4 classless route
+
+Origin: upstream, https://github.com/systemd/systemd-stable/commit/7cf1bc00b02010f7ad89c5804dfa81fd906e44c7
+Bug-Ubuntu: https://launchpad.net/bugs/2009743
+
+For issue #28280.
+
+(cherry picked from commit 86f6760038477e9e27ccea580f1b3b27328a98a7)
+(cherry picked from commit f74337b7565348a9bd44baae27917b2a202dcf1a)
+---
+ test/test-network/systemd-networkd-tests.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
+index a04f302..1fe743d 100755
+--- a/test/test-network/systemd-networkd-tests.py
++++ b/test/test-network/systemd-networkd-tests.py
+@@ -4658,7 +4658,7 @@ class NetworkdDHCPClientTests(unittest.TestCase, Utilities):
+         ]
+         if classless:
+             additional_options += [
+-                '--dhcp-option=option:classless-static-route,0.0.0.0/0,192.168.5.4,8.0.0.0/8,192.168.5.5'
++                '--dhcp-option=option:classless-static-route,0.0.0.0/0,192.168.5.4,8.0.0.0/8,192.168.5.5,192.168.5.64/26,192.168.5.5'
+             ]
+         start_dnsmasq(*additional_options)
+         self.wait_online(['veth99:routable', 'veth-peer:routable'])
+@@ -4671,6 +4671,7 @@ class NetworkdDHCPClientTests(unittest.TestCase, Utilities):
+             if classless:
+                 self.assertRegex(output, r'default via 192.168.5.4 proto dhcp src 192.168.5.[0-9]* metric 1024')
+                 self.assertRegex(output, r'8.0.0.0/8 via 192.168.5.5 proto dhcp src 192.168.5.[0-9]* metric 1024')
++                self.assertRegex(output, r'192.168.5.64/26 via 192.168.5.5 proto dhcp src 192.168.5.[0-9]* metric 1024')
+                 self.assertRegex(output, r'192.168.5.4 proto dhcp scope link src 192.168.5.[0-9]* metric 1024')
+                 self.assertRegex(output, r'192.168.5.5 proto dhcp scope link src 192.168.5.[0-9]* metric 1024')
+             else:
diff --git a/debian/patches/lp2013543-core-reorder-systemd-arguments-on-reexec.patch b/debian/patches/lp2013543-core-reorder-systemd-arguments-on-reexec.patch
new file mode 100644
index 0000000..d45f0e9
--- /dev/null
+++ b/debian/patches/lp2013543-core-reorder-systemd-arguments-on-reexec.patch
@@ -0,0 +1,58 @@
+From: Frantisek Sumsal <[e-mail]>
+Date: Thu, 29 Jun 2023 13:31:19 +0200
+Subject: core: reorder systemd arguments on reexec
+
+Origin: upstream, https://github.com/systemd/systemd-stable/commit/163be31d380fbdcb56ec06c09e81774840df90dc
+Bug-Ubuntu: https://launchpad.net/bugs/2013543
+
+When reexecuting system let's put our arguments carrying deserialization
+info first followed by any existing arguments to make sure they get
+parsed in case we get weird stuff from the kernel cmdline (like --).
+
+See: https://github.com/systemd/systemd/issues/28184
+(cherry picked from commit 06afda6b38d5d730fca3c65449096425933272bc)
+(cherry picked from commit 884ab38057dca70b8779c85884f4646057e80921)
+---
+ src/core/main.c            | 6 +++++-
+ test/TEST-01-BASIC/test.sh | 5 +++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/main.c b/src/core/main.c
+index c8b7d16..263bdde 100644
+--- a/src/core/main.c
++++ b/src/core/main.c
+@@ -1796,13 +1796,17 @@ static int do_reexecute(
+                 xsprintf(sfd, "%i", fileno(arg_serialization));
+
+                 i = 1;         /* Leave args[0] empty for now. */
+-                filter_args(args, &i, argv, argc);
+
++                /* Put our stuff first to make sure it always gets parsed in case
++                 * we get weird stuff from the kernel cmdline (like --) */
+                 if (switch_root_dir)
+                         args[i++] = "--switched-root";
+                 args[i++] = arg_system ? "--system" : "--user";
+                 args[i++] = "--deserialize";
+                 args[i++] = sfd;
++
++                filter_args(args, &i, argv, argc);
++
+                 args[i++] = NULL;
+
+                 assert(i <= args_size);
+diff --git a/test/TEST-01-BASIC/test.sh b/test/TEST-01-BASIC/test.sh
+index cc6d065..d0e714a 100755
+--- a/test/TEST-01-BASIC/test.sh
++++ b/test/TEST-01-BASIC/test.sh
+@@ -8,6 +8,11 @@ RUN_IN_UNPRIVILEGED_CONTAINER=${RUN_IN_UNPRIVILEGED_CONTAINER:-yes}
+ TEST_REQUIRE_INSTALL_TESTS=0
+ TEST_SUPPORTING_SERVICES_SHOULD_BE_MASKED=0
+
++# Check if we can correctly deserialize if the kernel cmdline contains "weird" stuff
++# like an invalid argument, "end of arguments" separator, or a sysvinit argument (-z)
++# See: https://github.com/systemd/systemd/issues/28184
++KERNEL_APPEND="foo -- -z bar --- baz $KERNEL_APPEND"
++
+ # shellcheck source=test/test-functions
+ . "${TEST_BASE_DIR:?}/test-functions"
+
diff --git a/debian/patches/lp2028180-udev-rules-fix-nvme-symlink-creation-on-namespace-changes.patch b/debian/patches/lp2028180-udev-rules-fix-nvme-symlink-creation-on-namespace-changes.patch
new file mode 100644
index 0000000..5f2735b
--- /dev/null
+++ b/debian/patches/lp2028180-udev-rules-fix-nvme-symlink-creation-on-namespace-changes.patch
@@ -0,0 +1,59 @@
+From: Thomas Blume <[e-mail]>
+Date: Thu, 2 Mar 2023 12:06:13 +0100
+Subject: udev-rules: fix nvme symlink creation on namespace changes
+
+Origin: upstream, https://github.com/systemd/systemd/commit/c5ba7a2a4dd19a2d31b8a9d52d3c4bdde78387f0
+Bug-Ubuntu: https://launchpad.net/bugs/2028180
+
+The nvme by-id symlink changes to the latest namespace when a new namespace gets
+added, for example by connecting multiple NVMe/TCP host controllers via nvme
+connect-all.
+That is incorrect for persistent device links.
+The persistent symbolic device link should continue to point to the same NVMe
+namespace throughout the lifetime of the current boot.
+Therefore the namespace id needs to be added to the link name.
+---
+ rules.d/60-persistent-storage.rules | 8 ++++++++
+ test/units/testsuite-64.sh          | 2 ++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/rules.d/60-persistent-storage.rules b/rules.d/60-persistent-storage.rules
+index 2780dcb..e1c4bf6 100644
+--- a/rules.d/60-persistent-storage.rules
++++ b/rules.d/60-persistent-storage.rules
+@@ -37,14 +37,22 @@ KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ATTRS{serial}=="?*", ENV{ID_S
+ KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ATTRS{wwid}=="?*", ENV{ID_WWN}="$attr{wwid}"
+ KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ATTRS{model}=="?*", ENV{ID_MODEL}="$attr{model}"
+ KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ATTRS{firmware_rev}=="?*", ENV{ID_REVISION}="$attr{firmware_rev}"
++KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ATTRS{nsid}=="?*", ENV{ID_NSID}="$attr{nsid}"
++# obsolete symlink that might get overridden on adding a new nvme controller, kept for backward compatibility
+ KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ENV{ID_MODEL}=="?*", ENV{ID_SERIAL_SHORT}=="?*", \
+   OPTIONS="string_escape=replace", ENV{ID_SERIAL}="$env{ID_MODEL}_$env{ID_SERIAL_SHORT}", SYMLINK+="disk/by-id/nvme-$env{ID_SERIAL}"
++KERNEL=="nvme*[0-9]n*[0-9]", ENV{DEVTYPE}=="disk", ENV{ID_MODEL}=="?*", ENV{ID_SERIAL_SHORT}=="?*", ENV{ID_NSID}=="?*",\
++  OPTIONS="string_escape=replace", ENV{ID_SERIAL}="$env{ID_MODEL}_$env{ID_SERIAL_SHORT}_$env{ID_NSID}", SYMLINK+="disk/by-id/nvme-$env{ID_SERIAL}"
+
+ KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ATTRS{serial}=="?*", ENV{ID_SERIAL_SHORT}="$attr{serial}"
+ KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ATTRS{model}=="?*", ENV{ID_MODEL}="$attr{model}"
+ KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ATTRS{firmware_rev}=="?*", ENV{ID_REVISION}="$attr{firmware_rev}"
++KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ATTRS{nsid}=="?*", ENV{ID_NSID}="$attr{nsid}"
++# obsolete symlink that might get overridden on adding a new nvme controller, kept for backward compatibility
+ KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ENV{ID_MODEL}=="?*", ENV{ID_SERIAL_SHORT}=="?*", \
+   OPTIONS="string_escape=replace", ENV{ID_SERIAL}="$env{ID_MODEL}_$env{ID_SERIAL_SHORT}", SYMLINK+="disk/by-id/nvme-$env{ID_SERIAL}-part%n"
++KERNEL=="nvme*[0-9]n*[0-9]p*[0-9]", ENV{DEVTYPE}=="partition", ENV{ID_MODEL}=="?*", ENV{ID_SERIAL_SHORT}=="?*",  ENV{ID_NSID}=="?*",\
++  OPTIONS="string_escape=replace", ENV{ID_SERIAL}="$env{ID_MODEL}_$env{ID_SERIAL_SHORT}_$env{ID_NSID}", SYMLINK+="disk/by-id/nvme-$env{ID_SERIAL}-part%n"
+
+ # virtio-blk
+ KERNEL=="vd*[!0-9]", ATTRS{serial}=="?*", ENV{ID_SERIAL}="$attr{serial}", SYMLINK+="disk/by-id/virtio-$env{ID_SERIAL}"
+diff --git a/test/units/testsuite-64.sh b/test/units/testsuite-64.sh
+index c4406f3..5d32e0d 100755
+--- a/test/units/testsuite-64.sh
++++ b/test/units/testsuite-64.sh
+@@ -181,6 +181,8 @@ testcase_nvme_subsystem() {
+     local expected_symlinks=(
+         # Controller(s)
+         /dev/disk/by-id/nvme-QEMU_NVMe_Ctrl_deadbeef
++        /dev/disk/by-id/nvme-QEMU_NVMe_Ctrl_deadbeef_16
++        /dev/disk/by-id/nvme-QEMU_NVMe_Ctrl_deadbeef_17
+         # Shared namespaces
+         /dev/disk/by-path/pci-*-nvme-16
+         /dev/disk/by-path/pci-*-nvme-17
diff --git a/debian/patches/lp2031683-sd-bus-bus_message_type_from_string-is-not-pure.patch b/debian/patches/lp2031683-sd-bus-bus_message_type_from_string-is-not-pure.patch
new file mode 100644
index 0000000..7cd6202
--- /dev/null
+++ b/debian/patches/lp2031683-sd-bus-bus_message_type_from_string-is-not-pure.patch
@@ -0,0 +1,62 @@
+From: Xi Ruoyao <[e-mail]>
+Date: Wed, 10 May 2023 01:41:28 +0800
+Subject: sd-bus: bus_message_type_from_string is not pure
+
+Origin: upstream, https://github.com/systemd/systemd-stable/commit/bf2f71a0615b3831f170728760171d8bfb13fc5e
+Bug-Ubuntu: https://launchpad.net/bugs/2031683
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+GCC document [1] says:
+
+    The pure attribute prohibits a function from modifying the state
+    of the program that is observable by means other than inspecting
+    the function’s return value.
+
+And there is an example:
+
+    `int hash (char *) __attribute__ ((pure));`
+    ... Even though hash takes a non-const pointer argument it must
+    not modify the array it points to, ...
+
+But we are modifying the object pointed to by the pointer u, which is
+clearly a violation of the semantic of pure.
+
+With -ftrivial-auto-var-init (enabled by -Dmode=release), on some
+targets (GCC 12.2 on AArch64 and GCC 13.1 on x86_64) performs an
+optimization: as the variable "u" in bus_match_parse has been
+zero-initialized (by the -ftrivial-auto-var-init option) and never
+modified (because a "pure" bus_message_type_from_string is not allowed
+to modify it), "u" will be always 0.
+
+Then 0 is used to initialize .value_u8 field of struct
+bus_match_component.  This then causes a infinite event loop, so
+"systemctl restart" never stops, and pam_systemd timeouts communicating
+with logind, etc.
+
+So we should remove the "pure" attribute here.
+
+Fixes #26395.
+
+[1]:https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-pure-function-attribute
+
+(cherry picked from commit 6723c28f36ea566faf61d3610012cd89f95ee4a0)
+(cherry picked from commit 59dccdfddbdde5d4ff047108a545106f2bac6872)
+---
+ src/libsystemd/sd-bus/bus-internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
+index 51673ad1..d486e17 100644
+--- a/src/libsystemd/sd-bus/bus-internal.h
++++ b/src/libsystemd/sd-bus/bus-internal.h
+@@ -361,7 +361,7 @@ bool path_complex_pattern(const char *pattern, const char *value) _pure_;
+ bool namespace_simple_pattern(const char *pattern, const char *value) _pure_;
+ bool path_simple_pattern(const char *pattern, const char *value) _pure_;
+
+-int bus_message_type_from_string(const char *s, uint8_t *u) _pure_;
++int bus_message_type_from_string(const char *s, uint8_t *u);
+ const char *bus_message_type_to_string(uint8_t u) _pure_;
+
+ #define error_name_is_valid interface_name_is_valid
diff --git a/debian/patches/series b/debian/patches/series
index ac0e72b..a9a027e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,7 +18,6 @@ debian/Ubuntu-UseDomains-by-default.patch
 debian/Ubuntu-units-set-ConditionVirtualization-private-users-on-j.patch
 debian/UBUNTU-Add-AssumedApparmorLabel-unconfined-to-timedate1-dbus.patch
 debian/UBUNTU-test-test-functions-launch-qemu-with-vga-none.patch
-debian/UBUNTU-wait-online-exit-if-no-links-are-managed.patch
 debian/UBUNTU-journald.service-set-Nice-1-to-dodge-watchdog-on-soft-loc.patch
 debian/UBUNTU-units-block-CAP_SYS_MODULE-units-in-containers-too.patch
 debian/UBUNTU-test-sleep-skip-test_fiemap-upon-inapproriate-ioctl-.patch
@@ -57,3 +56,8 @@ lp2002445/sd-device-make-device_set_syspath-clear-sysname-and-sysnu.patch
 lp2002445/udev-restore-syspath-and-properties-on-failure.patch
 lp2002445/sd-device-introduce-device_get_property_int.patch
 lp2002445/core-device-ignore-failed-uevents.patch
+lp2028180-udev-rules-fix-nvme-symlink-creation-on-namespace-changes.patch
+lp2013543-core-reorder-systemd-arguments-on-reexec.patch
+lp2009743/network-dhcp4-do-not-ignore-the-gateway-even-if-the-desti.patch
+lp2009743/test-network-add-one-more-testcase-for-DHCPv4-classless-r.patch
+lp2031683-sd-bus-bus_message_type_from_string-is-not-pure.patch
diff --git a/debian/systemd.postinst b/debian/systemd.postinst
index f63f02f..bced892 100644
--- a/debian/systemd.postinst
+++ b/debian/systemd.postinst
@@ -61,19 +61,6 @@ fi
 # Initial update of the Message Catalogs database
 _update_catalog
 
-# skip daemon-reexec and try-restarts during shutdown to avoid hitting LP: #1803391
-if [ -n "$2" ] && [ "$(systemctl is-system-running)" != "stopping" ]; then
-    _systemctl daemon-reexec || true
-    # do not restart logind; this can be done again once this gets implemented:
-    # https://github.com/systemd/systemd/issues/1163
-    if dpkg --compare-versions "$2" lt-nl "246.2-2~"; then
-        # the socket configuration changed
-        _systemctl stop systemd-networkd.socket || true
-    fi
-    _systemctl try-restart systemd-networkd.service || true
-    _systemctl try-restart systemd-journald.service || true
-fi
-
 # Process all tmpfiles that we ship, including any overrides in
 # runtime-dir/sysadmin-dir/other packages (e.g. rsyslog)
 #
@@ -93,8 +80,24 @@ fi
 
 #DEBHELPER#
 
-if [ -n "$2" ]; then
-    _systemctl daemon-reexec || true
+# skip daemon-reexec and try-restarts during shutdown to avoid hitting LP: #1803391
+if [ -n "$2" ] && [ "$(systemctl is-system-running)" != "stopping" ]; then
+    # LP: #2013543 - the systemd cmdline can get mangled depending on the
+    # contents of /proc/cmdline, which causes systemd to fail to deserialize
+    # it's previous state on daemon-reexec. This means that for upgrades from
+    # affected versions, we need a reboot and cannot re-exec here, else the
+    # bug could be triggered.
+    if dpkg --compare-versions "$2" lt "249.11-0ubuntu3.10~" ||
+        dpkg --compare-versions "$2" eq "252.5-2ubuntu3"; then
+        if ! grep -Fqsx systemd /run/reboot-required.pkgs; then
+            echo systemd >> /run/reboot-required.pkgs || true
+        fi
+
+        # Reload to avoid warnings when restarting services below
+        _systemctl daemon-reload || true
+    else
+        _systemctl daemon-reexec || true
+    fi
     # do not restart logind
     # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919509
     if dpkg --compare-versions "$2" lt-nl "246.2-2~"; then
diff --git a/debian/tests/tests-in-lxd b/debian/tests/tests-in-lxd
index b107262..d901999 100644
--- a/debian/tests/tests-in-lxd
+++ b/debian/tests/tests-in-lxd
@@ -47,7 +47,7 @@ if [ -d ../../binaries ]; then
 fi
 
 lxc stop systemd-lxc
-lxc publish systemd-lxc --alias $IMAGE
+lxc publish systemd-lxc --reuse --alias $IMAGE
 
 # Only test unprivileged LXD containers, since privileged LXD containers cause LoadCredential= (LP: #1950787),
 # and other things to break. According to upstream LXD, we should not worry to much about privileged LXD