244 files changed, 1010 insertions, 807 deletions

diff --git a/src/activate/activate.c b/src/activate/activate.c
index d345e28567..5318829442 100644
--- a/src/activate/activate.c
+++ b/src/activate/activate.c
@@ -33,6 +33,7 @@
 #include "log.h"
 #include "strv.h"
 #include "macro.h"
+#include "signal-util.h"
 
 static char** arg_listen = NULL;
 static bool arg_accept = false;
@@ -192,6 +193,10 @@ static int launch1(const char* child, char** argv, char **env, int fd) {
 
         /* In the child */
         if (child_pid == 0) {
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 r = dup2(fd, STDIN_FILENO);
                 if (r < 0) {
                         log_error_errno(errno, "Failed to dup connection to stdin: %m");
diff --git a/src/shared/.gitignore b/src/basic/.gitignore
index e22411e484..e22411e484 100644
--- a/src/shared/.gitignore
+++ b/src/basic/.gitignore
diff --git a/src/shared/Makefile b/src/basic/Makefile
index d0b0e8e008..d0b0e8e008 120000
--- a/src/shared/Makefile
+++ b/src/basic/Makefile
diff --git a/src/shared/MurmurHash2.c b/src/basic/MurmurHash2.c
index 2f4149dbe9..2f4149dbe9 100644
--- a/src/shared/MurmurHash2.c
+++ b/src/basic/MurmurHash2.c
diff --git a/src/shared/MurmurHash2.h b/src/basic/MurmurHash2.h
index 93362dd485..93362dd485 100644
--- a/src/shared/MurmurHash2.h
+++ b/src/basic/MurmurHash2.h
diff --git a/src/shared/af-list.c b/src/basic/af-list.c
index f396115a34..f396115a34 100644
--- a/src/shared/af-list.c
+++ b/src/basic/af-list.c
diff --git a/src/shared/af-list.h b/src/basic/af-list.h
index e346ab87f5..e346ab87f5 100644
--- a/src/shared/af-list.h
+++ b/src/basic/af-list.h
diff --git a/src/shared/arphrd-list.c b/src/basic/arphrd-list.c
index 284043cd90..284043cd90 100644
--- a/src/shared/arphrd-list.c
+++ b/src/basic/arphrd-list.c
diff --git a/src/shared/arphrd-list.h b/src/basic/arphrd-list.h
index 5ca182c9e8..5ca182c9e8 100644
--- a/src/shared/arphrd-list.h
+++ b/src/basic/arphrd-list.h
diff --git a/src/shared/async.c b/src/basic/async.c
index 7725e6d7d3..7725e6d7d3 100644
--- a/src/shared/async.c
+++ b/src/basic/async.c
diff --git a/src/shared/async.h b/src/basic/async.h
index 7f1ef79532..7f1ef79532 100644
--- a/src/shared/async.h
+++ b/src/basic/async.h
diff --git a/src/shared/audit.c b/src/basic/audit.c
index 54148fcf18..54148fcf18 100644
--- a/src/shared/audit.c
+++ b/src/basic/audit.c
diff --git a/src/shared/audit.h b/src/basic/audit.h
index 6de331c73e..6de331c73e 100644
--- a/src/shared/audit.h
+++ b/src/basic/audit.h
diff --git a/src/shared/barrier.c b/src/basic/barrier.c
index 436ba95989..436ba95989 100644
--- a/src/shared/barrier.c
+++ b/src/basic/barrier.c
diff --git a/src/shared/barrier.h b/src/basic/barrier.h
index b8954694d3..b8954694d3 100644
--- a/src/shared/barrier.h
+++ b/src/basic/barrier.h
diff --git a/src/shared/blkid-util.h b/src/basic/blkid-util.h
index c689310324..c689310324 100644
--- a/src/shared/blkid-util.h
+++ b/src/basic/blkid-util.h
diff --git a/src/shared/btrfs-ctree.h b/src/basic/btrfs-ctree.h
index d3ae57331c..d3ae57331c 100644
--- a/src/shared/btrfs-ctree.h
+++ b/src/basic/btrfs-ctree.h
diff --git a/src/shared/btrfs-util.c b/src/basic/btrfs-util.c
index 49528dbf01..49528dbf01 100644
--- a/src/shared/btrfs-util.c
+++ b/src/basic/btrfs-util.c
diff --git a/src/shared/btrfs-util.h b/src/basic/btrfs-util.h
index a7eb895c93..a7eb895c93 100644
--- a/src/shared/btrfs-util.h
+++ b/src/basic/btrfs-util.h
diff --git a/src/shared/build.h b/src/basic/build.h
index 24873ab9d7..24873ab9d7 100644
--- a/src/shared/build.h
+++ b/src/basic/build.h
diff --git a/src/shared/bus-label.c b/src/basic/bus-label.c
index ccc9f2bf8e..ccc9f2bf8e 100644
--- a/src/shared/bus-label.c
+++ b/src/basic/bus-label.c
diff --git a/src/shared/bus-label.h b/src/basic/bus-label.h
index ed1dc4e0a7..ed1dc4e0a7 100644
--- a/src/shared/bus-label.h
+++ b/src/basic/bus-label.h
diff --git a/src/shared/calendarspec.c b/src/basic/calendarspec.c
index 2fde3e107e..2fde3e107e 100644
--- a/src/shared/calendarspec.c
+++ b/src/basic/calendarspec.c
diff --git a/src/shared/calendarspec.h b/src/basic/calendarspec.h
index 7baf318249..7baf318249 100644
--- a/src/shared/calendarspec.h
+++ b/src/basic/calendarspec.h
diff --git a/src/shared/cap-list.c b/src/basic/cap-list.c
index bd5bffbfa5..bd5bffbfa5 100644
--- a/src/shared/cap-list.c
+++ b/src/basic/cap-list.c
diff --git a/src/shared/cap-list.h b/src/basic/cap-list.h
index 9824fad70f..9824fad70f 100644
--- a/src/shared/cap-list.h
+++ b/src/basic/cap-list.h
diff --git a/src/shared/capability.c b/src/basic/capability.c
index 58f00e6dae..58f00e6dae 100644
--- a/src/shared/capability.c
+++ b/src/basic/capability.c
diff --git a/src/shared/capability.h b/src/basic/capability.h
index 4eb5c2a835..4eb5c2a835 100644
--- a/src/shared/capability.h
+++ b/src/basic/capability.h
diff --git a/src/shared/cgroup-util.c b/src/basic/cgroup-util.c
index 9988e5c574..66857f118f 100644
--- a/src/shared/cgroup-util.c
+++ b/src/basic/cgroup-util.c
@@ -40,7 +40,7 @@
 #include "fileio.h"
 #include "special.h"
 #include "mkdir.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 int cg_enumerate_processes(const char *controller, const char *path, FILE **_f) {
         _cleanup_free_ char *fs = NULL;
@@ -441,9 +441,7 @@ static const char *normalize_controller(const char *controller) {
 
         assert(controller);
 
-        if (streq(controller, SYSTEMD_CGROUP_CONTROLLER))
-                return "systemd";
-        else if (startswith(controller, "name="))
+        if (startswith(controller, "name="))
                 return controller + 5;
         else
                 return controller;
@@ -483,7 +481,7 @@ int cg_get_path(const char *controller, const char *path, const char *suffix, ch
 
         assert(fs);
 
-        if (controller && !cg_controller_is_valid(controller, true))
+        if (controller && !cg_controller_is_valid(controller))
                 return -EINVAL;
 
         if (_unlikely_(!good)) {
@@ -526,7 +524,7 @@ int cg_get_path_and_check(const char *controller, const char *path, const char *
 
         assert(fs);
 
-        if (!cg_controller_is_valid(controller, true))
+        if (!cg_controller_is_valid(controller))
                 return -EINVAL;
 
         /* Normalize the controller syntax */
@@ -742,7 +740,7 @@ int cg_pid_get_path(const char *controller, pid_t pid, char **path) {
         assert(pid >= 0);
 
         if (controller) {
-                if (!cg_controller_is_valid(controller, true))
+                if (!cg_controller_is_valid(controller))
                         return -EINVAL;
 
                 controller = normalize_controller(controller);
@@ -971,7 +969,7 @@ int cg_split_spec(const char *spec, char **controller, char **path) {
 
         e = strchr(spec, ':');
         if (!e) {
-                if (!cg_controller_is_valid(spec, true))
+                if (!cg_controller_is_valid(spec))
                         return -EINVAL;
 
                 if (controller) {
@@ -994,7 +992,7 @@ int cg_split_spec(const char *spec, char **controller, char **path) {
         t = strdup(normalize_controller(v));
         if (!t)
                 return -ENOMEM;
-        if (!cg_controller_is_valid(t, true)) {
+        if (!cg_controller_is_valid(t)) {
                 free(t);
                 return -EINVAL;
         }
@@ -1610,17 +1608,15 @@ char *cg_unescape(const char *p) {
         DIGITS LETTERS                          \
         "_"
 
-bool cg_controller_is_valid(const char *p, bool allow_named) {
+bool cg_controller_is_valid(const char *p) {
         const char *t, *s;
 
         if (!p)
                 return false;
 
-        if (allow_named) {
-                s = startswith(p, "name=");
-                if (s)
-                        p = s;
-        }
+        s = startswith(p, "name=");
+        if (s)
+                p = s;
 
         if (*p == 0 || *p == '_')
                 return false;
diff --git a/src/shared/cgroup-util.h b/src/basic/cgroup-util.h
index cbf7201370..fd72e9e5c5 100644
--- a/src/shared/cgroup-util.h
+++ b/src/basic/cgroup-util.h
@@ -122,7 +122,7 @@ int cg_path_decode_unit(const char *cgroup, char **unit);
 char *cg_escape(const char *p);
 char *cg_unescape(const char *p) _pure_;
 
-bool cg_controller_is_valid(const char *p, bool allow_named);
+bool cg_controller_is_valid(const char *p);
 
 int cg_slice_to_path(const char *unit, char **ret);
 
diff --git a/src/shared/clock-util.c b/src/basic/clock-util.c
index e4e03df1e4..e4e03df1e4 100644
--- a/src/shared/clock-util.c
+++ b/src/basic/clock-util.c
diff --git a/src/shared/clock-util.h b/src/basic/clock-util.h
index 8c2d235430..8c2d235430 100644
--- a/src/shared/clock-util.h
+++ b/src/basic/clock-util.h
diff --git a/src/shared/conf-files.c b/src/basic/conf-files.c
index da8745b284..da8745b284 100644
--- a/src/shared/conf-files.c
+++ b/src/basic/conf-files.c
diff --git a/src/shared/conf-files.h b/src/basic/conf-files.h
index 3169a907f1..3169a907f1 100644
--- a/src/shared/conf-files.h
+++ b/src/basic/conf-files.h
diff --git a/src/shared/copy.c b/src/basic/copy.c
index 1282cb88be..1282cb88be 100644
--- a/src/shared/copy.c
+++ b/src/basic/copy.c
diff --git a/src/shared/copy.h b/src/basic/copy.h
index 8de0cfba32..8de0cfba32 100644
--- a/src/shared/copy.h
+++ b/src/basic/copy.h
diff --git a/src/shared/def.h b/src/basic/def.h
index a3d9fcf388..011c7c667e 100644
--- a/src/shared/def.h
+++ b/src/basic/def.h
@@ -35,7 +35,7 @@
  * the watchdog pings will keep the loop busy. */
 #define DEFAULT_EXIT_USEC (30*USEC_PER_SEC)
 
-#define SYSTEMD_CGROUP_CONTROLLER "name=systemd"
+#define SYSTEMD_CGROUP_CONTROLLER "systemd"
 
 #define SIGNALS_CRASH_HANDLER SIGSEGV,SIGILL,SIGFPE,SIGBUS,SIGQUIT,SIGABRT
 #define SIGNALS_IGNORE SIGPIPE
diff --git a/src/shared/device-nodes.c b/src/basic/device-nodes.c
index 9d5af72d27..9d5af72d27 100644
--- a/src/shared/device-nodes.c
+++ b/src/basic/device-nodes.c
diff --git a/src/shared/device-nodes.h b/src/basic/device-nodes.h
index 04ba4897e5..04ba4897e5 100644
--- a/src/shared/device-nodes.h
+++ b/src/basic/device-nodes.h
diff --git a/src/shared/env-util.c b/src/basic/env-util.c
index ac7bbdc711..ac7bbdc711 100644
--- a/src/shared/env-util.c
+++ b/src/basic/env-util.c
diff --git a/src/shared/env-util.h b/src/basic/env-util.h
index 803aa61cad..803aa61cad 100644
--- a/src/shared/env-util.h
+++ b/src/basic/env-util.h
diff --git a/src/shared/errno-list.c b/src/basic/errno-list.c
index 34d1331486..34d1331486 100644
--- a/src/shared/errno-list.c
+++ b/src/basic/errno-list.c
diff --git a/src/shared/errno-list.h b/src/basic/errno-list.h
index ba533294e6..ba533294e6 100644
--- a/src/shared/errno-list.h
+++ b/src/basic/errno-list.h
diff --git a/src/shared/ether-addr-util.h b/src/basic/ether-addr-util.h
index 7033138788..7033138788 100644
--- a/src/shared/ether-addr-util.h
+++ b/src/basic/ether-addr-util.h
diff --git a/src/shared/exit-status.c b/src/basic/exit-status.c
index c09efdd2cb..c09efdd2cb 100644
--- a/src/shared/exit-status.c
+++ b/src/basic/exit-status.c
diff --git a/src/shared/exit-status.h b/src/basic/exit-status.h
index 7259cd1d18..7259cd1d18 100644
--- a/src/shared/exit-status.h
+++ b/src/basic/exit-status.h
diff --git a/src/shared/fdset.c b/src/basic/fdset.c
index 6101b628ec..6101b628ec 100644
--- a/src/shared/fdset.c
+++ b/src/basic/fdset.c
diff --git a/src/shared/fdset.h b/src/basic/fdset.h
index 340438d7c4..340438d7c4 100644
--- a/src/shared/fdset.h
+++ b/src/basic/fdset.h
diff --git a/src/shared/fileio-label.c b/src/basic/fileio-label.c
index bec988ca78..bec988ca78 100644
--- a/src/shared/fileio-label.c
+++ b/src/basic/fileio-label.c
diff --git a/src/shared/fileio-label.h b/src/basic/fileio-label.h
index 25fa351be2..25fa351be2 100644
--- a/src/shared/fileio-label.h
+++ b/src/basic/fileio-label.h
diff --git a/src/shared/fileio.c b/src/basic/fileio.c
index ff6b1a7ed7..ff6b1a7ed7 100644
--- a/src/shared/fileio.c
+++ b/src/basic/fileio.c
diff --git a/src/shared/fileio.h b/src/basic/fileio.h
index 5ae51c1e28..5ae51c1e28 100644
--- a/src/shared/fileio.h
+++ b/src/basic/fileio.h
diff --git a/src/shared/gunicode.c b/src/basic/gunicode.c
index d89a2f3ed9..d89a2f3ed9 100644
--- a/src/shared/gunicode.c
+++ b/src/basic/gunicode.c
diff --git a/src/shared/gunicode.h b/src/basic/gunicode.h
index e70818fdd7..e70818fdd7 100644
--- a/src/shared/gunicode.h
+++ b/src/basic/gunicode.h
diff --git a/src/shared/hashmap.c b/src/basic/hashmap.c
index 20d599d04b..20d599d04b 100644
--- a/src/shared/hashmap.c
+++ b/src/basic/hashmap.c
diff --git a/src/shared/hashmap.h b/src/basic/hashmap.h
index a03ee5812a..a03ee5812a 100644
--- a/src/shared/hashmap.h
+++ b/src/basic/hashmap.h
diff --git a/src/shared/hostname-util.c b/src/basic/hostname-util.c
index e336f269fa..e336f269fa 100644
--- a/src/shared/hostname-util.c
+++ b/src/basic/hostname-util.c
diff --git a/src/shared/hostname-util.h b/src/basic/hostname-util.h
index 0c4763cf5a..0c4763cf5a 100644
--- a/src/shared/hostname-util.h
+++ b/src/basic/hostname-util.h
diff --git a/src/shared/in-addr-util.c b/src/basic/in-addr-util.c
index d88864b598..d88864b598 100644
--- a/src/shared/in-addr-util.c
+++ b/src/basic/in-addr-util.c
diff --git a/src/shared/in-addr-util.h b/src/basic/in-addr-util.h
index 51af08868c..51af08868c 100644
--- a/src/shared/in-addr-util.h
+++ b/src/basic/in-addr-util.h
diff --git a/src/shared/ioprio.h b/src/basic/ioprio.h
index e5c71d0043..e5c71d0043 100644
--- a/src/shared/ioprio.h
+++ b/src/basic/ioprio.h
diff --git a/src/shared/json.c b/src/basic/json.c
index be40a0d203..be40a0d203 100644
--- a/src/shared/json.c
+++ b/src/basic/json.c
diff --git a/src/shared/json.h b/src/basic/json.h
index e0b4d810b5..e0b4d810b5 100644
--- a/src/shared/json.h
+++ b/src/basic/json.h
diff --git a/src/shared/label.c b/src/basic/label.c
index 82f10b21bd..82f10b21bd 100644
--- a/src/shared/label.c
+++ b/src/basic/label.c
diff --git a/src/shared/label.h b/src/basic/label.h
index 8070bcb021..8070bcb021 100644
--- a/src/shared/label.h
+++ b/src/basic/label.h
diff --git a/src/shared/linux/Makefile b/src/basic/linux/Makefile
index d0b0e8e008..d0b0e8e008 120000
--- a/src/shared/linux/Makefile
+++ b/src/basic/linux/Makefile
diff --git a/src/shared/list.h b/src/basic/list.h
index 2939216adb..2939216adb 100644
--- a/src/shared/list.h
+++ b/src/basic/list.h
diff --git a/src/shared/locale-util.c b/src/basic/locale-util.c
index 61db9a8125..61db9a8125 100644
--- a/src/shared/locale-util.c
+++ b/src/basic/locale-util.c
diff --git a/src/shared/locale-util.h b/src/basic/locale-util.h
index e48aa3d9af..e48aa3d9af 100644
--- a/src/shared/locale-util.h
+++ b/src/basic/locale-util.h
diff --git a/src/shared/lockfile-util.c b/src/basic/lockfile-util.c
index 05e16d1caa..05e16d1caa 100644
--- a/src/shared/lockfile-util.c
+++ b/src/basic/lockfile-util.c
diff --git a/src/shared/lockfile-util.h b/src/basic/lockfile-util.h
index 38d47094bd..38d47094bd 100644
--- a/src/shared/lockfile-util.h
+++ b/src/basic/lockfile-util.h
diff --git a/src/shared/log.c b/src/basic/log.c
index b96afc4de4..b96afc4de4 100644
--- a/src/shared/log.c
+++ b/src/basic/log.c
diff --git a/src/shared/log.h b/src/basic/log.h
index 569762d083..569762d083 100644
--- a/src/shared/log.h
+++ b/src/basic/log.h
diff --git a/src/shared/login-shared.c b/src/basic/login-util.c
index 64650a9134..e25437f0f4 100644
--- a/src/shared/login-shared.c
+++ b/src/basic/login-util.c
@@ -19,7 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include "login-shared.h"
+#include "login-util.h"
 #include "def.h"
 
 bool session_id_valid(const char *id) {
diff --git a/src/shared/login-shared.h b/src/basic/login-util.h
index a79f20c1b1..a79f20c1b1 100644
--- a/src/shared/login-shared.h
+++ b/src/basic/login-util.h
diff --git a/src/shared/macro.h b/src/basic/macro.h
index 7ae1ed80b6..cc1c9e73c0 100644
--- a/src/shared/macro.h
+++ b/src/basic/macro.h
@@ -467,4 +467,7 @@ do {                                                                    \
         }                                                       \
         struct __useless_struct_to_allow_trailing_semicolon__
 
+#define CMSG_FOREACH(cmsg, mh)                                          \
+        for ((cmsg) = CMSG_FIRSTHDR(mh); (cmsg); (cmsg) = CMSG_NXTHDR((mh), (cmsg)))
+
 #include "log.h"
diff --git a/src/shared/memfd-util.c b/src/basic/memfd-util.c
index e99a738e1f..e99a738e1f 100644
--- a/src/shared/memfd-util.c
+++ b/src/basic/memfd-util.c
diff --git a/src/shared/memfd-util.h b/src/basic/memfd-util.h
index 3ed551fb37..3ed551fb37 100644
--- a/src/shared/memfd-util.h
+++ b/src/basic/memfd-util.h
diff --git a/src/shared/mempool.c b/src/basic/mempool.c
index d5d98d8829..d5d98d8829 100644
--- a/src/shared/mempool.c
+++ b/src/basic/mempool.c
diff --git a/src/shared/mempool.h b/src/basic/mempool.h
index 42f473bee1..42f473bee1 100644
--- a/src/shared/mempool.h
+++ b/src/basic/mempool.h
diff --git a/src/shared/missing.h b/src/basic/missing.h
index be7f6186fc..be7f6186fc 100644
--- a/src/shared/missing.h
+++ b/src/basic/missing.h
diff --git a/src/shared/mkdir-label.c b/src/basic/mkdir-label.c
index 76bbc1edda..76bbc1edda 100644
--- a/src/shared/mkdir-label.c
+++ b/src/basic/mkdir-label.c
diff --git a/src/shared/mkdir.c b/src/basic/mkdir.c
index 7ee4546988..7ee4546988 100644
--- a/src/shared/mkdir.c
+++ b/src/basic/mkdir.c
diff --git a/src/shared/mkdir.h b/src/basic/mkdir.h
index 2392d1fd1b..2392d1fd1b 100644
--- a/src/shared/mkdir.h
+++ b/src/basic/mkdir.h
diff --git a/src/shared/ordered-set.h b/src/basic/ordered-set.h
index 766a1f2e83..766a1f2e83 100644
--- a/src/shared/ordered-set.h
+++ b/src/basic/ordered-set.h
diff --git a/src/shared/path-util.c b/src/basic/path-util.c
index be50a1865d..537705446a 100644
--- a/src/shared/path-util.c
+++ b/src/basic/path-util.c
@@ -640,7 +640,7 @@ fallback_fstat:
 /* flags can be AT_SYMLINK_FOLLOW or 0 */
 int path_is_mount_point(const char *t, int flags) {
         _cleanup_close_ int fd = -1;
-        _cleanup_free_ char *parent = NULL;
+        _cleanup_free_ char *canonical = NULL, *parent = NULL;
         int r;
 
         assert(t);
@@ -648,7 +648,17 @@ int path_is_mount_point(const char *t, int flags) {
         if (path_equal(t, "/"))
                 return 1;
 
-        r = path_get_parent(t, &parent);
+        /* we need to resolve symlinks manually, we can't just rely on
+         * fd_is_mount_point() to do that for us; if we have a structure like
+         * /bin -> /usr/bin/ and /usr is a mount point, then the parent that we
+         * look at needs to be /usr, not /. */
+        if (flags & AT_SYMLINK_FOLLOW) {
+                canonical = canonicalize_file_name(t);
+                if (!canonical)
+                        return -errno;
+        }
+
+        r = path_get_parent(canonical ?: t, &parent);
         if (r < 0)
                 return r;
 
@@ -656,7 +666,7 @@ int path_is_mount_point(const char *t, int flags) {
         if (fd < 0)
                 return -errno;
 
-        return fd_is_mount_point(fd, basename(t), flags);
+        return fd_is_mount_point(fd, basename(canonical ?: t), flags);
 }
 
 int path_is_read_only_fs(const char *path) {
diff --git a/src/shared/path-util.h b/src/basic/path-util.h
index 1eac89c51b..1eac89c51b 100644
--- a/src/shared/path-util.h
+++ b/src/basic/path-util.h
diff --git a/src/shared/prioq.c b/src/basic/prioq.c
index b89888be0e..b89888be0e 100644
--- a/src/shared/prioq.c
+++ b/src/basic/prioq.c
diff --git a/src/shared/prioq.h b/src/basic/prioq.h
index 1c044b135c..1c044b135c 100644
--- a/src/shared/prioq.h
+++ b/src/basic/prioq.h
diff --git a/src/shared/process-util.c b/src/basic/process-util.c
index cfc876567d..cfc876567d 100644
--- a/src/shared/process-util.c
+++ b/src/basic/process-util.c
diff --git a/src/shared/process-util.h b/src/basic/process-util.h
index 07431d043b..07431d043b 100644
--- a/src/shared/process-util.h
+++ b/src/basic/process-util.h
diff --git a/src/shared/random-util.c b/src/basic/random-util.c
index b230044f50..b230044f50 100644
--- a/src/shared/random-util.c
+++ b/src/basic/random-util.c
diff --git a/src/shared/random-util.h b/src/basic/random-util.h
index f7862c8c8b..f7862c8c8b 100644
--- a/src/shared/random-util.h
+++ b/src/basic/random-util.h
diff --git a/src/shared/ratelimit.c b/src/basic/ratelimit.c
index 81fc9c19ff..81fc9c19ff 100644
--- a/src/shared/ratelimit.c
+++ b/src/basic/ratelimit.c
diff --git a/src/shared/ratelimit.h b/src/basic/ratelimit.h
index 58efca7df1..58efca7df1 100644
--- a/src/shared/ratelimit.h
+++ b/src/basic/ratelimit.h
diff --git a/src/shared/refcnt.h b/src/basic/refcnt.h
index 0502c20a2e..0502c20a2e 100644
--- a/src/shared/refcnt.h
+++ b/src/basic/refcnt.h
diff --git a/src/shared/replace-var.c b/src/basic/replace-var.c
index 478fc43a38..478fc43a38 100644
--- a/src/shared/replace-var.c
+++ b/src/basic/replace-var.c
diff --git a/src/shared/replace-var.h b/src/basic/replace-var.h
index 7eaee93a3e..7eaee93a3e 100644
--- a/src/shared/replace-var.h
+++ b/src/basic/replace-var.h
diff --git a/src/shared/ring.c b/src/basic/ring.c
index 6814918464..6814918464 100644
--- a/src/shared/ring.c
+++ b/src/basic/ring.c
diff --git a/src/shared/ring.h b/src/basic/ring.h
index a7c44d1b56..a7c44d1b56 100644
--- a/src/shared/ring.h
+++ b/src/basic/ring.h
diff --git a/src/shared/rm-rf.c b/src/basic/rm-rf.c
index bafd483be2..bafd483be2 100644
--- a/src/shared/rm-rf.c
+++ b/src/basic/rm-rf.c
diff --git a/src/shared/rm-rf.h b/src/basic/rm-rf.h
index 96579eb182..96579eb182 100644
--- a/src/shared/rm-rf.h
+++ b/src/basic/rm-rf.h
diff --git a/src/shared/securebits.h b/src/basic/securebits.h
index 98fbe0d433..98fbe0d433 100644
--- a/src/shared/securebits.h
+++ b/src/basic/securebits.h
diff --git a/src/shared/selinux-util.c b/src/basic/selinux-util.c
index 7c58985cd2..7c58985cd2 100644
--- a/src/shared/selinux-util.c
+++ b/src/basic/selinux-util.c
diff --git a/src/shared/selinux-util.h b/src/basic/selinux-util.h
index 8467185291..8467185291 100644
--- a/src/shared/selinux-util.h
+++ b/src/basic/selinux-util.h
diff --git a/src/shared/set.h b/src/basic/set.h
index 4dffecd39d..4dffecd39d 100644
--- a/src/shared/set.h
+++ b/src/basic/set.h
diff --git a/src/shared/sigbus.c b/src/basic/sigbus.c
index 0108603fe8..0108603fe8 100644
--- a/src/shared/sigbus.c
+++ b/src/basic/sigbus.c
diff --git a/src/shared/sigbus.h b/src/basic/sigbus.h
index 23edc6d9cb..23edc6d9cb 100644
--- a/src/shared/sigbus.h
+++ b/src/basic/sigbus.h
diff --git a/src/shared/signal-util.c b/src/basic/signal-util.c
index 9a2973b6fd..84cf42b285 100644
--- a/src/shared/signal-util.c
+++ b/src/basic/signal-util.c
@@ -23,13 +23,13 @@
 #include "signal-util.h"
 
 int reset_all_signal_handlers(void) {
+        static const struct sigaction sa = {
+                .sa_handler = SIG_DFL,
+                .sa_flags = SA_RESTART,
+        };
         int sig, r = 0;
 
         for (sig = 1; sig < _NSIG; sig++) {
-                static const struct sigaction sa = {
-                        .sa_handler = SIG_DFL,
-                        .sa_flags = SA_RESTART,
-                };
 
                 /* These two cannot be caught... */
                 if (sig == SIGKILL || sig == SIGSTOP)
@@ -38,7 +38,7 @@ int reset_all_signal_handlers(void) {
                 /* On Linux the first two RT signals are reserved by
                  * glibc, and sigaction() will return EINVAL for them. */
                 if ((sigaction(sig, &sa, NULL) < 0))
-                        if (errno != EINVAL && r == 0)
+                        if (errno != EINVAL && r >= 0)
                                 r = -errno;
         }
 
@@ -57,83 +57,123 @@ int reset_signal_mask(void) {
         return 0;
 }
 
+static int sigaction_many_ap(const struct sigaction *sa, int sig, va_list ap) {
+        int r = 0;
+
+        /* negative signal ends the list. 0 signal is skipped. */
+
+        if (sig < 0)
+                return 0;
+
+        if (sig > 0) {
+                if (sigaction(sig, sa, NULL) < 0)
+                        r = -errno;
+        }
+
+        while ((sig = va_arg(ap, int)) >= 0) {
+
+                if (sig == 0)
+                        continue;
+
+                if (sigaction(sig, sa, NULL) < 0) {
+                        if (r >= 0)
+                                r = -errno;
+                }
+        }
+
+        return r;
+}
+
 int sigaction_many(const struct sigaction *sa, ...) {
         va_list ap;
-        int r = 0, sig;
+        int r;
 
         va_start(ap, sa);
-        while ((sig = va_arg(ap, int)) > 0)
-                if (sigaction(sig, sa, NULL) < 0)
-                        r = -errno;
+        r = sigaction_many_ap(sa, 0, ap);
         va_end(ap);
 
         return r;
 }
 
 int ignore_signals(int sig, ...) {
+
         static const struct sigaction sa = {
                 .sa_handler = SIG_IGN,
                 .sa_flags = SA_RESTART,
         };
-        va_list ap;
-        int r = 0;
 
-        if (sigaction(sig, &sa, NULL) < 0)
-                r = -errno;
+        va_list ap;
+        int r;
 
         va_start(ap, sig);
-        while ((sig = va_arg(ap, int)) > 0)
-                if (sigaction(sig, &sa, NULL) < 0)
-                        r = -errno;
+        r = sigaction_many_ap(&sa, sig, ap);
         va_end(ap);
 
         return r;
 }
 
 int default_signals(int sig, ...) {
+
         static const struct sigaction sa = {
                 .sa_handler = SIG_DFL,
                 .sa_flags = SA_RESTART,
         };
-        va_list ap;
-        int r = 0;
 
-        if (sigaction(sig, &sa, NULL) < 0)
-                r = -errno;
+        va_list ap;
+        int r;
 
         va_start(ap, sig);
-        while ((sig = va_arg(ap, int)) > 0)
-                if (sigaction(sig, &sa, NULL) < 0)
-                        r = -errno;
+        r = sigaction_many_ap(&sa, sig, ap);
         va_end(ap);
 
         return r;
 }
 
-void sigset_add_many(sigset_t *ss, ...) {
-        va_list ap;
-        int sig;
+static int sigset_add_many_ap(sigset_t *ss, va_list ap) {
+        int sig, r = 0;
 
         assert(ss);
 
+        while ((sig = va_arg(ap, int)) >= 0) {
+
+                if (sig == 0)
+                        continue;
+
+                if (sigaddset(ss, sig) < 0) {
+                        if (r >= 0)
+                                r = -errno;
+                }
+        }
+
+        return r;
+}
+
+int sigset_add_many(sigset_t *ss, ...) {
+        va_list ap;
+        int r;
+
         va_start(ap, ss);
-        while ((sig = va_arg(ap, int)) > 0)
-                assert_se(sigaddset(ss, sig) == 0);
+        r = sigset_add_many_ap(ss, ap);
         va_end(ap);
+
+        return r;
 }
 
 int sigprocmask_many(int how, ...) {
         va_list ap;
         sigset_t ss;
-        int sig;
+        int r;
 
-        assert_se(sigemptyset(&ss) == 0);
+        if (sigemptyset(&ss) < 0)
+                return -errno;
 
         va_start(ap, how);
-        while ((sig = va_arg(ap, int)) > 0)
-                assert_se(sigaddset(&ss, sig) == 0);
+        r = sigset_add_many_ap(&ss, ap);
         va_end(ap);
 
+        if (r < 0)
+                return r;
+
         if (sigprocmask(how, &ss, NULL) < 0)
                 return -errno;
 
diff --git a/src/shared/signal-util.h b/src/basic/signal-util.h
index ddf64cda76..9dc8a28726 100644
--- a/src/shared/signal-util.h
+++ b/src/basic/signal-util.h
@@ -32,7 +32,7 @@ int ignore_signals(int sig, ...);
 int default_signals(int sig, ...);
 int sigaction_many(const struct sigaction *sa, ...);
 
-void sigset_add_many(sigset_t *ss, ...);
+int sigset_add_many(sigset_t *ss, ...);
 int sigprocmask_many(int how, ...);
 
 const char *signal_to_string(int i) _const_;
diff --git a/src/shared/siphash24.c b/src/basic/siphash24.c
index f68bd283a1..f68bd283a1 100644
--- a/src/shared/siphash24.c
+++ b/src/basic/siphash24.c
diff --git a/src/shared/siphash24.h b/src/basic/siphash24.h
index 62e1168a79..62e1168a79 100644
--- a/src/shared/siphash24.h
+++ b/src/basic/siphash24.h
diff --git a/src/shared/smack-util.c b/src/basic/smack-util.c
index 2e24b1ea99..2e24b1ea99 100644
--- a/src/shared/smack-util.c
+++ b/src/basic/smack-util.c
diff --git a/src/shared/smack-util.h b/src/basic/smack-util.h
index 50f55b1f4b..50f55b1f4b 100644
--- a/src/shared/smack-util.h
+++ b/src/basic/smack-util.h
diff --git a/src/shared/socket-label.c b/src/basic/socket-label.c
index cbe3ff216e..cbe3ff216e 100644
--- a/src/shared/socket-label.c
+++ b/src/basic/socket-label.c
diff --git a/src/shared/socket-util.c b/src/basic/socket-util.c
index e8bb10dc9b..e8bb10dc9b 100644
--- a/src/shared/socket-util.c
+++ b/src/basic/socket-util.c
diff --git a/src/shared/socket-util.h b/src/basic/socket-util.h
index 538cf59174..538cf59174 100644
--- a/src/shared/socket-util.h
+++ b/src/basic/socket-util.h
diff --git a/src/shared/sparse-endian.h b/src/basic/sparse-endian.h
index c913fda8c5..c913fda8c5 100644
--- a/src/shared/sparse-endian.h
+++ b/src/basic/sparse-endian.h
diff --git a/src/shared/special.h b/src/basic/special.h
index e51310eb6d..e51310eb6d 100644
--- a/src/shared/special.h
+++ b/src/basic/special.h
diff --git a/src/shared/strbuf.c b/src/basic/strbuf.c
index 01a076c2ba..01a076c2ba 100644
--- a/src/shared/strbuf.c
+++ b/src/basic/strbuf.c
diff --git a/src/shared/strbuf.h b/src/basic/strbuf.h
index fbc4e5f2a1..fbc4e5f2a1 100644
--- a/src/shared/strbuf.h
+++ b/src/basic/strbuf.h
diff --git a/src/shared/strv.c b/src/basic/strv.c
index d44a72fc48..d44a72fc48 100644
--- a/src/shared/strv.c
+++ b/src/basic/strv.c
diff --git a/src/shared/strv.h b/src/basic/strv.h
index 22f8f98fda..22f8f98fda 100644
--- a/src/shared/strv.h
+++ b/src/basic/strv.h
diff --git a/src/shared/strxcpyx.c b/src/basic/strxcpyx.c
index 6542c0abf5..6542c0abf5 100644
--- a/src/shared/strxcpyx.c
+++ b/src/basic/strxcpyx.c
diff --git a/src/shared/strxcpyx.h b/src/basic/strxcpyx.h
index ccc7e52f37..ccc7e52f37 100644
--- a/src/shared/strxcpyx.h
+++ b/src/basic/strxcpyx.h
diff --git a/src/shared/terminal-util.c b/src/basic/terminal-util.c
index 042b88f222..042b88f222 100644
--- a/src/shared/terminal-util.c
+++ b/src/basic/terminal-util.c
diff --git a/src/shared/terminal-util.h b/src/basic/terminal-util.h
index 188714f228..188714f228 100644
--- a/src/shared/terminal-util.h
+++ b/src/basic/terminal-util.h
diff --git a/src/shared/time-util.c b/src/basic/time-util.c
index 12f1b193be..12f1b193be 100644
--- a/src/shared/time-util.c
+++ b/src/basic/time-util.c
diff --git a/src/shared/time-util.h b/src/basic/time-util.h
index 7a64d454a0..7a64d454a0 100644
--- a/src/shared/time-util.h
+++ b/src/basic/time-util.h
diff --git a/src/shared/unaligned.h b/src/basic/unaligned.h
index d6181dd9a9..d6181dd9a9 100644
--- a/src/shared/unaligned.h
+++ b/src/basic/unaligned.h
diff --git a/src/shared/unit-name.c b/src/basic/unit-name.c
index bf52463d81..bf52463d81 100644
--- a/src/shared/unit-name.c
+++ b/src/basic/unit-name.c
diff --git a/src/shared/unit-name.h b/src/basic/unit-name.h
index b2043d0870..b2043d0870 100644
--- a/src/shared/unit-name.h
+++ b/src/basic/unit-name.h
diff --git a/src/shared/utf8.c b/src/basic/utf8.c
index 800884ffee..800884ffee 100644
--- a/src/shared/utf8.c
+++ b/src/basic/utf8.c
diff --git a/src/shared/utf8.h b/src/basic/utf8.h
index e745649f06..e745649f06 100644
--- a/src/shared/utf8.h
+++ b/src/basic/utf8.h
diff --git a/src/shared/util.c b/src/basic/util.c
index 311acbb349..6f6906f877 100644
--- a/src/shared/util.c
+++ b/src/basic/util.c
@@ -2301,8 +2301,8 @@ static int do_execute(char **directories, usec_t timeout, char *argv[]) {
         /* We fork this all off from a child process so that we can
          * somewhat cleanly make use of SIGALRM to set a time limit */
 
-        reset_all_signal_handlers();
-        reset_signal_mask();
+        (void) reset_all_signal_handlers();
+        (void) reset_signal_mask();
 
         assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
@@ -3344,8 +3344,8 @@ int fork_agent(pid_t *pid, const int except[], unsigned n_except, const char *pa
         /* Make sure we actually can kill the agent, if we need to, in
          * case somebody invoked us from a shell script that trapped
          * SIGTERM or so... */
-        reset_all_signal_handlers();
-        reset_signal_mask();
+        (void) reset_all_signal_handlers();
+        (void) reset_signal_mask();
 
         /* Check whether our parent died before we were able
          * to set the death signal and unblock the signals */
@@ -4932,7 +4932,7 @@ int bind_remount_recursive(const char *prefix, bool ro) {
                 while ((x = set_steal_first(todo))) {
 
                         r = set_consume(done, x);
-                        if (r == -EEXIST)
+                        if (r == -EEXIST || r == 0)
                                 continue;
                         if (r < 0)
                                 return r;
@@ -5520,7 +5520,7 @@ int openpt_in_namespace(pid_t pid, int flags) {
         if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
                 return -errno;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        CMSG_FOREACH(cmsg, &mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                         int *fds;
                         unsigned n_fds;
@@ -5908,7 +5908,7 @@ void cmsg_close_all(struct msghdr *mh) {
 
         assert(mh);
 
-        for (cmsg = CMSG_FIRSTHDR(mh); cmsg; cmsg = CMSG_NXTHDR(mh, cmsg))
+        CMSG_FOREACH(cmsg, mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS)
                         close_many((int*) CMSG_DATA(cmsg), (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int));
 }
diff --git a/src/shared/util.h b/src/basic/util.h
index 467ae234a0..467ae234a0 100644
--- a/src/shared/util.h
+++ b/src/basic/util.h
diff --git a/src/shared/verbs.c b/src/basic/verbs.c
index c7beccc2dc..c7beccc2dc 100644
--- a/src/shared/verbs.c
+++ b/src/basic/verbs.c
diff --git a/src/shared/verbs.h b/src/basic/verbs.h
index d59e4d59b8..d59e4d59b8 100644
--- a/src/shared/verbs.h
+++ b/src/basic/verbs.h
diff --git a/src/shared/virt.c b/src/basic/virt.c
index 1299a75ed5..1299a75ed5 100644
--- a/src/shared/virt.c
+++ b/src/basic/virt.c
diff --git a/src/shared/virt.h b/src/basic/virt.h
index 7194ab2bf7..7194ab2bf7 100644
--- a/src/shared/virt.h
+++ b/src/basic/virt.h
diff --git a/src/shared/xml.c b/src/basic/xml.c
index 15c629b188..15c629b188 100644
--- a/src/shared/xml.c
+++ b/src/basic/xml.c
diff --git a/src/shared/xml.h b/src/basic/xml.h
index b256b0ba10..b256b0ba10 100644
--- a/src/shared/xml.h
+++ b/src/basic/xml.h
diff --git a/src/cgtop/cgtop.c b/src/cgtop/cgtop.c
index a390cf3256..d630e35882 100644
--- a/src/cgtop/cgtop.c
+++ b/src/cgtop/cgtop.c
@@ -60,8 +60,9 @@ typedef struct Group {
 } Group;
 
 static unsigned arg_depth = 3;
-static unsigned arg_iterations = 0;
+static unsigned arg_iterations = (unsigned)-1;
 static bool arg_batch = false;
+static bool arg_raw = false;
 static usec_t arg_delay = 1*USEC_PER_SEC;
 
 static enum {
@@ -96,6 +97,16 @@ static void group_hashmap_free(Hashmap *h) {
         hashmap_free(h);
 }
 
+static const char *maybe_format_bytes(char *buf, size_t l, bool is_valid, off_t t) {
+        if (!is_valid)
+                return "-";
+        if (arg_raw) {
+                snprintf(buf, l, "%jd", t);
+                return buf;
+        }
+        return format_bytes(buf, l, t);
+}
+
 static int process(const char *controller, const char *path, Hashmap *a, Hashmap *b, unsigned iteration) {
         Group *g;
         int r;
@@ -270,11 +281,10 @@ static int process(const char *controller, const char *path, Hashmap *a, Hashmap
                         yr = rd - g->io_input;
                         yw = wr - g->io_output;
 
-                        if (yr > 0 || yw > 0) {
+                        if (g->io_input > 0 || g->io_output > 0) {
                                 g->io_input_bps = (yr * 1000000000ULL) / x;
                                 g->io_output_bps = (yw * 1000000000ULL) / x;
                                 g->io_valid = true;
-
                         }
                 }
 
@@ -532,18 +542,9 @@ static int display(Hashmap *a) {
                 } else
                         printf(" %*s", maxtcpu, format_timespan(buffer, sizeof(buffer), (nsec_t) (g->cpu_usage / NSEC_PER_USEC), 0));
 
-                if (g->memory_valid)
-                        printf(" %8s", format_bytes(buffer, sizeof(buffer), g->memory));
-                else
-                        fputs("        -", stdout);
-
-                if (g->io_valid) {
-                        printf(" %8s",
-                               format_bytes(buffer, sizeof(buffer), g->io_input_bps));
-                        printf(" %8s",
-                               format_bytes(buffer, sizeof(buffer), g->io_output_bps));
-                } else
-                        fputs("        -        -", stdout);
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->memory_valid, g->memory));
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->io_valid, g->io_input_bps));
+                printf(" %8s", maybe_format_bytes(buffer, sizeof(buffer), g->io_valid, g->io_output_bps));
 
                 putchar('\n');
         }
@@ -561,6 +562,7 @@ static void help(void) {
                "  -c                  Order by CPU load\n"
                "  -m                  Order by memory load\n"
                "  -i                  Order by IO load\n"
+               "  -r --raw            Provide raw (not human-readable) numbers\n"
                "     --cpu[=TYPE]     Show CPU usage as time or percentage (default)\n"
                "  -d --delay=DELAY    Delay between updates\n"
                "  -n --iterations=N   Run for N iterations before exiting\n"
@@ -583,6 +585,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "delay",      required_argument, NULL, 'd'         },
                 { "iterations", required_argument, NULL, 'n'         },
                 { "batch",      no_argument,       NULL, 'b'         },
+                { "raw",        no_argument,       NULL, 'r'         },
                 { "depth",      required_argument, NULL, ARG_DEPTH   },
                 { "cpu",        optional_argument, NULL, ARG_CPU_TYPE},
                 {}
@@ -594,7 +597,7 @@ static int parse_argv(int argc, char *argv[]) {
         assert(argc >= 1);
         assert(argv);
 
-        while ((c = getopt_long(argc, argv, "hptcmin:bd:", options, NULL)) >= 0)
+        while ((c = getopt_long(argc, argv, "hptcmin:brd:", options, NULL)) >= 0)
 
                 switch (c) {
 
@@ -649,6 +652,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_batch = true;
                         break;
 
+                case 'r':
+                        arg_raw = true;
+                        break;
+
                 case 'p':
                         arg_order = ORDER_PATH;
                         break;
@@ -707,8 +714,8 @@ int main(int argc, char *argv[]) {
 
         signal(SIGWINCH, columns_lines_cache_reset);
 
-        if (!on_tty())
-                arg_iterations = 1;
+        if (arg_iterations == (unsigned)-1)
+                arg_iterations = on_tty() ? 0 : 1;
 
         while (!quit) {
                 Hashmap *c;
@@ -741,6 +748,10 @@ int main(int argc, char *argv[]) {
                 if (arg_iterations && iteration >= arg_iterations)
                         break;
 
+                if (!on_tty()) /* non-TTY: Empty newline as delimiter between polls */
+                        fputs("\n", stdout);
+                fflush(stdout);
+
                 if (arg_batch) {
                         usleep(last_refresh + arg_delay - t);
                 } else {
@@ -754,8 +765,10 @@ int main(int argc, char *argv[]) {
                         }
                 }
 
-                fputs("\r \r", stdout);
-                fflush(stdout);
+                if (on_tty()) { /* TTY: Clear any user keystroke */
+                        fputs("\r \r", stdout);
+                        fflush(stdout);
+                }
 
                 if (arg_batch)
                         continue;
diff --git a/src/core/busname.c b/src/core/busname.c
index 11f3b98009..2085721546 100644
--- a/src/core/busname.c
+++ b/src/core/busname.c
@@ -125,7 +125,7 @@ static int busname_arm_timer(BusName *n) {
                 return sd_event_source_set_enabled(n->timer_event_source, SD_EVENT_ONESHOT);
         }
 
-        r =  sd_event_add_time(
+        r = sd_event_add_time(
                         UNIT(n)->manager->event,
                         &n->timer_event_source,
                         CLOCK_MONOTONIC,
@@ -408,8 +408,8 @@ static int busname_make_starter(BusName *n, pid_t *_pid) {
         if (pid == 0) {
                 int ret;
 
-                default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
-                ignore_signals(SIGPIPE, -1);
+                (void) default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
+                (void) ignore_signals(SIGPIPE, -1);
                 log_forget_fds();
 
                 r = bus_kernel_make_starter(n->starter_fd, n->name, n->activating, n->accept_fd, n->policy, n->policy_world);
diff --git a/src/core/execute.c b/src/core/execute.c
index 4120493bda..f13c6936e0 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -823,6 +823,7 @@ static int setup_pam(
 
         /* Block SIGTERM, so that we know that it won't get lost in
          * the child */
+
         if (sigemptyset(&ss) < 0 ||
             sigaddset(&ss, SIGTERM) < 0 ||
             sigprocmask(SIG_BLOCK, &ss, &old_ss) < 0)
@@ -857,6 +858,8 @@ static int setup_pam(
                 if (setresuid(uid, uid, uid) < 0)
                         log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
 
+                (void) ignore_signals(SIGPIPE, -1);
+
                 /* Wait until our parent died. This will only work if
                  * the above setresuid() succeeds, otherwise the kernel
                  * will not allow unprivileged parents kill their privileged
@@ -1324,11 +1327,11 @@ static int exec_child(
          * others we leave untouched because we set them to
          * SIG_DFL or a valid handler initially, both of which
          * will be demoted to SIG_DFL. */
-        default_signals(SIGNALS_CRASH_HANDLER,
-                        SIGNALS_IGNORE, -1);
+        (void) default_signals(SIGNALS_CRASH_HANDLER,
+                               SIGNALS_IGNORE, -1);
 
         if (context->ignore_sigpipe)
-                ignore_signals(SIGPIPE, -1);
+                (void) ignore_signals(SIGPIPE, -1);
 
         r = reset_signal_mask();
         if (r < 0) {
diff --git a/src/core/killall.c b/src/core/killall.c
index 6e85923581..2a9d72c901 100644
--- a/src/core/killall.c
+++ b/src/core/killall.c
@@ -158,6 +158,7 @@ static int killall(int sig, Set *pids, bool send_sighup) {
 
         while ((d = readdir(dir))) {
                 pid_t pid;
+                int r;
 
                 if (d->d_type != DT_DIR &&
                     d->d_type != DT_UNKNOWN)
@@ -177,8 +178,11 @@ static int killall(int sig, Set *pids, bool send_sighup) {
                 }
 
                 if (kill(pid, sig) >= 0) {
-                        if (pids)
-                                set_put(pids, ULONG_TO_PTR(pid));
+                        if (pids) {
+                                r = set_put(pids, ULONG_TO_PTR(pid));
+                                if (r < 0)
+                                        log_oom();
+                        }
                 } else if (errno != ENOENT)
                         log_warning_errno(errno, "Could not kill %d: %m", pid);
 
diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index 96379058a1..d956f9b190 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -53,26 +53,27 @@ int kmod_setup(void) {
         static const struct {
                 const char *module;
                 const char *path;
-                bool warn;
+                bool warn_if_unavailable:1;
+                bool warn_if_module:1;
                 bool (*condition_fn)(void);
         } kmod_table[] = {
                 /* auto-loading on use doesn't work before udev is up */
-                { "autofs4",   "/sys/class/misc/autofs",    true,  NULL                },
+                { "autofs4",   "/sys/class/misc/autofs",    true,   false,   NULL      },
 
                 /* early configure of ::1 on the loopback device */
-                { "ipv6",      "/sys/module/ipv6",          false,  NULL               },
+                { "ipv6",      "/sys/module/ipv6",          false,  true,    NULL      },
 
                 /* this should never be a module */
-                { "unix",      "/proc/net/unix",            true,  NULL                },
+                { "unix",      "/proc/net/unix",            true,   true,    NULL      },
 
 #ifdef ENABLE_KDBUS
                 /* IPC is needed before we bring up any other services */
-                { "kdbus",     "/sys/fs/kdbus",             false, is_kdbus_wanted     },
+                { "kdbus",     "/sys/fs/kdbus",             false,  false,   is_kdbus_wanted },
 #endif
 
 #ifdef HAVE_LIBIPTC
                 /* netfilter is needed by networkd, nspawn among others, and cannot be autoloaded */
-                { "ip_tables", "/proc/net/ip_tables_names", false, NULL                },
+                { "ip_tables", "/proc/net/ip_tables_names", false,  false,   NULL      },
 #endif
         };
         struct kmod_ctx *ctx = NULL;
@@ -91,7 +92,7 @@ int kmod_setup(void) {
                 if (kmod_table[i].condition_fn && !kmod_table[i].condition_fn())
                         continue;
 
-                if (kmod_table[i].warn)
+                if (kmod_table[i].warn_if_module)
                         log_debug("Your kernel apparently lacks built-in %s support. Might be "
                                   "a good idea to compile it in. We'll now try to work around "
                                   "this by loading the module...", kmod_table[i].module);
@@ -116,8 +117,10 @@ int kmod_setup(void) {
                         log_info("Inserted module '%s'", kmod_module_get_name(mod));
                 else if (r == KMOD_PROBE_APPLY_BLACKLIST)
                         log_info("Module '%s' is blacklisted", kmod_module_get_name(mod));
-                else if (kmod_table[i].warn)
-                        log_error("Failed to insert module '%s'", kmod_module_get_name(mod));
+                else
+                        log_full_errno((kmod_table[i].warn_if_unavailable || (r < 0 && r != -ENOENT)) ? LOG_WARNING : LOG_DEBUG,
+                                       r,
+                                       "Failed to insert module '%s': %m", kmod_module_get_name(mod));
 
                 kmod_module_unref(mod);
         }
diff --git a/src/core/main.c b/src/core/main.c
index 29ccff7b63..332453a0ea 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1405,9 +1405,8 @@ int main(int argc, char *argv[]) {
         }
 
         /* Reset all signal handlers. */
-        assert_se(reset_all_signal_handlers() == 0);
-
-        ignore_signals(SIGNALS_IGNORE, -1);
+        (void) reset_all_signal_handlers();
+        (void) ignore_signals(SIGNALS_IGNORE, -1);
 
         if (parse_config_file() < 0) {
                 error_message = "Failed to parse config file";
@@ -1931,8 +1930,8 @@ finish:
 
                 /* Reenable any blocked signals, especially important
                  * if we switch from initial ramdisk to init=... */
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
 
                 if (switch_root_init) {
                         args[0] = switch_root_init;
diff --git a/src/core/manager.c b/src/core/manager.c
index a1c54339ea..eb80dd1b46 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -665,7 +665,7 @@ static int manager_setup_notify(Manager *m) {
 
         if (m->notify_fd < 0) {
                 _cleanup_close_ int fd = -1;
-                union sockaddr_union sa =  {
+                union sockaddr_union sa = {
                         .sa.sa_family = AF_UNIX,
                 };
                 static const int one = 1;
@@ -1546,7 +1546,7 @@ static int manager_dispatch_notify_fd(sd_event_source *source, int fd, uint32_t
                         return -errno;
                 }
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+                CMSG_FOREACH(cmsg, &msghdr) {
                         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
 
                                 fd_array = (int*) CMSG_DATA(cmsg);
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 01a817bf23..045321e1d4 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -696,12 +696,11 @@ int setup_netns(int netns_storage_socket[2]) {
         } else {
                 /* Yay, found something, so let's join the namespace */
 
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                                 assert(cmsg->cmsg_len == CMSG_LEN(sizeof(int)));
                                 netns = *(int*) CMSG_DATA(cmsg);
                         }
-                }
 
                 if (setns(netns, CLONE_NEWNET) < 0) {
                         r = -errno;
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 5e9a4a5e02..decd42f95a 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -261,7 +261,7 @@ int mac_selinux_generic_access_check(
         audit_info.path = path;
         audit_info.cmdline = cl;
 
-        r = selinux_check_access((security_context_t) scon, fcon, tclass, permission, &audit_info);
+        r = selinux_check_access(scon, fcon, tclass, permission, &audit_info);
         if (r < 0)
                 r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "SELinux policy denies access.");
 
diff --git a/src/core/service.c b/src/core/service.c
index c7e65772ea..71252e29e2 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -2008,6 +2008,7 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
                 unit_serialize_item_format(u, f, "main-pid", PID_FMT, s->main_pid);
 
         unit_serialize_item(u, f, "main-pid-known", yes_no(s->main_pid_known));
+        unit_serialize_item(u, f, "bus-name-good", yes_no(s->bus_name_good));
 
         if (s->status_text) {
                 _cleanup_free_ char *c = NULL;
@@ -2131,6 +2132,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
                         log_unit_debug(u, "Failed to parse main-pid-known value: %s", value);
                 else
                         s->main_pid_known = b;
+        } else if (streq(key, "bus-name-good")) {
+                int b;
+
+                b = parse_boolean(value);
+                if (b < 0)
+                        log_unit_debug(u, "Failed to parse bus-name-good value: %s", value);
+                else
+                        s->bus_name_good = b;
         } else if (streq(key, "status-text")) {
                 char *t;
 
diff --git a/src/core/socket.c b/src/core/socket.c
index fc5eb1464a..d3178e642b 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -832,7 +832,7 @@ static void socket_apply_socket_options(Socket *s, int fd) {
         }
 
         if (s->keep_alive_interval) {
-                int value =  s->keep_alive_interval / USEC_PER_SEC;
+                int value = s->keep_alive_interval / USEC_PER_SEC;
                 if (setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &value, sizeof(value)) < 0)
                         log_unit_warning_errno(UNIT(s), errno, "TCP_KEEPINTVL failed: %m");
         }
@@ -1473,8 +1473,8 @@ static int socket_chown(Socket *s, pid_t *_pid) {
                 gid_t gid = GID_INVALID;
                 int ret;
 
-                default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
-                ignore_signals(SIGPIPE, -1);
+                (void) default_signals(SIGNALS_CRASH_HANDLER, SIGNALS_IGNORE, -1);
+                (void) ignore_signals(SIGPIPE, -1);
                 log_forget_fds();
 
                 if (!isempty(s->user)) {
@@ -2589,7 +2589,7 @@ static void socket_trigger_notify(Unit *u, Unit *other) {
 
         /* Don't propagate state changes from the service if we are
            already down or accepting connections */
-        if ((s->state !=  SOCKET_RUNNING &&
+        if ((s->state != SOCKET_RUNNING &&
             s->state != SOCKET_LISTENING) ||
             s->accept)
                 return;
diff --git a/src/core/unit.c b/src/core/unit.c
index e380276d49..7bb2afc9f2 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2596,6 +2596,7 @@ int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs) {
 
         if (u->cgroup_path)
                 unit_serialize_item(u, f, "cgroup", u->cgroup_path);
+        unit_serialize_item(u, f, "cgroup-realized", yes_no(u->cgroup_realized));
 
         if (serialize_jobs) {
                 if (u->job) {
@@ -2806,6 +2807,16 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
                                 log_unit_debug_errno(u, r, "Failed to set cgroup path %s, ignoring: %m", v);
 
                         continue;
+                } else if (streq(l, "cgroup-realized")) {
+                        int b;
+
+                        b = parse_boolean(v);
+                        if (b < 0)
+                                log_unit_debug(u, "Failed to parse cgroup-realized bool %s, ignoring.", v);
+                        else
+                                u->cgroup_realized = b;
+
+                        continue;
                 }
 
                 if (unit_can_serialize(u)) {
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index a5018f13ed..5c6c7c0ed8 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -238,6 +238,23 @@ static void log_glue(int level, const char *msg, void *usrptr) {
         log_debug("%s", msg);
 }
 
+static int disk_major_minor(const char *path, char **ret) {
+        struct stat st;
+
+        assert(path);
+
+        if (stat(path, &st) < 0)
+                return -errno;
+
+        if (!S_ISBLK(st.st_mode))
+                return -EINVAL;
+
+        if (asprintf(ret, "/dev/block/%d:%d", major(st.st_rdev), minor(st.st_rdev)) < 0)
+                return -errno;
+
+        return 0;
+}
+
 static char* disk_description(const char *path) {
 
         static const char name_fields[] =
@@ -295,20 +312,55 @@ static char *disk_mount_point(const char *label) {
         return NULL;
 }
 
-static int get_password(const char *name, usec_t until, bool accept_cached, char ***passwords) {
-        int r;
+static int get_password(const char *vol, const char *src, usec_t until, bool accept_cached, char ***passwords) {
+        int r = 0;
         char **p;
         _cleanup_free_ char *text = NULL;
         _cleanup_free_ char *escaped_name = NULL;
         char *id;
+        const char *name = NULL;
+        _cleanup_free_ char *description = NULL, *name_buffer = NULL,
+                *mount_point = NULL, *maj_min = NULL;
 
-        assert(name);
+        assert(vol);
+        assert(src);
         assert(passwords);
 
+        description = disk_description(src);
+        mount_point = disk_mount_point(vol);
+
+        if (description && streq(vol, description)) {
+                /* If the description string is simply the
+                 * volume name, then let's not show this
+                 * twice */
+                free(description);
+                description = NULL;
+        }
+
+        if (mount_point && description)
+                r = asprintf(&name_buffer, "%s (%s) on %s", description, vol, mount_point);
+        else if (mount_point)
+                r = asprintf(&name_buffer, "%s on %s", vol, mount_point);
+        else if (description)
+                r = asprintf(&name_buffer, "%s (%s)", description, vol);
+
+        if (r < 0)
+                return log_oom();
+
+        name = name_buffer ? name_buffer : vol;
+
         if (asprintf(&text, "Please enter passphrase for disk %s!", name) < 0)
                 return log_oom();
 
-        escaped_name = cescape(name);
+        if (src)
+                (void) disk_major_minor(src, &maj_min);
+
+        if (maj_min) {
+                escaped_name = maj_min;
+                maj_min = NULL;
+        } else
+                escaped_name = cescape(name);
+
         if (!escaped_name)
                 return log_oom();
 
@@ -552,8 +604,7 @@ int main(int argc, char *argv[]) {
                 unsigned tries;
                 usec_t until;
                 crypt_status_info status;
-                const char *key_file = NULL, *name = NULL;
-                _cleanup_free_ char *description = NULL, *name_buffer = NULL, *mount_point = NULL;
+                const char *key_file = NULL;
 
                 /* Arguments: systemd-cryptsetup attach VOLUME SOURCE-DEVICE [PASSWORD] [OPTIONS] */
 
@@ -581,31 +632,6 @@ int main(int argc, char *argv[]) {
                 /* A delicious drop of snake oil */
                 mlockall(MCL_FUTURE);
 
-                description = disk_description(argv[3]);
-                mount_point = disk_mount_point(argv[2]);
-
-                if (description && streq(argv[2], description)) {
-                        /* If the description string is simply the
-                         * volume name, then let's not show this
-                         * twice */
-                        free(description);
-                        description = NULL;
-                }
-
-                k = 0;
-                if (mount_point && description)
-                        k = asprintf(&name_buffer, "%s (%s) on %s", description, argv[2], mount_point);
-                else if (mount_point)
-                        k = asprintf(&name_buffer, "%s on %s", argv[2], mount_point);
-                else if (description)
-                        k = asprintf(&name_buffer, "%s (%s)", description, argv[2]);
-
-                if (k < 0) {
-                        log_oom();
-                        goto finish;
-                }
-                name = name_buffer ? name_buffer : argv[2];
-
                 if (arg_header) {
                         log_debug("LUKS header: %s", arg_header);
                         k = crypt_init(&cd, arg_header);
@@ -652,7 +678,7 @@ int main(int argc, char *argv[]) {
                         _cleanup_strv_free_ char **passwords = NULL;
 
                         if (!key_file) {
-                                k = get_password(name, until, tries == 0 && !arg_verify, &passwords);
+                                k = get_password(argv[2], argv[3], until, tries == 0 && !arg_verify, &passwords);
                                 if (k == -EAGAIN)
                                         continue;
                                 else if (k < 0)
diff --git a/src/delta/delta.c b/src/delta/delta.c
index c764bb4b46..b60aaef734 100644
--- a/src/delta/delta.c
+++ b/src/delta/delta.c
@@ -24,6 +24,7 @@
 #include <string.h>
 #include <unistd.h>
 #include <getopt.h>
+#include <sys/prctl.h>
 
 #include "hashmap.h"
 #include "util.h"
@@ -34,6 +35,7 @@
 #include "strv.h"
 #include "process-util.h"
 #include "terminal-util.h"
+#include "signal-util.h"
 
 static const char prefixes[] =
         "/etc\0"
@@ -189,9 +191,14 @@ static int found_override(const char *top, const char *bottom) {
         if (pid < 0)
                 return log_error_errno(errno, "Failed to fork off diff: %m");
         else if (pid == 0) {
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+                assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
+
                 execlp("diff", "diff", "-us", "--", bottom, top, NULL);
                 log_error_errno(errno, "Failed to execute diff: %m");
-                _exit(1);
+                _exit(EXIT_FAILURE);
         }
 
         wait_for_terminate_and_warn("diff", pid, false);
diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
index f0e5c5f239..30254b6680 100644
--- a/src/fsck/fsck.c
+++ b/src/fsck/fsck.c
@@ -394,8 +394,8 @@ int main(int argc, char *argv[]) {
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 /* Close the reading side of the progress pipe */
diff --git a/src/import/export.c b/src/import/export.c
index d4bc88e010..e563bee96e 100644
--- a/src/import/export.c
+++ b/src/import/export.c
@@ -311,7 +311,7 @@ int main(int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
-        ignore_signals(SIGPIPE, -1);
+        (void) ignore_signals(SIGPIPE, -1);
 
         r = export_main(argc, argv);
 
diff --git a/src/import/import-common.c b/src/import/import-common.c
index 9711614000..950c7b4acd 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -97,8 +97,8 @@ int import_fork_tar_x(const char *path, pid_t *ret) {
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 pipefd[1] = safe_close(pipefd[1]);
@@ -171,8 +171,8 @@ int import_fork_tar_c(const char *path, pid_t *ret) {
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 pipefd[0] = safe_close(pipefd[0]);
diff --git a/src/import/import.c b/src/import/import.c
index fff5a104b1..3091ed1c45 100644
--- a/src/import/import.c
+++ b/src/import/import.c
@@ -328,7 +328,7 @@ int main(int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
-        ignore_signals(SIGPIPE, -1);
+        (void) ignore_signals(SIGPIPE, -1);
 
         r = import_main(argc, argv);
 
diff --git a/src/import/importd.c b/src/import/importd.c
index 50566a6e5c..05a619ac0c 100644
--- a/src/import/importd.c
+++ b/src/import/importd.c
@@ -390,8 +390,8 @@ static int transfer_start(Transfer *t) {
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 pipefd[0] = safe_close(pipefd[0]);
@@ -599,7 +599,7 @@ static int manager_on_notify(sd_event_source *s, int fd, uint32_t revents, void
 
         cmsg_close_all(&msghdr);
 
-        for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+        CMSG_FOREACH(cmsg, &msghdr) {
                 if (cmsg->cmsg_level == SOL_SOCKET &&
                            cmsg->cmsg_type == SCM_CREDENTIALS &&
                            cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
diff --git a/src/import/pull-common.c b/src/import/pull-common.c
index d2588d4fa0..652277e4be 100644
--- a/src/import/pull-common.c
+++ b/src/import/pull-common.c
@@ -339,8 +339,8 @@ int pull_verify(
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 gpg_pipe[1] = safe_close(gpg_pipe[1]);
diff --git a/src/import/pull.c b/src/import/pull.c
index eec4583868..03fe3dcaf4 100644
--- a/src/import/pull.c
+++ b/src/import/pull.c
@@ -440,7 +440,7 @@ int main(int argc, char *argv[]) {
         if (r <= 0)
                 goto finish;
 
-        ignore_signals(SIGPIPE, -1);
+        (void) ignore_signals(SIGPIPE, -1);
 
         r = pull_main(argc, argv);
 
diff --git a/src/journal-remote/journal-remote.c b/src/journal-remote/journal-remote.c
index 911e2a178b..ae332d826f 100644
--- a/src/journal-remote/journal-remote.c
+++ b/src/journal-remote/journal-remote.c
@@ -96,6 +96,10 @@ static int spawn_child(const char* child, char** argv) {
 
         /* In the child */
         if (child_pid == 0) {
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 r = dup2(fd[1], STDOUT_FILENO);
                 if (r < 0) {
                         log_error_errno(errno, "Failed to dup pipe to stdout: %m");
diff --git a/src/journal/coredumpctl.c b/src/journal/coredumpctl.c
index 381bf72776..fc49b2e174 100644
--- a/src/journal/coredumpctl.c
+++ b/src/journal/coredumpctl.c
@@ -757,6 +757,9 @@ static int run_gdb(sd_journal *j) {
                 goto finish;
         }
         if (pid == 0) {
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 execlp("gdb", "gdb", exe, path, NULL);
 
                 log_error_errno(errno, "Failed to invoke gdb: %m");
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 3353024f4e..d0d670f36e 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -1104,6 +1104,42 @@ finish:
 
 int server_process_datagram(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
         Server *s = userdata;
+        struct ucred *ucred = NULL;
+        struct timeval *tv = NULL;
+        struct cmsghdr *cmsg;
+        char *label = NULL;
+        size_t label_len = 0, m;
+        struct iovec iovec;
+        ssize_t n;
+        int *fds = NULL, v = 0;
+        unsigned n_fds = 0;
+
+        union {
+                struct cmsghdr cmsghdr;
+
+                /* We use NAME_MAX space for the SELinux label
+                 * here. The kernel currently enforces no
+                 * limit, but according to suggestions from
+                 * the SELinux people this will change and it
+                 * will probably be identical to NAME_MAX. For
+                 * now we use that, but this should be updated
+                 * one day when the final limit is known. */
+                uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
+                            CMSG_SPACE(sizeof(struct timeval)) +
+                            CMSG_SPACE(sizeof(int)) + /* fd */
+                            CMSG_SPACE(NAME_MAX)]; /* selinux label */
+        } control = {};
+
+        union sockaddr_union sa = {};
+
+        struct msghdr msghdr = {
+                .msg_iov = &iovec,
+                .msg_iovlen = 1,
+                .msg_control = &control,
+                .msg_controllen = sizeof(control),
+                .msg_name = &sa,
+                .msg_namelen = sizeof(sa),
+        };
 
         assert(s);
         assert(fd == s->native_fd || fd == s->syslog_fd || fd == s->audit_fd);
@@ -1113,119 +1149,79 @@ int server_process_datagram(sd_event_source *es, int fd, uint32_t revents, void
                 return -EIO;
         }
 
-        for (;;) {
-                struct ucred *ucred = NULL;
-                struct timeval *tv = NULL;
-                struct cmsghdr *cmsg;
-                char *label = NULL;
-                size_t label_len = 0;
-                struct iovec iovec;
-
-                union {
-                        struct cmsghdr cmsghdr;
-
-                        /* We use NAME_MAX space for the SELinux label
-                         * here. The kernel currently enforces no
-                         * limit, but according to suggestions from
-                         * the SELinux people this will change and it
-                         * will probably be identical to NAME_MAX. For
-                         * now we use that, but this should be updated
-                         * one day when the final limit is known. */
-                        uint8_t buf[CMSG_SPACE(sizeof(struct ucred)) +
-                                    CMSG_SPACE(sizeof(struct timeval)) +
-                                    CMSG_SPACE(sizeof(int)) + /* fd */
-                                    CMSG_SPACE(NAME_MAX)]; /* selinux label */
-                } control = {};
-                union sockaddr_union sa = {};
-                struct msghdr msghdr = {
-                        .msg_iov = &iovec,
-                        .msg_iovlen = 1,
-                        .msg_control = &control,
-                        .msg_controllen = sizeof(control),
-                        .msg_name = &sa,
-                        .msg_namelen = sizeof(sa),
-                };
-
-                ssize_t n;
-                int *fds = NULL;
-                unsigned n_fds = 0;
-                int v = 0;
-                size_t m;
-
-                /* Try to get the right size, if we can. (Not all
-                 * sockets support SIOCINQ, hence we just try, but
-                 * don't rely on it. */
-                (void) ioctl(fd, SIOCINQ, &v);
-
-                /* Fix it up, if it is too small. We use the same fixed value as auditd here. Awful! */
-                m = PAGE_ALIGN(MAX3((size_t) v + 1,
-                                    (size_t) LINE_MAX,
-                                    ALIGN(sizeof(struct nlmsghdr)) + ALIGN((size_t) MAX_AUDIT_MESSAGE_LENGTH)) + 1);
-
-                if (!GREEDY_REALLOC(s->buffer, s->buffer_size, m))
-                        return log_oom();
-
-                iovec.iov_base = s->buffer;
-                iovec.iov_len = s->buffer_size - 1; /* Leave room for trailing NUL we add later */
-
-                n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
-                if (n < 0) {
-                        if (errno == EINTR || errno == EAGAIN)
-                                return 0;
-
-                        log_error_errno(errno, "recvmsg() failed: %m");
-                        return -errno;
-                }
+        /* Try to get the right size, if we can. (Not all
+         * sockets support SIOCINQ, hence we just try, but
+         * don't rely on it. */
+        (void) ioctl(fd, SIOCINQ, &v);
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
-
-                        if (cmsg->cmsg_level == SOL_SOCKET &&
-                            cmsg->cmsg_type == SCM_CREDENTIALS &&
-                            cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))
-                                ucred = (struct ucred*) CMSG_DATA(cmsg);
-                        else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                 cmsg->cmsg_type == SCM_SECURITY) {
-                                label = (char*) CMSG_DATA(cmsg);
-                                label_len = cmsg->cmsg_len - CMSG_LEN(0);
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SO_TIMESTAMP &&
-                                   cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
-                                tv = (struct timeval*) CMSG_DATA(cmsg);
-                        else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                 cmsg->cmsg_type == SCM_RIGHTS) {
-                                fds = (int*) CMSG_DATA(cmsg);
-                                n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
-                        }
-                }
+        /* Fix it up, if it is too small. We use the same fixed value as auditd here. Awful! */
+        m = PAGE_ALIGN(MAX3((size_t) v + 1,
+                            (size_t) LINE_MAX,
+                            ALIGN(sizeof(struct nlmsghdr)) + ALIGN((size_t) MAX_AUDIT_MESSAGE_LENGTH)) + 1);
 
-                /* And a trailing NUL, just in case */
-                s->buffer[n] = 0;
+        if (!GREEDY_REALLOC(s->buffer, s->buffer_size, m))
+                return log_oom();
 
-                if (fd == s->syslog_fd) {
-                        if (n > 0 && n_fds == 0)
-                                server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
-                        else if (n_fds > 0)
-                                log_warning("Got file descriptors via syslog socket. Ignoring.");
+        iovec.iov_base = s->buffer;
+        iovec.iov_len = s->buffer_size - 1; /* Leave room for trailing NUL we add later */
 
-                } else if (fd == s->native_fd) {
-                        if (n > 0 && n_fds == 0)
-                                server_process_native_message(s, s->buffer, n, ucred, tv, label, label_len);
-                        else if (n == 0 && n_fds == 1)
-                                server_process_native_file(s, fds[0], ucred, tv, label, label_len);
-                        else if (n_fds > 0)
-                                log_warning("Got too many file descriptors via native socket. Ignoring.");
+        n = recvmsg(fd, &msghdr, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
+        if (n < 0) {
+                if (errno == EINTR || errno == EAGAIN)
+                        return 0;
 
-                } else {
-                        assert(fd == s->audit_fd);
+                return log_error_errno(errno, "recvmsg() failed: %m");
+        }
 
-                        if (n > 0 && n_fds == 0)
-                                server_process_audit_message(s, s->buffer, n, ucred, &sa, msghdr.msg_namelen);
-                        else if (n_fds > 0)
-                                log_warning("Got file descriptors via audit socket. Ignoring.");
+        CMSG_FOREACH(cmsg, &msghdr) {
+
+                if (cmsg->cmsg_level == SOL_SOCKET &&
+                    cmsg->cmsg_type == SCM_CREDENTIALS &&
+                    cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))
+                        ucred = (struct ucred*) CMSG_DATA(cmsg);
+                else if (cmsg->cmsg_level == SOL_SOCKET &&
+                         cmsg->cmsg_type == SCM_SECURITY) {
+                        label = (char*) CMSG_DATA(cmsg);
+                        label_len = cmsg->cmsg_len - CMSG_LEN(0);
+                } else if (cmsg->cmsg_level == SOL_SOCKET &&
+                           cmsg->cmsg_type == SO_TIMESTAMP &&
+                           cmsg->cmsg_len == CMSG_LEN(sizeof(struct timeval)))
+                        tv = (struct timeval*) CMSG_DATA(cmsg);
+                else if (cmsg->cmsg_level == SOL_SOCKET &&
+                         cmsg->cmsg_type == SCM_RIGHTS) {
+                        fds = (int*) CMSG_DATA(cmsg);
+                        n_fds = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
                 }
+        }
+
+        /* And a trailing NUL, just in case */
+        s->buffer[n] = 0;
+
+        if (fd == s->syslog_fd) {
+                if (n > 0 && n_fds == 0)
+                        server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
+                else if (n_fds > 0)
+                        log_warning("Got file descriptors via syslog socket. Ignoring.");
+
+        } else if (fd == s->native_fd) {
+                if (n > 0 && n_fds == 0)
+                        server_process_native_message(s, s->buffer, n, ucred, tv, label, label_len);
+                else if (n == 0 && n_fds == 1)
+                        server_process_native_file(s, fds[0], ucred, tv, label, label_len);
+                else if (n_fds > 0)
+                        log_warning("Got too many file descriptors via native socket. Ignoring.");
 
-                close_many(fds, n_fds);
+        } else {
+                assert(fd == s->audit_fd);
+
+                if (n > 0 && n_fds == 0)
+                        server_process_audit_message(s, s->buffer, n, ucred, &sa, msghdr.msg_namelen);
+                else if (n_fds > 0)
+                        log_warning("Got file descriptors via audit socket. Ignoring.");
         }
+
+        close_many(fds, n_fds);
+        return 0;
 }
 
 static int dispatch_sigusr1(sd_event_source *es, const struct signalfd_siginfo *si, void *userdata) {
diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c
index b572147a56..db2f581972 100644
--- a/src/journal/journald-stream.c
+++ b/src/journal/journald-stream.c
@@ -59,10 +59,7 @@ struct StdoutStream {
         int fd;
 
         struct ucred ucred;
-#ifdef HAVE_SELINUX
-        security_context_t security_context;
-#endif
-
+        char *label;
         char *identifier;
         char *unit_id;
         int priority;
@@ -99,12 +96,7 @@ void stdout_stream_free(StdoutStream *s) {
         }
 
         safe_close(s->fd);
-
-#ifdef HAVE_SELINUX
-        if (s->security_context)
-                freecon(s->security_context);
-#endif
-
+        free(s->label);
         free(s->identifier);
         free(s->unit_id);
         free(s->state_file);
@@ -225,8 +217,7 @@ static int stdout_stream_log(StdoutStream *s, const char *p) {
         char syslog_facility[sizeof("SYSLOG_FACILITY=")-1 + DECIMAL_STR_MAX(int) + 1];
         _cleanup_free_ char *message = NULL, *syslog_identifier = NULL;
         unsigned n = 0;
-        char *label = NULL;
-        size_t label_len = 0;
+        size_t label_len;
 
         assert(s);
         assert(p);
@@ -271,14 +262,8 @@ static int stdout_stream_log(StdoutStream *s, const char *p) {
         if (message)
                 IOVEC_SET_STRING(iovec[n++], message);
 
-#ifdef HAVE_SELINUX
-        if (s->security_context) {
-                label = (char*) s->security_context;
-                label_len = strlen((char*) s->security_context);
-        }
-#endif
-
-        server_dispatch_message(s->server, iovec, n, ELEMENTSOF(iovec), &s->ucred, NULL, label, label_len, s->unit_id, priority, 0);
+        label_len = s->label ? strlen(s->label) : 0;
+        server_dispatch_message(s->server, iovec, n, ELEMENTSOF(iovec), &s->ucred, NULL, s->label, label_len, s->unit_id, priority, 0);
         return 0;
 }
 
@@ -489,12 +474,11 @@ static int stdout_stream_install(Server *s, int fd, StdoutStream **ret) {
         if (r < 0)
                 return log_error_errno(r, "Failed to determine peer credentials: %m");
 
-#ifdef HAVE_SELINUX
         if (mac_selinux_use()) {
-                if (getpeercon(fd, &stream->security_context) < 0 && errno != ENOPROTOOPT)
-                        log_error_errno(errno, "Failed to determine peer security context: %m");
+                r = getpeersec(fd, &stream->label);
+                if (r < 0 && r != -EOPNOTSUPP)
+                        (void) log_warning_errno(r, "Failed to determine peer security context: %m");
         }
-#endif
 
         (void) shutdown(fd, SHUT_WR);
 
diff --git a/src/libsystemd-network/lldp-tlv.c b/src/libsystemd-network/lldp-tlv.c
index e32783f3eb..0cea5b10a6 100644
--- a/src/libsystemd-network/lldp-tlv.c
+++ b/src/libsystemd-network/lldp-tlv.c
@@ -221,7 +221,7 @@ int tlv_packet_read_string(tlv_packet *m, char **data, uint16_t *data_length) {
                 return r;
 
         *data = (char *) val;
-        *data_length =  m->container->length;
+        *data_length = m->container->length;
 
         m->container->read_pos += m->container->length;
 
diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c
index 0193e42d65..6853038b67 100644
--- a/src/libsystemd-network/sd-dhcp-client.c
+++ b/src/libsystemd-network/sd-dhcp-client.c
@@ -1588,7 +1588,7 @@ static int client_receive_message_raw(sd_event_source *s, int fd,
         } else if ((size_t)len < sizeof(DHCPPacket))
                 return 0;
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        CMSG_FOREACH(cmsg, &msg) {
                 if (cmsg->cmsg_level == SOL_PACKET &&
                     cmsg->cmsg_type == PACKET_AUXDATA &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(struct tpacket_auxdata))) {
diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
index 8a4220621b..d8bc76edda 100644
--- a/src/libsystemd-network/sd-dhcp-lease.c
+++ b/src/libsystemd-network/sd-dhcp-lease.c
@@ -32,6 +32,7 @@
 #include "dhcp-lease-internal.h"
 #include "sd-dhcp-lease.h"
 #include "network-internal.h"
+#include "dns-domain.h"
 
 int sd_dhcp_lease_get_address(sd_dhcp_lease *lease, struct in_addr *addr) {
         assert_return(lease, -EINVAL);
@@ -504,9 +505,18 @@ int dhcp_lease_parse_options(uint8_t code, uint8_t len, const uint8_t *option,
                 if (e)
                         *e = 0;
 
-                if (!hostname_is_valid(domainname) || is_localhost(domainname))
+                if (is_localhost(domainname))
                         break;
 
+                r = dns_name_is_valid(domainname);
+                if (r <= 0) {
+                        if (r < 0)
+                                log_error_errno(r, "Failed to validate domain name: %s: %m", domainname);
+                        if (r == 0)
+                                log_warning("Domain name is not valid, ignoring: %s", domainname);
+                        break;
+                }
+
                 free(lease->domainname);
                 lease->domainname = domainname;
                 domainname = NULL;
diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index a0a2320efa..cc5e032344 100644
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -902,7 +902,7 @@ static int server_receive_message(sd_event_source *s, int fd,
         else if ((size_t)len < sizeof(DHCPMessage))
                 return 0;
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        CMSG_FOREACH(cmsg, &msg) {
                 if (cmsg->cmsg_level == IPPROTO_IP &&
                     cmsg->cmsg_type == IP_PKTINFO &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(struct in_pktinfo))) {
diff --git a/src/libsystemd-terminal/grdev-drm.c b/src/libsystemd-terminal/grdev-drm.c
index 4cee95f469..30c1a726eb 100644
--- a/src/libsystemd-terminal/grdev-drm.c
+++ b/src/libsystemd-terminal/grdev-drm.c
@@ -30,7 +30,7 @@
 #include <unistd.h>
 
 /* Yuck! DRM headers need system headers included first.. but we have to
- * include it before shared/missing.h to avoid redefining ioctl bits */
+ * include it before util/missing.h to avoid redefining ioctl bits */
 #include <drm.h>
 #include <drm_fourcc.h>
 #include <drm_mode.h>
diff --git a/src/libsystemd-terminal/grdev.c b/src/libsystemd-terminal/grdev.c
index c386e65982..71f0bd31e7 100644
--- a/src/libsystemd-terminal/grdev.c
+++ b/src/libsystemd-terminal/grdev.c
@@ -25,7 +25,7 @@
 #include "sd-bus.h"
 #include "sd-event.h"
 #include "hashmap.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "macro.h"
 #include "util.h"
 #include "grdev.h"
diff --git a/src/libsystemd-terminal/idev.c b/src/libsystemd-terminal/idev.c
index b187934977..b92a393b69 100644
--- a/src/libsystemd-terminal/idev.c
+++ b/src/libsystemd-terminal/idev.c
@@ -25,7 +25,7 @@
 #include "sd-bus.h"
 #include "sd-event.h"
 #include "hashmap.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "macro.h"
 #include "util.h"
 #include "idev.h"
diff --git a/src/libsystemd/libsystemd.sym.m4 b/src/libsystemd/libsystemd.sym.m4
index 0b94a87dd6..3121e71282 100644
--- a/src/libsystemd/libsystemd.sym.m4
+++ b/src/libsystemd/libsystemd.sym.m4
@@ -320,6 +320,7 @@ global:
         sd_bus_get_name_creds;
         sd_bus_get_name_machine_id;
         sd_bus_call_method;
+        sd_bus_call_method_async;
         sd_bus_get_property;
         sd_bus_get_property_trivial;
         sd_bus_get_property_string;
diff --git a/src/libsystemd/sd-bus/bus-bloom.c b/src/libsystemd/sd-bus/bus-bloom.c
index 3556774074..91fab90cb0 100644
--- a/src/libsystemd/sd-bus/bus-bloom.c
+++ b/src/libsystemd/sd-bus/bus-bloom.c
@@ -116,11 +116,19 @@ void bloom_add_prefixes(uint64_t filter[], size_t size, unsigned k, const char *
         p = stpcpy(stpcpy(c, a), ":");
         strcpy(p, b);
 
+        bloom_add_data(filter, size, k, c, n);
+
         for (;;) {
                 char *e;
 
                 e = strrchr(p, sep);
-                if (!e || e == p)
+                if (!e)
+                        break;
+
+                *(e + 1) = 0;
+                bloom_add_data(filter, size, k, c, e - c + 1);
+
+                if (e == p)
                         break;
 
                 *e = 0;
diff --git a/src/libsystemd/sd-bus/bus-container.c b/src/libsystemd/sd-bus/bus-container.c
index f157c25bba..fa7a207448 100644
--- a/src/libsystemd/sd-bus/bus-container.c
+++ b/src/libsystemd/sd-bus/bus-container.c
@@ -222,7 +222,7 @@ int bus_container_connect_kernel(sd_bus *b) {
         if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0)
                 return -errno;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
+        CMSG_FOREACH(cmsg, &mh)
                 if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
                         int *fds;
                         unsigned n_fds;
diff --git a/src/libsystemd/sd-bus/bus-control.c b/src/libsystemd/sd-bus/bus-control.c
index 43ddfc651d..7a59702cb2 100644
--- a/src/libsystemd/sd-bus/bus-control.c
+++ b/src/libsystemd/sd-bus/bus-control.c
@@ -979,8 +979,10 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
         _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
         pid_t pid = 0;
         int r;
+        bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
 
-        if (!bus->ucred_valid && !isempty(bus->label))
+        /* Avoid allocating anything if we have no chance of returning useful data */
+        if (!bus->ucred_valid && !do_label)
                 return -ENODATA;
 
         c = bus_creds_new();
@@ -1004,7 +1006,7 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
                 }
         }
 
-        if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
+        if (do_label) {
                 c->label = strdup(bus->label);
                 if (!c->label)
                         return -ENOMEM;
@@ -1289,10 +1291,8 @@ int bus_add_match_internal_kernel(
                         break;
 
                 case BUS_MATCH_PATH_NAMESPACE:
-                        if (!streq(c->value_str, "/")) {
-                                bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, "path-slash-prefix", c->value_str);
-                                using_bloom = true;
-                        }
+                        bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, "path-slash-prefix", c->value_str);
+                        using_bloom = true;
                         break;
 
                 case BUS_MATCH_ARG...BUS_MATCH_ARG_LAST: {
@@ -1308,11 +1308,18 @@ int bus_add_match_internal_kernel(
                 }
 
                 case BUS_MATCH_ARG_PATH...BUS_MATCH_ARG_PATH_LAST: {
-                        char buf[sizeof("arg")-1 + 2 + sizeof("-slash-prefix")];
-
-                        xsprintf(buf, "arg%i-slash-prefix", c->type - BUS_MATCH_ARG_PATH);
-                        bloom_add_pair(bloom, bus->bloom_size, bus->bloom_n_hash, buf, c->value_str);
-                        using_bloom = true;
+                        /*
+                         * XXX: DBus spec defines arg[0..63]path= matching to be
+                         * a two-way glob. That is, if either string is a prefix
+                         * of the other, it matches.
+                         * This is really hard to realize in bloom-filters, as
+                         * we would have to create a bloom-match for each prefix
+                         * of @c->value_str. This is excessive, hence we just
+                         * ignore all those matches and accept everything from
+                         * the kernel. People should really avoid those matches.
+                         * If they're used in real-life some day, we will have
+                         * to properly support multiple-matches here.
+                         */
                         break;
                 }
 
diff --git a/src/libsystemd/sd-bus/bus-convenience.c b/src/libsystemd/sd-bus/bus-convenience.c
index 28bc8d2818..dfd82e746d 100644
--- a/src/libsystemd/sd-bus/bus-convenience.c
+++ b/src/libsystemd/sd-bus/bus-convenience.c
@@ -58,6 +58,43 @@ _public_ int sd_bus_emit_signal(
         return sd_bus_send(bus, m, NULL);
 }
 
+_public_ int sd_bus_call_method_async(
+                sd_bus *bus,
+                sd_bus_slot **slot,
+                const char *destination,
+                const char *path,
+                const char *interface,
+                const char *member,
+                sd_bus_message_handler_t callback,
+                void *userdata,
+                const char *types, ...) {
+
+        _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
+        int r;
+
+        assert_return(bus, -EINVAL);
+        assert_return(!bus_pid_changed(bus), -ECHILD);
+
+        if (!BUS_IS_OPEN(bus->state))
+                return -ENOTCONN;
+
+        r = sd_bus_message_new_method_call(bus, &m, destination, path, interface, member);
+        if (r < 0)
+                return r;
+
+        if (!isempty(types)) {
+                va_list ap;
+
+                va_start(ap, types);
+                r = bus_message_append_ap(m, types, ap);
+                va_end(ap);
+                if (r < 0)
+                        return r;
+        }
+
+        return sd_bus_call_async(bus, slot, m, callback, userdata, 0);
+}
+
 _public_ int sd_bus_call_method(
                 sd_bus *bus,
                 const char *destination,
diff --git a/src/libsystemd/sd-bus/bus-creds.c b/src/libsystemd/sd-bus/bus-creds.c
index 4d67619cf8..1c365b7fcd 100644
--- a/src/libsystemd/sd-bus/bus-creds.c
+++ b/src/libsystemd/sd-bus/bus-creds.c
@@ -773,11 +773,13 @@ int bus_creds_add_more(sd_bus_creds *c, uint64_t mask, pid_t pid, pid_t tid) {
                 return 0;
 
         /* Try to retrieve PID from creds if it wasn't passed to us */
-        if (pid <= 0 && (c->mask & SD_BUS_CREDS_PID))
+        if (pid > 0) {
+                c->pid = pid;
+                c->mask |= SD_BUS_CREDS_PID;
+        } else if (c->mask & SD_BUS_CREDS_PID)
                 pid = c->pid;
-
-        /* Without pid we cannot do much... */
-        if (pid <= 0)
+        else
+                /* Without pid we cannot do much... */
                 return 0;
 
         /* Try to retrieve TID from creds if it wasn't passed to us */
@@ -789,9 +791,6 @@ int bus_creds_add_more(sd_bus_creds *c, uint64_t mask, pid_t pid, pid_t tid) {
         if (missing == 0)
                 return 0;
 
-        c->pid = pid;
-        c->mask |= SD_BUS_CREDS_PID;
-
         if (tid > 0) {
                 c->tid = tid;
                 c->mask |= SD_BUS_CREDS_TID;
diff --git a/src/libsystemd/sd-bus/bus-internal.c b/src/libsystemd/sd-bus/bus-internal.c
index 91b288cd25..fea796cd30 100644
--- a/src/libsystemd/sd-bus/bus-internal.c
+++ b/src/libsystemd/sd-bus/bus-internal.c
@@ -19,6 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "bus-message.h"
 #include "bus-internal.h"
 
 bool object_path_is_valid(const char *p) {
@@ -211,6 +212,17 @@ bool member_name_is_valid(const char *p) {
         return true;
 }
 
+/*
+ * Complex pattern match
+ * This checks whether @a is a 'complex-prefix' of @b, or @b is a
+ * 'complex-prefix' of @a, based on strings that consist of labels with @c as
+ * spearator. This function returns true if:
+ *   - both strings are equal
+ *   - either is a prefix of the other and ends with @c
+ * The second rule makes sure that either string needs to be fully included in
+ * the other, and the string which is considered the prefix needs to end with a
+ * separator.
+ */
 static bool complex_pattern_check(char c, const char *a, const char *b) {
         bool separator = false;
 
@@ -222,9 +234,7 @@ static bool complex_pattern_check(char c, const char *a, const char *b) {
 
         for (;;) {
                 if (*a != *b)
-                        return (separator && (*a == 0 || *b == 0)) ||
-                                (*a == 0 && *b == c && b[1] == 0) ||
-                                (*b == 0 && *a == c && a[1] == 0);
+                        return (separator && (*a == 0 || *b == 0));
 
                 if (*a == 0)
                         return true;
@@ -243,7 +253,18 @@ bool path_complex_pattern(const char *pattern, const char *value) {
         return complex_pattern_check('/', pattern, value);
 }
 
+/*
+ * Simple pattern match
+ * This checks whether @a is a 'simple-prefix' of @b, based on strings that
+ * consist of labels with @c as separator. This function returns true, if:
+ *   - if @a and @b are equal
+ *   - if @a is a prefix of @b, and the first following character in @b (or the
+ *     last character in @a) is @c
+ * The second rule basically makes sure that if @a is a prefix of @b, then @b
+ * must follow with a new label separated by @c. It cannot extend the label.
+ */
 static bool simple_pattern_check(char c, const char *a, const char *b) {
+        bool separator = false;
 
         if (!a && !b)
                 return true;
@@ -253,11 +274,13 @@ static bool simple_pattern_check(char c, const char *a, const char *b) {
 
         for (;;) {
                 if (*a != *b)
-                        return *a == 0 && *b == c;
+                        return *a == 0 && (*b == c || separator);
 
                 if (*a == 0)
                         return true;
 
+                separator = *a == c;
+
                 a++, b++;
         }
 }
@@ -323,3 +346,28 @@ char *bus_address_escape(const char *v) {
         *b = 0;
         return r;
 }
+
+int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error) {
+        assert(m);
+
+        if (r < 0) {
+                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
+                        sd_bus_reply_method_errno(m, r, error);
+
+        } else if (sd_bus_error_is_set(error)) {
+                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
+                        sd_bus_reply_method_error(m, error);
+        } else
+                return r;
+
+        log_debug("Failed to process message [type=%s sender=%s path=%s interface=%s member=%s signature=%s]: %s",
+                  bus_message_type_to_string(m->header->type),
+                  strna(m->sender),
+                  strna(m->path),
+                  strna(m->interface),
+                  strna(m->member),
+                  strna(m->root_container.signature),
+                  bus_error_message(error, r));
+
+        return 1;
+}
diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
index 1351938c80..88c058889a 100644
--- a/src/libsystemd/sd-bus/bus-internal.h
+++ b/src/libsystemd/sd-bus/bus-internal.h
@@ -261,7 +261,7 @@ struct sd_bus {
         usec_t auth_timeout;
 
         struct ucred ucred;
-        char label[NAME_MAX];
+        char *label;
 
         uint64_t creds_mask;
 
@@ -390,3 +390,5 @@ int bus_set_address_system_machine(sd_bus *b, const char *machine);
 int bus_remove_match_by_string(sd_bus *bus, const char *match, sd_bus_message_handler_t callback, void *userdata);
 
 int bus_get_root_path(sd_bus *bus);
+
+int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error);
diff --git a/src/libsystemd/sd-bus/bus-kernel.c b/src/libsystemd/sd-bus/bus-kernel.c
index 572a9c6e64..3aaaabf4ed 100644
--- a/src/libsystemd/sd-bus/bus-kernel.c
+++ b/src/libsystemd/sd-bus/bus-kernel.c
@@ -498,7 +498,6 @@ static int bus_kernel_make_message(sd_bus *bus, struct kdbus_msg *k) {
                         footer, footer_size,
                         n_bytes,
                         fds, n_fds,
-                        NULL,
                         seclabel, 0, &m);
         if (r < 0)
                 return r;
diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index 6ee209dd1b..c38b2a5fa5 100644
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -435,7 +435,6 @@ int bus_message_from_header(
                 size_t message_size,
                 int *fds,
                 unsigned n_fds,
-                const struct ucred *ucred,
                 const char *label,
                 size_t extra,
                 sd_bus_message **ret) {
@@ -528,23 +527,6 @@ int bus_message_from_header(
         m->fds = fds;
         m->n_fds = n_fds;
 
-        if (ucred) {
-                m->creds.pid = ucred->pid;
-                m->creds.euid = ucred->uid;
-                m->creds.egid = ucred->gid;
-
-                /* Due to namespace translations some data might be
-                 * missing from this ucred record. */
-                if (m->creds.pid > 0)
-                        m->creds.mask |= SD_BUS_CREDS_PID;
-
-                if (m->creds.euid != UID_INVALID)
-                        m->creds.mask |= SD_BUS_CREDS_EUID;
-
-                if (m->creds.egid != GID_INVALID)
-                        m->creds.mask |= SD_BUS_CREDS_EGID;
-        }
-
         if (label) {
                 m->creds.label = (char*) m + ALIGN(sizeof(sd_bus_message)) + ALIGN(extra);
                 memcpy(m->creds.label, label, label_sz + 1);
@@ -565,7 +547,6 @@ int bus_message_from_malloc(
                 size_t length,
                 int *fds,
                 unsigned n_fds,
-                const struct ucred *ucred,
                 const char *label,
                 sd_bus_message **ret) {
 
@@ -579,7 +560,7 @@ int bus_message_from_malloc(
                         buffer, length,
                         length,
                         fds, n_fds,
-                        ucred, label,
+                        label,
                         0, &m);
         if (r < 0)
                 return r;
diff --git a/src/libsystemd/sd-bus/bus-message.h b/src/libsystemd/sd-bus/bus-message.h
index d784e603dd..088d5b1109 100644
--- a/src/libsystemd/sd-bus/bus-message.h
+++ b/src/libsystemd/sd-bus/bus-message.h
@@ -205,7 +205,6 @@ int bus_message_from_header(
                 size_t message_size,
                 int *fds,
                 unsigned n_fds,
-                const struct ucred *ucred,
                 const char *label,
                 size_t extra,
                 sd_bus_message **ret);
@@ -216,7 +215,6 @@ int bus_message_from_malloc(
                 size_t length,
                 int *fds,
                 unsigned n_fds,
-                const struct ucred *ucred,
                 const char *label,
                 sd_bus_message **ret);
 
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
index 4fffc6581d..322d57ddbb 100644
--- a/src/libsystemd/sd-bus/bus-socket.c
+++ b/src/libsystemd/sd-bus/bus-socket.c
@@ -500,11 +500,8 @@ static int bus_socket_read_auth(sd_bus *b) {
         void *p;
         union {
                 struct cmsghdr cmsghdr;
-                uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX) +
-                            CMSG_SPACE(sizeof(struct ucred)) +
-                            CMSG_SPACE(NAME_MAX)]; /*selinux label */
+                uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
         } control;
-        struct cmsghdr *cmsg;
         bool handle_cmsg = false;
 
         assert(b);
@@ -555,7 +552,9 @@ static int bus_socket_read_auth(sd_bus *b) {
         b->rbuffer_size += k;
 
         if (handle_cmsg) {
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+                struct cmsghdr *cmsg;
+
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_RIGHTS) {
                                 int j;
@@ -566,30 +565,9 @@ static int bus_socket_read_auth(sd_bus *b) {
                                 j = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
                                 close_many((int*) CMSG_DATA(cmsg), j);
                                 return -EIO;
-
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SCM_CREDENTIALS &&
-                                   cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
-
-                                /* Ignore bogus data, which we might
-                                 * get on socketpair() sockets */
-                                if (((struct ucred*) CMSG_DATA(cmsg))->pid != 0) {
-                                        memcpy(&b->ucred, CMSG_DATA(cmsg), sizeof(struct ucred));
-                                        b->ucred_valid = true;
-                                }
-
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SCM_SECURITY) {
-
-                                size_t l;
-
-                                l = cmsg->cmsg_len - CMSG_LEN(0);
-                                if (l > 0) {
-                                        memcpy(&b->label, CMSG_DATA(cmsg), l);
-                                        b->label[l] = 0;
-                                }
-                        }
-                }
+                        } else
+                                log_debug("Got unexpected auxiliary data with level=%d and type=%d",
+                                          cmsg->cmsg_level, cmsg->cmsg_type);
         }
 
         r = bus_socket_auth_verify(b);
@@ -600,18 +578,8 @@ static int bus_socket_read_auth(sd_bus *b) {
 }
 
 void bus_socket_setup(sd_bus *b) {
-        int enable;
-
         assert(b);
 
-        /* Enable SO_PASSCRED + SO_PASSEC. We try this on any
-         * socket, just in case. */
-        enable = !b->bus_client;
-        (void) setsockopt(b->input_fd, SOL_SOCKET, SO_PASSCRED, &enable, sizeof(enable));
-
-        enable = !b->bus_client && (b->attach_flags & KDBUS_ATTACH_SECLABEL);
-        (void) setsockopt(b->input_fd, SOL_SOCKET, SO_PASSSEC, &enable, sizeof(enable));
-
         /* Increase the buffers to 8 MB */
         fd_inc_rcvbuf(b->input_fd, SNDBUF_SIZE);
         fd_inc_sndbuf(b->output_fd, SNDBUF_SIZE);
@@ -622,10 +590,17 @@ void bus_socket_setup(sd_bus *b) {
 }
 
 static void bus_get_peercred(sd_bus *b) {
+        int r;
+
         assert(b);
 
         /* Get the peer for socketpair() sockets */
         b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
+
+        /* Get the SELinux context of the peer */
+        r = getpeersec(b->input_fd, &b->label);
+        if (r < 0 && r != -EOPNOTSUPP)
+                log_debug_errno(r, "Failed to determine peer security context: %m");
 }
 
 static int bus_socket_start_auth_client(sd_bus *b) {
@@ -738,7 +713,8 @@ int bus_socket_exec(sd_bus *b) {
         if (pid == 0) {
                 /* Child */
 
-                reset_all_signal_handlers();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
 
                 close_all_fds(s+1, 1);
 
@@ -914,7 +890,6 @@ static int bus_socket_make_message(sd_bus *bus, size_t size) {
                                     bus->rbuffer, size,
                                     bus->fds, bus->n_fds,
                                     NULL,
-                                    NULL,
                                     &t);
         if (r < 0) {
                 free(b);
@@ -941,11 +916,8 @@ int bus_socket_read_message(sd_bus *bus) {
         void *b;
         union {
                 struct cmsghdr cmsghdr;
-                uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX) +
-                            CMSG_SPACE(sizeof(struct ucred)) +
-                            CMSG_SPACE(NAME_MAX)]; /*selinux label */
+                uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
         } control;
-        struct cmsghdr *cmsg;
         bool handle_cmsg = false;
 
         assert(bus);
@@ -991,7 +963,9 @@ int bus_socket_read_message(sd_bus *bus) {
         bus->rbuffer_size += k;
 
         if (handle_cmsg) {
-                for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+                struct cmsghdr *cmsg;
+
+                CMSG_FOREACH(cmsg, &mh)
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_RIGHTS) {
                                 int n, *f;
@@ -1016,28 +990,9 @@ int bus_socket_read_message(sd_bus *bus) {
                                 memcpy(f + bus->n_fds, CMSG_DATA(cmsg), n * sizeof(int));
                                 bus->fds = f;
                                 bus->n_fds += n;
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SCM_CREDENTIALS &&
-                                   cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
-
-                                /* Ignore bogus data, which we might
-                                 * get on socketpair() sockets */
-                                if (((struct ucred*) CMSG_DATA(cmsg))->pid != 0) {
-                                        memcpy(&bus->ucred, CMSG_DATA(cmsg), sizeof(struct ucred));
-                                        bus->ucred_valid = true;
-                                }
-
-                        } else if (cmsg->cmsg_level == SOL_SOCKET &&
-                                   cmsg->cmsg_type == SCM_SECURITY) {
-
-                                size_t l;
-                                l = cmsg->cmsg_len - CMSG_LEN(0);
-                                if (l > 0) {
-                                        memcpy(&bus->label, CMSG_DATA(cmsg), l);
-                                        bus->label[l] = 0;
-                                }
-                        }
-                }
+                        } else
+                                log_debug("Got unexpected auxiliary data with level=%d and type=%d",
+                                          cmsg->cmsg_level, cmsg->cmsg_type);
         }
 
         r = bus_socket_read_message_need(bus, &need);
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
index edc27aef87..2805b29839 100644
--- a/src/libsystemd/sd-bus/sd-bus.c
+++ b/src/libsystemd/sd-bus/sd-bus.c
@@ -49,6 +49,21 @@
 #include "bus-track.h"
 #include "bus-slot.h"
 
+#define log_debug_bus_message(m)                                         \
+        do {                                                             \
+                sd_bus_message *_mm = (m);                               \
+                log_debug("Got message type=%s sender=%s destination=%s object=%s interface=%s member=%s cookie=%" PRIu64 " reply_cookie=%" PRIu64 " error=%s", \
+                          bus_message_type_to_string(_mm->header->type), \
+                          strna(sd_bus_message_get_sender(_mm)),         \
+                          strna(sd_bus_message_get_destination(_mm)),    \
+                          strna(sd_bus_message_get_path(_mm)),           \
+                          strna(sd_bus_message_get_interface(_mm)),      \
+                          strna(sd_bus_message_get_member(_mm)),         \
+                          BUS_MESSAGE_COOKIE(_mm),                       \
+                          _mm->reply_cookie,                             \
+                          strna(_mm->error.message));                    \
+        } while (false)
+
 static int bus_poll(sd_bus *bus, bool need_more, uint64_t timeout_usec);
 static int attach_io_events(sd_bus *b);
 static void detach_io_events(sd_bus *b);
@@ -116,6 +131,7 @@ static void bus_free(sd_bus *b) {
         if (b->kdbus_buffer)
                 munmap(b->kdbus_buffer, KDBUS_POOL_SIZE);
 
+        free(b->label);
         free(b->rbuffer);
         free(b->unique_name);
         free(b->auth_buffer);
@@ -1992,6 +2008,7 @@ _public_ int sd_bus_call(
 
                                 memmove(bus->rqueue + i, bus->rqueue + i + 1, sizeof(sd_bus_message*) * (bus->rqueue_size - i - 1));
                                 bus->rqueue_size--;
+                                log_debug_bus_message(incoming);
 
                                 if (incoming->header->type == SD_BUS_MESSAGE_METHOD_RETURN) {
 
@@ -2480,16 +2497,7 @@ static int process_message(sd_bus *bus, sd_bus_message *m) {
         bus->current_message = m;
         bus->iteration_counter++;
 
-        log_debug("Got message type=%s sender=%s destination=%s object=%s interface=%s member=%s cookie=%" PRIu64 " reply_cookie=%" PRIu64 " error=%s",
-                  bus_message_type_to_string(m->header->type),
-                  strna(sd_bus_message_get_sender(m)),
-                  strna(sd_bus_message_get_destination(m)),
-                  strna(sd_bus_message_get_path(m)),
-                  strna(sd_bus_message_get_interface(m)),
-                  strna(sd_bus_message_get_member(m)),
-                  BUS_MESSAGE_COOKIE(m),
-                  m->reply_cookie,
-                  strna(m->error.message));
+        log_debug_bus_message(m);
 
         r = process_hello(bus, m);
         if (r != 0)
diff --git a/src/libsystemd/sd-bus/test-bus-gvariant.c b/src/libsystemd/sd-bus/test-bus-gvariant.c
index 992edacb28..22ea00c2fb 100644
--- a/src/libsystemd/sd-bus/test-bus-gvariant.c
+++ b/src/libsystemd/sd-bus/test-bus-gvariant.c
@@ -198,7 +198,7 @@ static void test_marshal(void) {
         }
 #endif
 
-        assert_se(bus_message_from_malloc(bus, blob, sz, NULL, 0, NULL, NULL, &n) >= 0);
+        assert_se(bus_message_from_malloc(bus, blob, sz, NULL, 0, NULL, &n) >= 0);
         blob = NULL;
 
         assert_se(bus_message_dump(n, NULL, BUS_MESSAGE_DUMP_WITH_HEADER) >= 0);
diff --git a/src/libsystemd/sd-bus/test-bus-kernel-bloom.c b/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
index b11c43bd7b..90eb1f2a33 100644
--- a/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
+++ b/src/libsystemd/sd-bus/test-bus-kernel-bloom.c
@@ -26,6 +26,14 @@
 #include "bus-kernel.h"
 #include "bus-util.h"
 
+static int test_match(sd_bus_message *m, void *userdata, sd_bus_error *ret_error) {
+        int *found = userdata;
+
+        *found = 1;
+
+        return 0;
+}
+
 static void test_one(
                 const char *path,
                 const char *interface,
@@ -39,7 +47,7 @@ static void test_one(
         _cleanup_free_ char *name = NULL, *bus_name = NULL, *address = NULL;
         _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
         sd_bus *a, *b;
-        int r;
+        int r, found = 0;
 
         assert_se(asprintf(&name, "deine-mutter-%u", (unsigned) getpid()) >= 0);
 
@@ -71,7 +79,7 @@ static void test_one(
         assert_se(r >= 0);
 
         log_debug("match");
-        r = sd_bus_add_match(b, NULL, match, NULL, NULL);
+        r = sd_bus_add_match(b, NULL, match, test_match, &found);
         assert_se(r >= 0);
 
         log_debug("signal");
@@ -83,7 +91,7 @@ static void test_one(
         assert_se(r >= 0);
 
         r = sd_bus_process(b, &m);
-        assert_se(r >= 0 && (good == !!m));
+        assert_se(r >= 0 && good == !!found);
 
         sd_bus_unref(a);
         sd_bus_unref(b);
@@ -115,6 +123,17 @@ int main(int argc, char *argv[]) {
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo'", true);
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/'", true);
         test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/quux'", false);
+        test_one("/", "waldo.com", "Piep", false, "foobar", "path_namespace='/'", true);
+
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path='/foo/bar/waldo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path='/foo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo/bar/waldo/'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "foobar", "path_namespace='/foo/'", true);
+
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo/bar/waldo", "arg0path='/foo/'", true);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo", "arg0path='/foo'", true);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo", "arg0path='/foo/bar/waldo'", false);
+        test_one("/foo/bar/waldo", "waldo.com", "Piep", false, "/foo/", "arg0path='/foo/bar/waldo'", true);
 
         return 0;
 }
diff --git a/src/libsystemd/sd-bus/test-bus-marshal.c b/src/libsystemd/sd-bus/test-bus-marshal.c
index f8ecadf499..a866a56179 100644
--- a/src/libsystemd/sd-bus/test-bus-marshal.c
+++ b/src/libsystemd/sd-bus/test-bus-marshal.c
@@ -212,7 +212,7 @@ int main(int argc, char *argv[]) {
 
         m = sd_bus_message_unref(m);
 
-        r = bus_message_from_malloc(bus, buffer, sz, NULL, 0, NULL, NULL, &m);
+        r = bus_message_from_malloc(bus, buffer, sz, NULL, 0, NULL, &m);
         assert_se(r >= 0);
 
         bus_message_dump(m, stdout, BUS_MESSAGE_DUMP_WITH_HEADER);
diff --git a/src/libsystemd/sd-bus/test-bus-signature.c b/src/libsystemd/sd-bus/test-bus-signature.c
index 4165c9273a..17c6188ca0 100644
--- a/src/libsystemd/sd-bus/test-bus-signature.c
+++ b/src/libsystemd/sd-bus/test-bus-signature.c
@@ -95,23 +95,28 @@ int main(int argc, char *argv[]) {
         assert_se(!namespace_complex_pattern("foo.", ""));
 
         assert_se(path_complex_pattern("", ""));
-        assert_se(path_complex_pattern("", "/"));
-        assert_se(path_complex_pattern("/", ""));
+        assert_se(!path_complex_pattern("", "/"));
+        assert_se(!path_complex_pattern("/", ""));
         assert_se(path_complex_pattern("/", "/"));
         assert_se(path_complex_pattern("/foobar/", "/"));
-        assert_se(path_complex_pattern("/foobar/", "/foobar"));
+        assert_se(!path_complex_pattern("/foobar/", "/foobar"));
         assert_se(path_complex_pattern("/foobar", "/foobar"));
-        assert_se(path_complex_pattern("/foobar", "/foobar/"));
+        assert_se(!path_complex_pattern("/foobar", "/foobar/"));
         assert_se(!path_complex_pattern("/foobar", "/foobar/waldo"));
         assert_se(path_complex_pattern("/foobar/", "/foobar/waldo"));
+        assert_se(path_complex_pattern("/foobar/waldo", "/foobar/"));
+
+        assert_se(path_simple_pattern("/foo/", "/foo/bar/waldo"));
 
         assert_se(namespace_simple_pattern("", ""));
+        assert_se(namespace_simple_pattern("", ".foobar"));
         assert_se(namespace_simple_pattern("foobar", "foobar"));
         assert_se(namespace_simple_pattern("foobar.waldo", "foobar.waldo"));
         assert_se(namespace_simple_pattern("foobar", "foobar.waldo"));
         assert_se(!namespace_simple_pattern("foobar.waldo", "foobar"));
         assert_se(!namespace_simple_pattern("", "foo"));
         assert_se(!namespace_simple_pattern("foo", ""));
+        assert_se(namespace_simple_pattern("foo.", "foo.bar.waldo"));
 
         assert_se(streq(object_path_startswith("/foo/bar", "/foo"), "bar"));
         assert_se(streq(object_path_startswith("/foo", "/foo"), ""));
diff --git a/src/libsystemd/sd-event/sd-event.c b/src/libsystemd/sd-event/sd-event.c
index 2b8d1b87ed..00880c983b 100644
--- a/src/libsystemd/sd-event/sd-event.c
+++ b/src/libsystemd/sd-event/sd-event.c
@@ -2384,7 +2384,6 @@ _public_ int sd_event_wait(sd_event *e, uint64_t timeout) {
                 }
 
                 r = -errno;
-
                 goto finish;
         }
 
diff --git a/src/libsystemd/sd-login/sd-login.c b/src/libsystemd/sd-login/sd-login.c
index ed8aa0952a..e3885ecba6 100644
--- a/src/libsystemd/sd-login/sd-login.c
+++ b/src/libsystemd/sd-login/sd-login.c
@@ -30,7 +30,7 @@
 #include "macro.h"
 #include "strv.h"
 #include "fileio.h"
-#include "login-shared.h"
+#include "login-util.h"
 #include "formats-util.h"
 #include "sd-login.h"
 
diff --git a/src/libsystemd/sd-network/sd-network.c b/src/libsystemd/sd-network/sd-network.c
index db1f6997cb..b63fdf8fcb 100644
--- a/src/libsystemd/sd-network/sd-network.c
+++ b/src/libsystemd/sd-network/sd-network.c
@@ -297,8 +297,31 @@ static inline sd_network_monitor* FD_TO_MONITOR(int fd) {
         return (sd_network_monitor*) (unsigned long) (fd + 1);
 }
 
+static int monitor_add_inotify_watch(int fd) {
+        int k;
+
+        k = inotify_add_watch(fd, "/run/systemd/netif/links/", IN_MOVED_TO|IN_DELETE);
+        if (k >= 0)
+                return 0;
+        else if (errno != ENOENT)
+                return -errno;
+
+        k = inotify_add_watch(fd, "/run/systemd/netif/", IN_CREATE|IN_ISDIR);
+        if (k >= 0)
+                return 0;
+        else if (errno != ENOENT)
+                return -errno;
+
+        k = inotify_add_watch(fd, "/run/systemd/", IN_CREATE|IN_ISDIR);
+        if (k < 0)
+                return -errno;
+
+        return 0;
+}
+
 _public_ int sd_network_monitor_new(sd_network_monitor **m, const char *category) {
-        int fd, k;
+        _cleanup_close_ int fd = -1;
+        int k;
         bool good = false;
 
         assert_return(m, -EINVAL);
@@ -308,40 +331,64 @@ _public_ int sd_network_monitor_new(sd_network_monitor **m, const char *category
                 return -errno;
 
         if (!category || streq(category, "links")) {
-                k = inotify_add_watch(fd, "/run/systemd/netif/links/", IN_MOVED_TO|IN_DELETE);
-                if (k < 0) {
-                        safe_close(fd);
-                        return -errno;
-                }
+                k = monitor_add_inotify_watch(fd);
+                if (k < 0)
+                        return k;
 
                 good = true;
         }
 
-        if (!good) {
-                close_nointr(fd);
+        if (!good)
                 return -EINVAL;
-        }
 
         *m = FD_TO_MONITOR(fd);
+        fd = -1;
+
         return 0;
 }
 
 _public_ sd_network_monitor* sd_network_monitor_unref(sd_network_monitor *m) {
         int fd;
 
-        assert_return(m, NULL);
-
-        fd = MONITOR_TO_FD(m);
-        close_nointr(fd);
+        if (m) {
+                fd = MONITOR_TO_FD(m);
+                close_nointr(fd);
+        }
 
         return NULL;
 }
 
 _public_ int sd_network_monitor_flush(sd_network_monitor *m) {
+        union inotify_event_buffer buffer;
+        struct inotify_event *e;
+        ssize_t l;
+        int fd, k;
 
         assert_return(m, -EINVAL);
 
-        return flush_fd(MONITOR_TO_FD(m));
+        fd = MONITOR_TO_FD(m);
+
+        l = read(fd, &buffer, sizeof(buffer));
+        if (l < 0) {
+                if (errno == EAGAIN || errno == EINTR)
+                        return 0;
+
+                return -errno;
+        }
+
+        FOREACH_INOTIFY_EVENT(e, buffer, l) {
+                if (e->mask & IN_ISDIR) {
+                        k = monitor_add_inotify_watch(fd);
+                        if (k < 0)
+                                return k;
+
+                        k = inotify_rm_watch(fd, e->wd);
+                        if (k < 0)
+                                return -errno;
+                }
+        }
+
+        return 0;
 }
 
 _public_ int sd_network_monitor_get_fd(sd_network_monitor *m) {
diff --git a/src/libsystemd/sd-rtnl/rtnl-message.c b/src/libsystemd/sd-rtnl/rtnl-message.c
index bab2a4ff08..9dcf7df559 100644
--- a/src/libsystemd/sd-rtnl/rtnl-message.c
+++ b/src/libsystemd/sd-rtnl/rtnl-message.c
@@ -1442,7 +1442,7 @@ static int socket_recv_message(int fd, struct iovec *iov, uint32_t *_group, bool
                 return (errno == EAGAIN || errno == EINTR) ? 0 : -errno;
         }
 
-        for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+        CMSG_FOREACH(cmsg, &msg) {
                 if (cmsg->cmsg_level == SOL_SOCKET &&
                     cmsg->cmsg_type == SCM_CREDENTIALS &&
                     cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
diff --git a/src/login/inhibit.c b/src/login/inhibit.c
index 57cfb5d0b5..0e5dce5925 100644
--- a/src/login/inhibit.c
+++ b/src/login/inhibit.c
@@ -33,6 +33,7 @@
 #include "strv.h"
 #include "formats-util.h"
 #include "process-util.h"
+#include "signal-util.h"
 
 static const char* arg_what = "idle:sleep:shutdown";
 static const char* arg_who = NULL;
@@ -274,6 +275,9 @@ int main(int argc, char *argv[]) {
                 if (pid == 0) {
                         /* Child */
 
+                        (void) reset_all_signal_handlers();
+                        (void) reset_signal_mask();
+
                         close_all_fds(NULL, 0);
 
                         execvp(argv[optind], argv + optind);
diff --git a/src/login/logind-session.h b/src/login/logind-session.h
index 7a329b94ad..4bf739a44d 100644
--- a/src/login/logind-session.h
+++ b/src/login/logind-session.h
@@ -26,7 +26,7 @@ typedef enum KillWho KillWho;
 
 #include "list.h"
 #include "logind-user.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 typedef enum SessionState {
         SESSION_OPENING,  /* Session scope is being created */
diff --git a/src/login/logind-user.c b/src/login/logind-user.c
index 373c9938e7..c0b473930d 100644
--- a/src/login/logind-user.c
+++ b/src/login/logind-user.c
@@ -738,8 +738,7 @@ int user_kill(User *u, int signo) {
         return manager_kill_unit(u->manager, u->slice, KILL_ALL, signo, NULL);
 }
 
-static bool
-elect_display_filter(Session *s) {
+static bool elect_display_filter(Session *s) {
         /* Return true if the session is a candidate for the user’s ‘primary
          * session’ or ‘display’. */
         assert(s);
@@ -747,8 +746,7 @@ elect_display_filter(Session *s) {
         return (s->class == SESSION_USER && !s->stopping);
 }
 
-static int
-elect_display_compare(Session *s1, Session *s2) {
+static int elect_display_compare(Session *s1, Session *s2) {
         /* Indexed by SessionType. Lower numbers mean more preferred. */
         const int type_ranks[_SESSION_TYPE_MAX] = {
                 [SESSION_UNSPECIFIED] = 0,
diff --git a/src/login/test-login-shared.c b/src/login/test-login-shared.c
index d29d7e7921..4c4275d124 100644
--- a/src/login/test-login-shared.c
+++ b/src/login/test-login-shared.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "macro.h"
-#include "login-shared.h"
+#include "login-util.h"
 
 static void test_session_id_valid(void) {
         assert_se(session_id_valid("c1"));
diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index 3454394977..68925debe6 100644
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -814,7 +814,7 @@ static char *lldp_system_caps(uint16_t cap) {
         }
 
         if (cap & LLDP_SYSTEM_CAPABILITIES_ROUTER) {
-                s =  strjoin(t, lldp_system_capability_to_string(LLDP_SYSTEM_CAPABILITIES_ROUTER), " ", NULL);
+                s = strjoin(t, lldp_system_capability_to_string(LLDP_SYSTEM_CAPABILITIES_ROUTER), " ", NULL);
                 if (!s)
                         return NULL;
 
diff --git a/src/network/networkd-dhcp4.c b/src/network/networkd-dhcp4.c
index 20aee53d6e..71cc722bcc 100644
--- a/src/network/networkd-dhcp4.c
+++ b/src/network/networkd-dhcp4.c
@@ -561,7 +561,7 @@ int dhcp4_configure(Link *link) {
 
         assert(link);
         assert(link->network);
-        assert(IN_SET(link->network->dhcp, ADDRESS_FAMILY_YES, ADDRESS_FAMILY_IPV4));
+        assert(link->network->dhcp & ADDRESS_FAMILY_IPV4);
 
         r = sd_dhcp_client_new(&link->dhcp_client);
         if (r < 0)
diff --git a/src/network/networkd-ipv4ll.c b/src/network/networkd-ipv4ll.c
index 8050801e19..14b8770429 100644
--- a/src/network/networkd-ipv4ll.c
+++ b/src/network/networkd-ipv4ll.c
@@ -34,7 +34,7 @@ static int ipv4ll_address_lost(Link *link) {
         assert(link);
 
         link->ipv4ll_route = false;
-        link->ipv4ll_address =  false;
+        link->ipv4ll_address = false;
 
         r = sd_ipv4ll_get_address(link->ipv4ll, &addr);
         if (r < 0)
@@ -209,7 +209,7 @@ int ipv4ll_configure(Link *link) {
 
         assert(link);
         assert(link->network);
-        assert(IN_SET(link->network->link_local, ADDRESS_FAMILY_IPV4, ADDRESS_FAMILY_YES));
+        assert(link->network->link_local & ADDRESS_FAMILY_IPV4);
 
         r = sd_ipv4ll_new(&link->ipv4ll);
         if (r < 0)
diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index b30fd7ae89..7841f69dab 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -40,7 +40,7 @@ bool link_dhcp6_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->dhcp, ADDRESS_FAMILY_IPV6, ADDRESS_FAMILY_YES);
+        return link->network->dhcp & ADDRESS_FAMILY_IPV6;
 }
 
 bool link_dhcp4_enabled(Link *link) {
@@ -50,7 +50,7 @@ bool link_dhcp4_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->dhcp, ADDRESS_FAMILY_IPV4, ADDRESS_FAMILY_YES);
+        return link->network->dhcp & ADDRESS_FAMILY_IPV4;
 }
 
 bool link_dhcp4_server_enabled(Link *link) {
@@ -70,7 +70,7 @@ bool link_ipv4ll_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->link_local, ADDRESS_FAMILY_IPV4, ADDRESS_FAMILY_YES);
+        return link->network->link_local & ADDRESS_FAMILY_IPV4;
 }
 
 bool link_ipv6ll_enabled(Link *link) {
@@ -80,7 +80,7 @@ bool link_ipv6ll_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->link_local, ADDRESS_FAMILY_IPV6, ADDRESS_FAMILY_YES);
+        return link->network->link_local & ADDRESS_FAMILY_IPV6;
 }
 
 bool link_lldp_enabled(Link *link) {
@@ -103,7 +103,7 @@ static bool link_ipv4_forward_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->ip_forward, ADDRESS_FAMILY_IPV4, ADDRESS_FAMILY_YES);
+        return link->network->ip_forward & ADDRESS_FAMILY_IPV4;
 }
 
 static bool link_ipv6_forward_enabled(Link *link) {
@@ -113,7 +113,7 @@ static bool link_ipv6_forward_enabled(Link *link) {
         if (!link->network)
                 return false;
 
-        return IN_SET(link->network->ip_forward, ADDRESS_FAMILY_IPV6, ADDRESS_FAMILY_YES);
+        return link->network->ip_forward & ADDRESS_FAMILY_IPV6;
 }
 
 #define FLAG_STRING(string, flag, old, new) \
@@ -749,7 +749,6 @@ static int set_hostname_handler(sd_bus_message *m, void *userdata, sd_bus_error
 }
 
 int link_set_hostname(Link *link, const char *hostname) {
-        _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
         int r = 0;
 
         assert(link);
@@ -764,22 +763,19 @@ int link_set_hostname(Link *link, const char *hostname) {
                 return 0;
         }
 
-        r = sd_bus_message_new_method_call(
+        r = sd_bus_call_method_async(
                         link->manager->bus,
-                        &m,
+                        NULL,
                         "org.freedesktop.hostname1",
                         "/org/freedesktop/hostname1",
                         "org.freedesktop.hostname1",
-                        "SetHostname");
-        if (r < 0)
-                return r;
-
-        r = sd_bus_message_append(m, "sb", hostname, false);
-        if (r < 0)
-                return r;
+                        "SetHostname",
+                        set_hostname_handler,
+                        link,
+                        "sb",
+                        hostname,
+                        false);
 
-        r = sd_bus_call_async(link->manager->bus, NULL, m, set_hostname_handler,
-                              link, 0);
         if (r < 0)
                 return log_link_error_errno(link, r, "Could not set transient hostname: %m");
 
@@ -1481,9 +1477,6 @@ static int link_set_ipv4_forward(Link *link) {
         const char *p = NULL;
         int r;
 
-        if (link->network->ip_forward == ADDRESS_FAMILY_KERNEL)
-                return 0;
-
         p = strjoina("/proc/sys/net/ipv4/conf/", link->ifname, "/forwarding");
         r = write_string_file_no_create(p, one_zero(link_ipv4_forward_enabled(link)));
         if (r < 0)
@@ -1500,9 +1493,6 @@ static int link_set_ipv6_forward(Link *link) {
         if (!socket_ipv6_is_supported())
                 return 0;
 
-        if (link->network->ip_forward == ADDRESS_FAMILY_KERNEL)
-                return 0;
-
         p = strjoina("/proc/sys/net/ipv6/conf/", link->ifname, "/forwarding");
         r = write_string_file_no_create(p, one_zero(link_ipv6_forward_enabled(link)));
         if (r < 0)
diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index 2cc53df4b1..db737ad484 100644
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -853,8 +853,6 @@ const char *address_family_boolean_to_string(AddressFamilyBoolean b) {
                 return "ipv4";
         if (b == ADDRESS_FAMILY_IPV6)
                 return "ipv6";
-        if (b == ADDRESS_FAMILY_KERNEL)
-                return "kernel";
 
         return NULL;
 }
@@ -874,8 +872,6 @@ AddressFamilyBoolean address_family_boolean_from_string(const char *s) {
                 return ADDRESS_FAMILY_IPV4;
         if (streq(s, "ipv6"))
                 return ADDRESS_FAMILY_IPV6;
-        if (streq(s, "kernel"))
-                return ADDRESS_FAMILY_KERNEL;
 
         return _ADDRESS_FAMILY_BOOLEAN_INVALID;
 }
diff --git a/src/network/networkd-netdev-bond.c b/src/network/networkd-netdev-bond.c
index 70df08a5e1..9919955f51 100644
--- a/src/network/networkd-netdev-bond.c
+++ b/src/network/networkd-netdev-bond.c
@@ -191,215 +191,132 @@ static int netdev_bond_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_m
         if (b->mode != _NETDEV_BOND_MODE_INVALID) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_MODE,
                                               bond_mode_to_kernel(b->mode));
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_MODE attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_MODE attribute: %m");
         }
 
         if (b->xmit_hash_policy != _NETDEV_BOND_XMIT_HASH_POLICY_INVALID) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_XMIT_HASH_POLICY,
                                               bond_xmit_hash_policy_to_kernel(b->xmit_hash_policy));
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_XMIT_HASH_POLICY attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_XMIT_HASH_POLICY attribute: %m");
         }
 
         if (b->lacp_rate != _NETDEV_BOND_LACP_RATE_INVALID &&
             b->mode == NETDEV_BOND_MODE_802_3AD) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_AD_LACP_RATE, b->lacp_rate );
                 if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_AD_LACP_RATE attribute: %s",
-                                         strerror(-r));
-                        return r;
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_AD_LACP_RATE attribute: %m");
                 }
         }
 
         if (b->miimon != 0) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_MIIMON, b->miimon / USEC_PER_MSEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_BOND_MIIMON attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_BOND_MIIMON attribute: %m");
         }
 
         if (b->downdelay != 0) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_DOWNDELAY, b->downdelay / USEC_PER_MSEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_DOWNDELAY attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_DOWNDELAY attribute: %m");
         }
 
         if (b->updelay != 0) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_UPDELAY, b->updelay / USEC_PER_MSEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_UPDELAY attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_UPDELAY attribute: %m");
         }
 
         if (b->arp_interval != 0) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_ARP_INTERVAL, b->arp_interval / USEC_PER_MSEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_ARP_INTERVAL attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
-        }
-
-        if ((b->lp_interval >= LEARNING_PACKETS_INTERVAL_MIN_SEC) &&
-            (b->lp_interval <= LEARNING_PACKETS_INTERVAL_MAX_SEC)) {
-                r = sd_rtnl_message_append_u32(m, IFLA_BOND_LP_INTERVAL, b->lp_interval / USEC_PER_SEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_LP_INTERVAL attribute: %s",
-                                         strerror(-r));
-                        return r;
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ARP_INTERVAL attribute: %m");
+
+                if ((b->lp_interval >= LEARNING_PACKETS_INTERVAL_MIN_SEC) &&
+                    (b->lp_interval <= LEARNING_PACKETS_INTERVAL_MAX_SEC)) {
+                        r = sd_rtnl_message_append_u32(m, IFLA_BOND_LP_INTERVAL, b->lp_interval / USEC_PER_SEC);
+                        if (r < 0)
+                                return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_LP_INTERVAL attribute: %m");
                 }
         }
 
         if (b->ad_select != _NETDEV_BOND_AD_SELECT_INVALID &&
             b->mode == BOND_MODE_8023AD) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_AD_SELECT, b->ad_select);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_AD_SELECT attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_AD_SELECT attribute: %m");
         }
 
         if (b->fail_over_mac != _NETDEV_BOND_FAIL_OVER_MAC_INVALID &&
             b->mode == NETDEV_BOND_MODE_ACTIVE_BACKUP) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_FAIL_OVER_MAC, b->fail_over_mac);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_FAIL_OVER_MAC attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_FAIL_OVER_MAC attribute: %m");
         }
 
         if (b->arp_validate != _NETDEV_BOND_ARP_VALIDATE_INVALID) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_ARP_VALIDATE, b->arp_validate);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_ARP_VALIDATE attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ARP_VALIDATE attribute: %m");
         }
 
         if (b->arp_all_targets != _NETDEV_BOND_ARP_ALL_TARGETS_INVALID) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_ARP_ALL_TARGETS, b->arp_all_targets);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_ARP_VALIDATE attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ARP_VALIDATE attribute: %m");
         }
 
         if (b->primary_reselect != _NETDEV_BOND_PRIMARY_RESELECT_INVALID) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_ARP_ALL_TARGETS, b->primary_reselect);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_ARP_ALL_TARGETS attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ARP_ALL_TARGETS attribute: %m");
         }
 
         if (b->resend_igmp <= RESEND_IGMP_MAX) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_RESEND_IGMP, b->resend_igmp);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_RESEND_IGMP attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_RESEND_IGMP attribute: %m");
         }
 
         if (b->packets_per_slave <= PACKETS_PER_SLAVE_MAX) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_PACKETS_PER_SLAVE, b->packets_per_slave);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_PACKETS_PER_SLAVE attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_PACKETS_PER_SLAVE attribute: %m");
         }
 
         if (b->num_grat_arp <= GRATUITOUS_ARP_MAX) {
                 r = sd_rtnl_message_append_u8(m, IFLA_BOND_NUM_PEER_NOTIF, b->num_grat_arp);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_NUM_PEER_NOTIF attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_NUM_PEER_NOTIF attribute: %m");
         }
 
         if (b->min_links != 0) {
                 r = sd_rtnl_message_append_u32(m, IFLA_BOND_MIN_LINKS, b->min_links);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_BOND_MIN_LINKS attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_MIN_LINKS attribute: %m");
         }
 
         r = sd_rtnl_message_append_u8(m, IFLA_BOND_ALL_SLAVES_ACTIVE, b->all_slaves_active);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_BOND_ALL_SLAVES_ACTIVE attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ALL_SLAVES_ACTIVE attribute: %m");
 
         if (b->arp_interval > 0)  {
                 if (b->n_arp_ip_targets > 0) {
 
                         r = sd_rtnl_message_open_container(m, IFLA_BOND_ARP_IP_TARGET);
-                        if (r < 0) {
-                                log_netdev_error(netdev,
-                                                 "Could not open contaniner IFLA_BOND_ARP_IP_TARGET : %s",
-                                                 strerror(-r));
-                                return r;
-                        }
+                        if (r < 0)
+                                return log_netdev_error_errno(netdev, r, "Could not open contaniner IFLA_BOND_ARP_IP_TARGET : %m");
 
                         LIST_FOREACH(arp_ip_target, target, b->arp_ip_targets) {
                                 r = sd_rtnl_message_append_u32(m, i++, target->ip.in.s_addr);
-                                if (r < 0) {
-                                        log_netdev_error(netdev,
-                                                         "Could not append IFLA_BOND_ARP_ALL_TARGETS attribute: %s",
-                                                         strerror(-r));
-                                        return r;
-                                }
+                                if (r < 0)
+                                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_BOND_ARP_ALL_TARGETS attribute: %m");
                         }
 
                         r = sd_rtnl_message_close_container(m);
-                        if (r < 0) {
-                                log_netdev_error(netdev,
-                                                 "Could not close contaniner IFLA_BOND_ARP_IP_TARGET : %s",
-                                                 strerror(-r));
-                                return r;
-                        }
+                        if (r < 0)
+                                return log_netdev_error_errno(netdev, r, "Could not close contaniner IFLA_BOND_ARP_IP_TARGET : %m");
                 }
         }
 
diff --git a/src/network/networkd-netdev-ipvlan.c b/src/network/networkd-netdev-ipvlan.c
index 5189000c1f..f1c8e0ccdb 100644
--- a/src/network/networkd-netdev-ipvlan.c
+++ b/src/network/networkd-netdev-ipvlan.c
@@ -42,13 +42,9 @@ static int netdev_ipvlan_fill_message_create(NetDev *netdev, Link *link, sd_rtnl
         assert(netdev->ifname);
 
         if (m->mode != _NETDEV_IPVLAN_MODE_INVALID) {
-        r = sd_rtnl_message_append_u16(req, IFLA_IPVLAN_MODE, m->mode);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_IPVLAN_MODE attribute: %s",
-                                 strerror(-r));
-                        return r;
-                }
+                r = sd_rtnl_message_append_u16(req, IFLA_IPVLAN_MODE, m->mode);
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPVLAN_MODE attribute: %m");
         }
 
         return 0;
diff --git a/src/network/networkd-netdev-macvlan.c b/src/network/networkd-netdev-macvlan.c
index 5f41f1c865..a8bf6e6bb7 100644
--- a/src/network/networkd-netdev-macvlan.c
+++ b/src/network/networkd-netdev-macvlan.c
@@ -44,13 +44,9 @@ static int netdev_macvlan_fill_message_create(NetDev *netdev, Link *link, sd_rtn
         assert(netdev->ifname);
 
         if (m->mode != _NETDEV_MACVLAN_MODE_INVALID) {
-        r = sd_rtnl_message_append_u32(req, IFLA_MACVLAN_MODE, m->mode);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_MACVLAN_MODE attribute: %s",
-                                 strerror(-r));
-                        return r;
-                }
+                r = sd_rtnl_message_append_u32(req, IFLA_MACVLAN_MODE, m->mode);
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_MACVLAN_MODE attribute: %m");
         }
 
         return 0;
diff --git a/src/network/networkd-netdev-veth.c b/src/network/networkd-netdev-veth.c
index 9e9e1225e7..7bb02d1ae1 100644
--- a/src/network/networkd-netdev-veth.c
+++ b/src/network/networkd-netdev-veth.c
@@ -35,12 +35,8 @@ static int netdev_veth_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_m
         assert(m);
 
         r = sd_rtnl_message_open_container(m, VETH_INFO_PEER);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append VETH_INFO_PEER attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append VETH_INFO_PEER attribute: %m");
 
         if (v->ifname_peer) {
                 r = sd_rtnl_message_append_string(m, IFLA_IFNAME, v->ifname_peer);
@@ -50,21 +46,13 @@ static int netdev_veth_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_m
 
         if (v->mac_peer) {
                 r = sd_rtnl_message_append_ether_addr(m, IFLA_ADDRESS, v->mac_peer);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_ADDRESS attribute: %s",
-                                         strerror(-r));
-                    return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_ADDRESS attribute: %m");
         }
 
         r = sd_rtnl_message_close_container(m);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_INFO_DATA attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_INFO_DATA attribute: %m");
 
         return r;
 }
diff --git a/src/network/networkd-netdev-vxlan.c b/src/network/networkd-netdev-vxlan.c
index e2c2b108b9..01a1e5089c 100644
--- a/src/network/networkd-netdev-vxlan.c
+++ b/src/network/networkd-netdev-vxlan.c
@@ -39,123 +39,67 @@ static int netdev_vxlan_fill_message_create(NetDev *netdev, Link *link, sd_rtnl_
 
         if (v->id <= VXLAN_VID_MAX) {
                 r = sd_rtnl_message_append_u32(m, IFLA_VXLAN_ID, v->id);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_VXLAN_ID attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_ID attribute: %m");
         }
 
         r = sd_rtnl_message_append_in_addr(m, IFLA_VXLAN_GROUP, &v->group.in);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_GROUP attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_GROUP attribute: %m");
 
         r = sd_rtnl_message_append_u32(m, IFLA_VXLAN_LINK, link->ifindex);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_LINK attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_LINK attribute: %m");
 
         if(v->ttl) {
                 r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_TTL, v->ttl);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_VXLAN_TTL attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_TTL attribute: %m");
         }
 
         if(v->tos) {
                 r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_TOS, v->tos);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_VXLAN_TOS attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_TOS attribute: %m");
         }
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_LEARNING, v->learning);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_LEARNING attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_LEARNING attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_RSC, v->route_short_circuit);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_RSC attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_RSC attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_PROXY, v->arp_proxy);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_PROXY attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_PROXY attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_L2MISS, v->l2miss);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_L2MISS attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_L2MISS attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_L3MISS, v->l3miss);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_L3MISS attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_L3MISS attribute: %m");
 
         if(v->fdb_ageing) {
                 r = sd_rtnl_message_append_u32(m, IFLA_VXLAN_AGEING, v->fdb_ageing / USEC_PER_SEC);
-                if (r < 0) {
-                        log_netdev_error(netdev,
-                                         "Could not append IFLA_VXLAN_AGEING attribute: %s",
-                                         strerror(-r));
-                        return r;
-                }
+                if (r < 0)
+                        return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_AGEING attribute: %m");
         }
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_UDP_CSUM, v->udpcsum);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_UDP_CSUM attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_UDP_CSUM attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_UDP_ZERO_CSUM6_TX, v->udp6zerocsumtx);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_UDP_ZERO_CSUM6_TX attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_UDP_ZERO_CSUM6_TX attribute: %m");
 
         r = sd_rtnl_message_append_u8(m, IFLA_VXLAN_UDP_ZERO_CSUM6_RX, v->udp6zerocsumrx);
-        if (r < 0) {
-                log_netdev_error(netdev,
-                                 "Could not append IFLA_VXLAN_UDP_ZERO_CSUM6_RX attribute: %s",
-                                 strerror(-r));
-                return r;
-        }
+        if (r < 0)
+                return log_netdev_error_errno(netdev, r, "Could not append IFLA_VXLAN_UDP_ZERO_CSUM6_RX attribute: %m");
 
         return r;
 }
diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index 5947084106..6f32e5f4a4 100644
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -30,6 +30,7 @@
 #include "networkd-netdev.h"
 #include "networkd-link.h"
 #include "network-internal.h"
+#include "dns-domain.h"
 
 static int network_load_one(Manager *manager, const char *filename) {
         _cleanup_network_free_ Network *network = NULL;
@@ -466,11 +467,16 @@ int config_parse_domains(const char *unit,
         STRV_FOREACH(domain, *domains) {
                 if (is_localhost(*domain))
                         log_syntax(unit, LOG_ERR, filename, line, EINVAL, "'localhost' domain names may not be configured, ignoring assignment: %s", *domain);
-                else if (!hostname_is_valid(*domain)) {
-                        if (!streq(*domain, "*"))
-                                log_syntax(unit, LOG_ERR, filename, line, EINVAL, "domain name is not valid, ignoring assignment: %s", *domain);
-                } else
-                        continue;
+                else {
+                        r = dns_name_is_valid(*domain);
+                        if (r <= 0 && !streq(*domain, "*")) {
+                                if (r < 0)
+                                        log_error_errno(r, "Failed to validate domain name: %s: %m", *domain);
+                                if (r == 0)
+                                        log_warning("Domain name is not valid, ignoring assignment: %s", *domain);
+                        } else
+                                continue;
+                }
 
                 strv_remove(*domains, *domain);
 
diff --git a/src/network/networkd.h b/src/network/networkd.h
index 49afeffe81..4b13d4aed1 100644
--- a/src/network/networkd.h
+++ b/src/network/networkd.h
@@ -60,7 +60,6 @@ typedef enum AddressFamilyBoolean {
         ADDRESS_FAMILY_IPV4 = 1,
         ADDRESS_FAMILY_IPV6 = 2,
         ADDRESS_FAMILY_YES = 3,
-        ADDRESS_FAMILY_KERNEL = 4,
         _ADDRESS_FAMILY_BOOLEAN_MAX,
         _ADDRESS_FAMILY_BOOLEAN_INVALID = -1,
 } AddressFamilyBoolean;
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 4211a3d779..251af4a67c 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -3656,7 +3656,8 @@ static int spawn_getent(const char *database, const char *key, pid_t *rpid) {
                 if (nullfd > 2)
                         safe_close(nullfd);
 
-                reset_all_signal_handlers();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 close_all_fds(NULL, 0);
 
                 execle("/usr/bin/getent", "getent", database, key, NULL, &empty_env);
@@ -4739,8 +4740,8 @@ int main(int argc, char *argv[]) {
                         rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
                         pid_socket_pair[0] = safe_close(pid_socket_pair[0]);
 
-                        reset_all_signal_handlers();
-                        reset_signal_mask();
+                        (void) reset_all_signal_handlers();
+                        (void) reset_signal_mask();
 
                         r = outer_child(&barrier,
                                         arg_directory,
diff --git a/src/nss-resolve/nss-resolve.c b/src/nss-resolve/nss-resolve.c
index bc6c5dc2a0..8f181a6c72 100644
--- a/src/nss-resolve/nss-resolve.c
+++ b/src/nss-resolve/nss-resolve.c
@@ -365,13 +365,13 @@ enum nss_status _nss_resolve_gethostbyname3_r(
                                         int32_t *ttlp,
                                         char **canonp);
 
-                        fallback =  (enum nss_status (*)(const char *name,
-                                                         int af,
-                                                         struct hostent *result,
-                                                         char *buffer, size_t buflen,
-                                                         int *errnop, int *h_errnop,
-                                                         int32_t *ttlp,
-                                                         char **canonp))
+                        fallback = (enum nss_status (*)(const char *name,
+                                                        int af,
+                                                        struct hostent *result,
+                                                        char *buffer, size_t buflen,
+                                                        int *errnop, int *h_errnop,
+                                                        int32_t *ttlp,
+                                                        char **canonp))
                                 find_fallback("libnss_dns.so.2", "_nss_dns_gethostbyname3_r");
                         if (fallback)
                                 return fallback(name, af, result, buffer, buflen, errnop, h_errnop, ttlp, canonp);
diff --git a/src/quotacheck/quotacheck.c b/src/quotacheck/quotacheck.c
index a729f592cf..cf6a239402 100644
--- a/src/quotacheck/quotacheck.c
+++ b/src/quotacheck/quotacheck.c
@@ -23,9 +23,11 @@
 #include <stdbool.h>
 #include <errno.h>
 #include <unistd.h>
+#include <sys/prctl.h>
 
 #include "util.h"
 #include "process-util.h"
+#include "signal-util.h"
 
 static bool arg_skip = false;
 static bool arg_force = false;
@@ -105,7 +107,13 @@ int main(int argc, char *argv[]) {
                 log_error_errno(errno, "fork(): %m");
                 return EXIT_FAILURE;
         } else if (pid == 0) {
+
                 /* Child */
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+                assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
+
                 execv(cmdline[0], (char**) cmdline);
                 _exit(1); /* Operational error */
         }
diff --git a/src/remount-fs/remount-fs.c b/src/remount-fs/remount-fs.c
index e701fc9fae..f904e48e75 100644
--- a/src/remount-fs/remount-fs.c
+++ b/src/remount-fs/remount-fs.c
@@ -95,6 +95,9 @@ int main(int argc, char *argv[]) {
                         const char *arguments[5];
                         /* Child */
 
+                        (void) reset_all_signal_handlers();
+                        (void) reset_signal_mask();
+
                         arguments[0] = MOUNT_PATH;
                         arguments[1] = me->mnt_dir;
                         arguments[2] = "-o";
diff --git a/src/resolve/resolved-bus.c b/src/resolve/resolved-bus.c
index 171141e3a4..6db12511f9 100644
--- a/src/resolve/resolved-bus.c
+++ b/src/resolve/resolved-bus.c
@@ -22,7 +22,7 @@
 #include "bus-common-errors.h"
 #include "bus-util.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-bus.h"
 #include "resolved-def.h"
 
diff --git a/src/resolve/resolved-dns-answer.c b/src/resolve/resolved-dns-answer.c
index e08eb667cc..f77b98e505 100644
--- a/src/resolve/resolved-dns-answer.c
+++ b/src/resolve/resolved-dns-answer.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "resolved-dns-answer.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 DnsAnswer *dns_answer_new(unsigned n) {
         DnsAnswer *a;
diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 21756f566f..bb74b1828e 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -23,7 +23,7 @@
 #include "util.h"
 #include "strv.h"
 #include "unaligned.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-packet.h"
 
 int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
diff --git a/src/resolve/resolved-dns-question.c b/src/resolve/resolved-dns-question.c
index 45bcbbf23a..4d71f5e3d4 100644
--- a/src/resolve/resolved-dns-question.c
+++ b/src/resolve/resolved-dns-question.c
@@ -20,7 +20,7 @@
 ***/
 
 #include "resolved-dns-question.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 DnsQuestion *dns_question_new(unsigned n) {
         DnsQuestion *q;
diff --git a/src/resolve/resolved-dns-rr.c b/src/resolve/resolved-dns-rr.c
index 78d9e4a412..c1818eef9c 100644
--- a/src/resolve/resolved-dns-rr.c
+++ b/src/resolve/resolved-dns-rr.c
@@ -23,7 +23,7 @@
 
 #include "strv.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-rr.h"
 #include "resolved-dns-packet.h"
 #include "dns-type.h"
diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c
index 7369cbf50f..c25ac2216d 100644
--- a/src/resolve/resolved-dns-scope.c
+++ b/src/resolve/resolved-dns-scope.c
@@ -27,7 +27,7 @@
 #include "af-list.h"
 #include "random-util.h"
 #include "hostname-util.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-scope.h"
 
 #define MULTICAST_RATELIMIT_INTERVAL_USEC (1*USEC_PER_SEC)
diff --git a/src/resolve/resolved-dns-stream.c b/src/resolve/resolved-dns-stream.c
index 4c0b557bad..7f47e7223a 100644
--- a/src/resolve/resolved-dns-stream.c
+++ b/src/resolve/resolved-dns-stream.c
@@ -113,7 +113,8 @@ static int dns_stream_identify(DnsStream *s) {
 
         mh.msg_control = &control;
         mh.msg_controllen = sl;
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+
+        CMSG_FOREACH(cmsg, &mh) {
 
                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
                         assert(s->peer.sa.sa_family == AF_INET6);
diff --git a/src/resolve/resolved-dns-zone.c b/src/resolve/resolved-dns-zone.c
index a4c9b7d7af..32d771a954 100644
--- a/src/resolve/resolved-dns-zone.c
+++ b/src/resolve/resolved-dns-zone.c
@@ -22,7 +22,7 @@
 #include "list.h"
 
 #include "resolved-dns-zone.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-dns-packet.h"
 
 /* Never allow more than 1K entries */
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index 52695376f0..f8d4db7aad 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -34,7 +34,7 @@
 #include "random-util.h"
 #include "hostname-util.h"
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 #include "resolved-conf.h"
 #include "resolved-bus.h"
 #include "resolved-manager.h"
@@ -920,7 +920,7 @@ int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
         } else
                 return -EAFNOSUPPORT;
 
-        for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
+        CMSG_FOREACH(cmsg, &mh) {
 
                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
                         assert(p->family == AF_INET6);
diff --git a/src/run/run.c b/src/run/run.c
index 5b9f31c4aa..f18f77b55a 100644
--- a/src/run/run.c
+++ b/src/run/run.c
@@ -68,7 +68,7 @@ static void help(void) {
         printf("%s [OPTIONS...] {COMMAND} [ARGS...]\n\n"
                "Run the specified command in a transient scope or service or timer\n"
                "unit. If timer option is specified and unit is exist which is\n"
-               "specified with --unit option then command can be ommited.\n\n"
+               "specified with --unit option then command can be omitted.\n\n"
                "  -h --help                       Show this help\n"
                "     --version                    Show package version\n"
                "     --user                       Run as user unit\n"
diff --git a/src/libsystemd/sd-bus/bus-util.c b/src/shared/bus-util.c
index 99937799b3..8fcc289957 100644
--- a/src/libsystemd/sd-bus/bus-util.c
+++ b/src/shared/bus-util.c
@@ -1330,31 +1330,6 @@ int bus_parse_unit_info(sd_bus_message *message, UnitInfo *u) {
                         &u->job_path);
 }
 
-int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error) {
-        assert(m);
-
-        if (r < 0) {
-                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
-                        sd_bus_reply_method_errno(m, r, error);
-
-        } else if (sd_bus_error_is_set(error)) {
-                if (m->header->type == SD_BUS_MESSAGE_METHOD_CALL)
-                        sd_bus_reply_method_error(m, error);
-        } else
-                return r;
-
-        log_debug("Failed to process message [type=%s sender=%s path=%s interface=%s member=%s signature=%s]: %s",
-                  bus_message_type_to_string(m->header->type),
-                  strna(m->sender),
-                  strna(m->path),
-                  strna(m->interface),
-                  strna(m->member),
-                  strna(m->root_container.signature),
-                  bus_error_message(error, r));
-
-        return 1;
-}
-
 int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignment) {
         const char *eq, *field;
         int r;
diff --git a/src/libsystemd/sd-bus/bus-util.h b/src/shared/bus-util.h
index 999a372cdd..d8dba584d6 100644
--- a/src/libsystemd/sd-bus/bus-util.h
+++ b/src/shared/bus-util.h
@@ -188,8 +188,6 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(sd_bus_track*, sd_bus_track_unref);
         SD_BUS_PROPERTY(name, "t", bus_property_get_usec, (offset) + offsetof(struct dual_timestamp, realtime), (flags)), \
         SD_BUS_PROPERTY(name "Monotonic", "t", bus_property_get_usec, (offset) + offsetof(struct dual_timestamp, monotonic), (flags))
 
-int bus_maybe_reply_error(sd_bus_message *m, int r, sd_bus_error *error);
-
 int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignment);
 
 typedef struct BusWaitForJobs BusWaitForJobs;
diff --git a/src/resolve/resolved-dns-domain.c b/src/shared/dns-domain.c
index e1eb3ddfe5..20a44ce4e1 100644
--- a/src/resolve/resolved-dns-domain.c
+++ b/src/shared/dns-domain.c
@@ -24,7 +24,7 @@
 #include <stringprep.h>
 #endif
 
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 int dns_label_unescape(const char **name, char *dest, size_t sz) {
         const char *n;
diff --git a/src/resolve/resolved-dns-domain.h b/src/shared/dns-domain.h
index 516d244f7a..00caf5d700 100644
--- a/src/resolve/resolved-dns-domain.h
+++ b/src/shared/dns-domain.h
@@ -35,6 +35,15 @@ int dns_label_apply_idna(const char *encoded, size_t encoded_size, char *decoded
 int dns_label_undo_idna(const char *encoded, size_t encoded_size, char *decoded, size_t decoded_max);
 
 int dns_name_normalize(const char *s, char **_ret);
+static inline int dns_name_is_valid(const char *s) {
+        int r;
+        r = dns_name_normalize(s, NULL);
+        if (r == -EINVAL)
+                return 0;
+        if (r < 0)
+                return r;
+        return 1;
+}
 
 unsigned long dns_name_hash_func(const void *s, const uint8_t hash_key[HASH_KEY_SIZE]);
 int dns_name_compare_func(const void *a, const void *b);
diff --git a/src/shared/efivars.c b/src/shared/efivars.c
index d34d977b9a..0d6ecf52cf 100644
--- a/src/shared/efivars.c
+++ b/src/shared/efivars.c
@@ -483,7 +483,7 @@ int efi_add_boot_option(uint16_t id, const char *title,
         devicep->length = offsetof(struct device_path, drive) + sizeof(struct drive_path);
         devicep->drive.part_nr = part;
         devicep->drive.part_start = pstart;
-        devicep->drive.part_size =  psize;
+        devicep->drive.part_size = psize;
         devicep->drive.signature_type = SIGNATURE_TYPE_GUID;
         devicep->drive.mbr_type = MBR_TYPE_EFI_PARTITION_TABLE_HEADER;
         id128_to_efi_guid(part_uuid, devicep->drive.signature);
diff --git a/src/shared/machine-pool.c b/src/shared/machine-pool.c
index d27931cb4a..8c64908b1a 100644
--- a/src/shared/machine-pool.c
+++ b/src/shared/machine-pool.c
@@ -109,8 +109,8 @@ static int setup_machine_raw(uint64_t size, sd_bus_error *error) {
 
                 /* Child */
 
-                reset_all_signal_handlers();
-                reset_signal_mask();
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
                 assert_se(prctl(PR_SET_PDEATHSIG, SIGTERM) == 0);
 
                 fd = safe_close(fd);
diff --git a/src/shared/pager.c b/src/shared/pager.c
index 58b62fdccf..13f03e798b 100644
--- a/src/shared/pager.c
+++ b/src/shared/pager.c
@@ -30,6 +30,7 @@
 #include "process-util.h"
 #include "macro.h"
 #include "terminal-util.h"
+#include "signal-util.h"
 
 static pid_t pager_pid = 0;
 
@@ -85,6 +86,9 @@ int pager_open(bool jump_to_end) {
         if (pager_pid == 0) {
                 const char* less_opts;
 
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 dup2(fd[0], STDIN_FILENO);
                 safe_close_pair(fd);
 
@@ -178,6 +182,10 @@ int show_man_page(const char *desc, bool null_stdio) {
 
         if (pid == 0) {
                 /* Child */
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 if (null_stdio) {
                         r = make_null_stdio();
                         if (r < 0) {
diff --git a/src/shared/pty.c b/src/shared/pty.c
index 119d66e9a2..a87b3ce6f0 100644
--- a/src/shared/pty.c
+++ b/src/shared/pty.c
@@ -239,7 +239,7 @@ int pty_setup_child(Pty *pty) {
         assert_return(pty_is_child(pty), -EINVAL);
         assert_return(pty_is_open(pty), -EALREADY);
 
-        r = sigprocmask_many(SIG_SETMASK, -1);
+        r = reset_signal_mask();
         if (r < 0)
                 return r;
 
diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
index b3d90d2c33..5075e4e176 100644
--- a/src/systemctl/systemctl.c
+++ b/src/systemctl/systemctl.c
@@ -5189,6 +5189,9 @@ static int enable_sysv_units(const char *verb, char **args) {
                 else if (pid == 0) {
                         /* Child */
 
+                        (void) reset_all_signal_handlers();
+                        (void) reset_signal_mask();
+
                         execv(argv[0], (char**) argv);
                         log_error("Failed to execute %s: %m", argv[0]);
                         _exit(EXIT_FAILURE);
@@ -5854,6 +5857,9 @@ static int run_editor(char **paths) {
                 unsigned i = 1;
                 size_t argc;
 
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 argc = strv_length(paths)/2 + 1;
                 args = newa(const char*, argc + 1);
 
diff --git a/src/systemd/sd-bus.h b/src/systemd/sd-bus.h
index e6e2ecd0b7..57e46ced8e 100644
--- a/src/systemd/sd-bus.h
+++ b/src/systemd/sd-bus.h
@@ -299,6 +299,7 @@ int sd_bus_get_name_machine_id(sd_bus *bus, const char *name, sd_id128_t *machin
 /* Convenience calls */
 
 int sd_bus_call_method(sd_bus *bus, const char *destination, const char *path, const char *interface, const char *member, sd_bus_error *ret_error, sd_bus_message **reply, const char *types, ...);
+int sd_bus_call_method_async(sd_bus *bus, sd_bus_slot **slot, const char *destination, const char *path, const char *interface, const char *member, sd_bus_message_handler_t callback, void *userdata, const char *types, ...);
 int sd_bus_get_property(sd_bus *bus, const char *destination, const char *path, const char *interface, const char *member, sd_bus_error *ret_error, sd_bus_message **reply, const char *type);
 int sd_bus_get_property_trivial(sd_bus *bus, const char *destination, const char *path, const char *interface, const char *member, sd_bus_error *ret_error, char type, void *ret_ptr);
 int sd_bus_get_property_string(sd_bus *bus, const char *destination, const char *path, const char *interface, const char *member, sd_bus_error *ret_error, char **ret); /* free the result! */
diff --git a/src/test/test-cgroup-util.c b/src/test/test-cgroup-util.c
index 4a89f64518..ecc9d70bf4 100644
--- a/src/test/test-cgroup-util.c
+++ b/src/test/test-cgroup-util.c
@@ -244,16 +244,16 @@ static void test_escape(void) {
 }
 
 static void test_controller_is_valid(void) {
-        assert_se(cg_controller_is_valid("foobar", false));
-        assert_se(cg_controller_is_valid("foo_bar", false));
-        assert_se(cg_controller_is_valid("name=foo", true));
-        assert_se(!cg_controller_is_valid("", false));
-        assert_se(!cg_controller_is_valid("name=", true));
-        assert_se(!cg_controller_is_valid("=", false));
-        assert_se(!cg_controller_is_valid("cpu,cpuacct", false));
-        assert_se(!cg_controller_is_valid("_", false));
-        assert_se(!cg_controller_is_valid("_foobar", false));
-        assert_se(!cg_controller_is_valid("tatü", false));
+        assert_se(cg_controller_is_valid("foobar"));
+        assert_se(cg_controller_is_valid("foo_bar"));
+        assert_se(cg_controller_is_valid("name=foo"));
+        assert_se(!cg_controller_is_valid(""));
+        assert_se(!cg_controller_is_valid("name="));
+        assert_se(!cg_controller_is_valid("="));
+        assert_se(!cg_controller_is_valid("cpu,cpuacct"));
+        assert_se(!cg_controller_is_valid("_"));
+        assert_se(!cg_controller_is_valid("_foobar"));
+        assert_se(!cg_controller_is_valid("tatü"));
 }
 
 static void test_slice_to_path_one(const char *unit, const char *path, int error) {
diff --git a/src/test/test-copy.c b/src/test/test-copy.c
index 403d85bff0..e55ffaa16a 100644
--- a/src/test/test-copy.c
+++ b/src/test/test-copy.c
@@ -133,10 +133,45 @@ static void test_copy_tree(void) {
         (void) rm_rf(original_dir, REMOVE_ROOT|REMOVE_PHYSICAL);
 }
 
+static void test_copy_bytes(void) {
+        _cleanup_close_pair_ int pipefd[2] = {-1, -1};
+        _cleanup_close_ int infd = -1;
+        int r, r2;
+        char buf[1024], buf2[1024];
+
+        infd = open("/etc/os-release", O_RDONLY|O_CLOEXEC);
+        assert_se(infd >= 0);
+
+        assert_se(pipe2(pipefd, O_CLOEXEC) == 0);
+
+        r = copy_bytes(infd, pipefd[1], (off_t) -1, false);
+        assert_se(r == 0);
+
+        r = read(pipefd[0], buf, sizeof(buf));
+        assert_se(r >= 0);
+
+        assert_se(lseek(infd, 0, SEEK_SET) == 0);
+        r2 = read(infd, buf2, sizeof(buf2));
+        assert_se(r == r2);
+
+        assert_se(strneq(buf, buf2, r));
+
+        /* test copy_bytes with invalid descriptors */
+        r = copy_bytes(pipefd[0], pipefd[0], 1, false);
+        assert_se(r == -EBADF);
+
+        r = copy_bytes(pipefd[1], pipefd[1], 1, false);
+        assert_se(r == -EBADF);
+
+        r = copy_bytes(pipefd[1], infd, 1, false);
+        assert_se(r == -EBADF);
+}
+
 int main(int argc, char *argv[]) {
         test_copy_file();
         test_copy_file_fd();
         test_copy_tree();
+        test_copy_bytes();
 
         return 0;
 }
diff --git a/src/resolve/test-dns-domain.c b/src/test/test-dns-domain.c
index c3208abc78..527cdd3b54 100644
--- a/src/resolve/test-dns-domain.c
+++ b/src/test/test-dns-domain.c
@@ -20,7 +20,7 @@
  ***/
 
 #include "macro.h"
-#include "resolved-dns-domain.h"
+#include "dns-domain.h"
 
 static void test_dns_label_unescape_one(const char *what, const char *expect, size_t buffer_sz, int ret) {
         char buffer[buffer_sz];
diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
index 0045ae6824..fce4e81a09 100644
--- a/src/test/test-path-util.c
+++ b/src/test/test-path-util.c
@@ -312,9 +312,11 @@ static void test_prefix_root(void) {
 }
 
 static void test_path_is_mount_point(void) {
-        int fd, rt, rf, rlt, rlf;
+        int fd;
         char tmp_dir[] = "/tmp/test-path-is-mount-point-XXXXXX";
         _cleanup_free_ char *file1 = NULL, *file2 = NULL, *link1 = NULL, *link2 = NULL;
+        _cleanup_free_ char *dir1 = NULL, *dir1file = NULL, *dirlink1 = NULL, *dirlink1file = NULL;
+        _cleanup_free_ char *dir2 = NULL, *dir2file = NULL;
 
         assert_se(path_is_mount_point("/", AT_SYMLINK_FOLLOW) > 0);
         assert_se(path_is_mount_point("/", 0) > 0);
@@ -328,6 +330,19 @@ static void test_path_is_mount_point(void) {
         assert_se(path_is_mount_point("/sys", AT_SYMLINK_FOLLOW) > 0);
         assert_se(path_is_mount_point("/sys", 0) > 0);
 
+        /* we'll create a hierarchy of different kinds of dir/file/link
+         * layouts:
+         *
+         * <tmp>/file1, <tmp>/file2
+         * <tmp>/link1 -> file1, <tmp>/link2 -> file2
+         * <tmp>/dir1/
+         * <tmp>/dir1/file
+         * <tmp>/dirlink1 -> dir1
+         * <tmp>/dirlink1file -> dirlink1/file
+         * <tmp>/dir2/
+         * <tmp>/dir2/file
+         */
+
         /* file mountpoints */
         assert_se(mkdtemp(tmp_dir) != NULL);
         file1 = path_join(NULL, tmp_dir, "file1");
@@ -352,8 +367,43 @@ static void test_path_is_mount_point(void) {
         assert_se(path_is_mount_point(link1, AT_SYMLINK_FOLLOW) == 0);
         assert_se(path_is_mount_point(link1, 0) == 0);
 
-        /* this test will only work as root */
+        /* directory mountpoints */
+        dir1 = path_join(NULL, tmp_dir, "dir1");
+        assert_se(dir1);
+        assert_se(mkdir(dir1, 0755) == 0);
+        dirlink1 = path_join(NULL, tmp_dir, "dirlink1");
+        assert_se(dirlink1);
+        assert_se(symlink("dir1", dirlink1) == 0);
+        dirlink1file = path_join(NULL, tmp_dir, "dirlink1file");
+        assert_se(dirlink1file);
+        assert_se(symlink("dirlink1/file", dirlink1file) == 0);
+        dir2 = path_join(NULL, tmp_dir, "dir2");
+        assert_se(dir2);
+        assert_se(mkdir(dir2, 0755) == 0);
+
+        assert_se(path_is_mount_point(dir1, AT_SYMLINK_FOLLOW) == 0);
+        assert_se(path_is_mount_point(dir1, 0) == 0);
+        assert_se(path_is_mount_point(dirlink1, AT_SYMLINK_FOLLOW) == 0);
+        assert_se(path_is_mount_point(dirlink1, 0) == 0);
+
+        /* file in subdirectory mountpoints */
+        dir1file = path_join(NULL, dir1, "file");
+        assert_se(dir1file);
+        fd = open(dir1file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664);
+        assert_se(fd > 0);
+        close(fd);
+
+        assert_se(path_is_mount_point(dir1file, AT_SYMLINK_FOLLOW) == 0);
+        assert_se(path_is_mount_point(dir1file, 0) == 0);
+        assert_se(path_is_mount_point(dirlink1file, AT_SYMLINK_FOLLOW) == 0);
+        assert_se(path_is_mount_point(dirlink1file, 0) == 0);
+
+        /* these tests will only work as root */
         if (mount(file1, file2, NULL, MS_BIND, NULL) >= 0) {
+                int rt, rf, rlt, rlf, rl1t, rl1f;
+
+                /* files */
+                /* capture results in vars, to avoid dangling mounts on failure */
                 rf = path_is_mount_point(file2, 0);
                 rt = path_is_mount_point(file2, AT_SYMLINK_FOLLOW);
                 rlf = path_is_mount_point(link2, 0);
@@ -365,6 +415,33 @@ static void test_path_is_mount_point(void) {
                 assert_se(rt == 1);
                 assert_se(rlf == 0);
                 assert_se(rlt == 1);
+
+                /* dirs */
+                dir2file = path_join(NULL, dir2, "file");
+                assert_se(dir2file);
+                fd = open(dir2file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664);
+                assert_se(fd > 0);
+                close(fd);
+
+                assert_se(mount(dir2, dir1, NULL, MS_BIND, NULL) >= 0);
+
+                rf = path_is_mount_point(dir1, 0);
+                rt = path_is_mount_point(dir1, AT_SYMLINK_FOLLOW);
+                rlf = path_is_mount_point(dirlink1, 0);
+                rlt = path_is_mount_point(dirlink1, AT_SYMLINK_FOLLOW);
+                /* its parent is a mount point, but not /file itself */
+                rl1f = path_is_mount_point(dirlink1file, 0);
+                rl1t = path_is_mount_point(dirlink1file, AT_SYMLINK_FOLLOW);
+
+                assert_se(umount(dir1) == 0);
+
+                assert_se(rf == 1);
+                assert_se(rt == 1);
+                assert_se(rlf == 0);
+                assert_se(rlt == 1);
+                assert_se(rl1f == 0);
+                assert_se(rl1t == 0);
+
         } else
                 printf("Skipping bind mount file test: %m\n");
 
diff --git a/src/timesync/timesyncd-manager.c b/src/timesync/timesyncd-manager.c
index 88e9cf98ed..40e0fd31fe 100644
--- a/src/timesync/timesyncd-manager.c
+++ b/src/timesync/timesyncd-manager.c
@@ -528,7 +528,7 @@ static int manager_receive_response(sd_event_source *source, int fd, uint32_t re
         }
 
         recv_time = NULL;
-        for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+        CMSG_FOREACH(cmsg, &msghdr) {
                 if (cmsg->cmsg_level != SOL_SOCKET)
                         continue;
 
diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
index 4dcf8f2e1c..8d17c5e1e3 100644
--- a/src/udev/udev-event.c
+++ b/src/udev/udev-event.c
@@ -631,9 +631,9 @@ static int spawn_wait(struct udev_event *event,
                         if (timeout_warn_usec > 0 && timeout_warn_usec < timeout_usec && age_usec < timeout_warn_usec) {
                                 spawn.timeout_warn = timeout_warn_usec - age_usec;
 
-                                r =  sd_event_add_time(e, NULL, clock_boottime_or_monotonic(),
-                                                       usec + spawn.timeout_warn, USEC_PER_SEC,
-                                                       on_spawn_timeout_warning, &spawn);
+                                r = sd_event_add_time(e, NULL, clock_boottime_or_monotonic(),
+                                                      usec + spawn.timeout_warn, USEC_PER_SEC,
+                                                      on_spawn_timeout_warning, &spawn);
                                 if (r < 0)
                                         return r;
                         }
diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
index 915371525f..7be9a2311a 100644
--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -1941,7 +1941,7 @@ int udev_rules_apply_to_event(struct udev_rules *rules,
                         udev_list_entry_foreach(list_entry, udev_device_get_devlinks_list_entry(event->dev)) {
                                 const char *devlink;
 
-                                devlink =  udev_list_entry_get_name(list_entry) + strlen("/dev/");
+                                devlink = udev_list_entry_get_name(list_entry) + strlen("/dev/");
                                 if (match_key(rules, cur, devlink) == 0) {
                                         match = true;
                                         break;
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index eb43091190..2affb5944a 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -875,7 +875,7 @@ static int on_worker(sd_event_source *s, int fd, uint32_t revents, void *userdat
                         continue;
                 }
 
-                for (cmsg = CMSG_FIRSTHDR(&msghdr); cmsg; cmsg = CMSG_NXTHDR(&msghdr, cmsg)) {
+                CMSG_FOREACH(cmsg, &msghdr) {
                         if (cmsg->cmsg_level == SOL_SOCKET &&
                             cmsg->cmsg_type == SCM_CREDENTIALS &&
                             cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred)))
@@ -1638,7 +1638,7 @@ int main(int argc, char *argv[]) {
                 arg_children_max = 8;
 
                 if (sched_getaffinity(0, sizeof (cpu_set), &cpu_set) == 0) {
-                        arg_children_max +=  CPU_COUNT(&cpu_set) * 2;
+                        arg_children_max += CPU_COUNT(&cpu_set) * 2;
                 }
 
                 log_debug("set children_max to %u", arg_children_max);
diff --git a/src/vconsole/vconsole-setup.c b/src/vconsole/vconsole-setup.c
index 6c782b3130..f7728dcfff 100644
--- a/src/vconsole/vconsole-setup.c
+++ b/src/vconsole/vconsole-setup.c
@@ -37,6 +37,7 @@
 #include "fileio.h"
 #include "process-util.h"
 #include "terminal-util.h"
+#include "signal-util.h"
 
 static bool is_vconsole(int fd) {
         unsigned char data[1];
@@ -122,6 +123,10 @@ static int keyboard_load_and_wait(const char *vc, const char *map, const char *m
         if (pid < 0)
                 return log_error_errno(errno, "Failed to fork: %m");
         else if (pid == 0) {
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 execv(args[0], (char **) args);
                 _exit(EXIT_FAILURE);
         }
@@ -160,6 +165,10 @@ static int font_load_and_wait(const char *vc, const char *font, const char *map,
         if (pid < 0)
                 return log_error_errno(errno, "Failed to fork: %m");
         else if (pid == 0) {
+
+                (void) reset_all_signal_handlers();
+                (void) reset_signal_mask();
+
                 execv(args[0], (char **) args);
                 _exit(EXIT_FAILURE);
         }