diff --git a/meta-citadel/recipes-core/systemd/systemd-conf.bbappend b/meta-citadel/recipes-core/systemd/systemd-conf.bbappend
new file mode 100644
index 0000000..e61f991
--- /dev/null
+++ b/meta-citadel/recipes-core/systemd/systemd-conf.bbappend
@@ -0,0 +1,4 @@
+
+do_install_append() {
+    echo "a4e415feff81466c925aab34b0c35a3c" > ${D}${sysconfdir}/machine-id
+}
diff --git a/meta-citadel/recipes-core/systemd/systemd_237.bbappend b/meta-citadel/recipes-core/systemd/systemd_%.bbappend
similarity index 58%
rename from meta-citadel/recipes-core/systemd/systemd_237.bbappend
rename to meta-citadel/recipes-core/systemd/systemd_%.bbappend
index 0241643..35c3204 100644
--- a/meta-citadel/recipes-core/systemd/systemd_237.bbappend
+++ b/meta-citadel/recipes-core/systemd/systemd_%.bbappend
@@ -8,11 +8,11 @@ ALTERNATIVE_${PN}_remove = "resolv-conf"
 
 GROUPADD_PARAM_${PN} += "; -r kvm"
 PACKAGECONFIG = "\
-    efi ldconfig pam usrmerge rfkill backlight binfmt hostnamed ima localed logind machined myhostname \
-    nss polkit randomseed seccomp timedated utmp vconsole timesyncd \
+    efi acl ldconfig pam usrmerge rfkill backlight binfmt hostnamed localed logind machined myhostname \
+    nss polkit randomseed seccomp timedated utmp timesyncd kmod sysusers gshadow \
 "
 
 do_install_append() {
     rm -f ${D}${sysconfdir}/tmpfiles.d/00-create-volatile.conf
-    echo "a4e415feff81466c925aab34b0c35a3c" > ${D}${sysconfdir}/machine-id
+    ln -s rescue.target ${D}${systemd_unitdir}/system/kbrequest.target
 }
diff --git a/meta-citadel/recipes-initrd/systemd-initrd/files/0032-memfd.patch b/meta-citadel/recipes-initrd/systemd-initrd/files/0032-memfd.patch
deleted file mode 100644
index 2167650..0000000
--- a/meta-citadel/recipes-initrd/systemd-initrd/files/0032-memfd.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From 4acd56b6297b1f36e24c5e1d9f97ece24ad2b67f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Wed, 21 Feb 2018 14:04:50 +0100
-Subject: [PATCH] missing_syscall: when adding syscall replacements, use
- different names (#8229)
-
-In meson.build we check that functions are available using:
-    meson.get_compiler('c').has_function('foo')
-which checks the following:
-- if __stub_foo or __stub___foo are defined, return false
-- if foo is declared (a pointer to the function can be taken), return true
-- otherwise check for __builtin_memfd_create
-
-_stub is documented by glibc as
-   It defines a symbol '__stub_FUNCTION' for each function
-   in the C library which is a stub, meaning it will fail
-   every time called, usually setting errno to ENOSYS.
-
-So if __stub is defined, we know we don't want to use the glibc version, but
-this doesn't tell us if the name itself is defined or not. If it _is_ defined,
-and we define our replacement as an inline static function, we get an error:
-
-In file included from ../src/basic/missing.h:1358:0,
-                 from ../src/basic/util.h:47,
-                 from ../src/basic/calendarspec.h:29,
-                 from ../src/basic/calendarspec.c:34:
-../src/basic/missing_syscall.h:65:19: error: static declaration of 'memfd_create' follows non-static declaration
- static inline int memfd_create(const char *name, unsigned int flags) {
-                   ^~~~~~~~~~~~
-.../usr/include/bits/mman-shared.h:46:5: note: previous declaration of 'memfd_create' was here
- int memfd_create (const char *__name, unsigned int __flags) __THROW;
-     ^~~~~~~~~~~~
-
-To avoid this problem, call our inline functions different than glibc,
-and use a #define to map the official name to our replacement.
-
-Fixes #8099.
-
-v2:
-- use "missing_" as the prefix instead of "_"
-
-v3:
-- rebase and update for statx()
-
-  Unfortunately "statx" is also present in "struct statx", so the define
-  causes issues. Work around this by using a typedef.
-
-I checked that systemd compiles with current glibc
-(glibc-devel-2.26-24.fc27.x86_64) if HAVE_MEMFD_CREATE, HAVE_GETTID,
-HAVE_PIVOT_ROOT, HAVE_SETNS, HAVE_RENAMEAT2, HAVE_KCMP, HAVE_KEYCTL,
-HAVE_COPY_FILE_RANGE, HAVE_BPF, HAVE_STATX are forced to 0.
-
-Setting HAVE_NAME_TO_HANDLE_AT to 0 causes an issue, but it's not because of
-the define, but because of struct file_handle.
-
-(cherry picked from commit 5187dd2c403caf92d09f3491e41f1ceb3f10491f)
-(cherry picked from commit 7909254c7a8ee09d91b8b21fd779320b3e2fe716)
----
- src/basic/missing_syscall.h | 55 ++++++++++++++++++++++++++++++++-------------
- 1 file changed, 40 insertions(+), 15 deletions(-)
-
-diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h
-index 898116c7b..e2860fc26 100644
---- a/src/basic/missing_syscall.h
-+++ b/src/basic/missing_syscall.h
-@@ -23,9 +23,11 @@
- /* Missing glibc definitions to access certain kernel APIs */
- 
- #if !HAVE_DECL_PIVOT_ROOT
--static inline int pivot_root(const char *new_root, const char *put_old) {
-+static inline int missing_pivot_root(const char *new_root, const char *put_old) {
-         return syscall(SYS_pivot_root, new_root, put_old);
- }
-+
-+#  define pivot_root missing_pivot_root
- #endif
- 
- /* ======================================================================= */
-@@ -59,7 +61,7 @@ static inline int pivot_root(const char *new_root, const char *put_old) {
- #    endif
- #  endif
- 
--static inline int memfd_create(const char *name, unsigned int flags) {
-+static inline int missing_memfd_create(const char *name, unsigned int flags) {
- #  ifdef __NR_memfd_create
-         return syscall(__NR_memfd_create, name, flags);
- #  else
-@@ -67,6 +69,8 @@ static inline int memfd_create(const char *name, unsigned int flags) {
-         return -1;
- #  endif
- }
-+
-+#  define memfd_create missing_memfd_create
- #endif
- 
- /* ======================================================================= */
-@@ -106,7 +110,7 @@ static inline int memfd_create(const char *name, unsigned int flags) {
- #    endif
- #  endif
- 
--static inline int getrandom(void *buffer, size_t count, unsigned flags) {
-+static inline int missing_getrandom(void *buffer, size_t count, unsigned flags) {
- #  ifdef __NR_getrandom
-         return syscall(__NR_getrandom, buffer, count, flags);
- #  else
-@@ -114,14 +118,18 @@ static inline int getrandom(void *buffer, size_t count, unsigned flags) {
-         return -1;
- #  endif
- }
-+
-+#  define getrandom missing_getrandom
- #endif
- 
- /* ======================================================================= */
- 
- #if !HAVE_DECL_GETTID
--static inline pid_t gettid(void) {
-+static inline pid_t missing_gettid(void) {
-         return (pid_t) syscall(SYS_gettid);
- }
-+
-+#  define gettid missing_gettid
- #endif
- 
- /* ======================================================================= */
-@@ -149,7 +157,7 @@ struct file_handle {
-         unsigned char f_handle[0];
- };
- 
--static inline int name_to_handle_at(int fd, const char *name, struct file_handle *handle, int *mnt_id, int flags) {
-+static inline int missing_name_to_handle_at(int fd, const char *name, struct file_handle *handle, int *mnt_id, int flags) {
- #  ifdef __NR_name_to_handle_at
-         return syscall(__NR_name_to_handle_at, fd, name, handle, mnt_id, flags);
- #  else
-@@ -157,6 +165,8 @@ static inline int name_to_handle_at(int fd, const char *name, struct file_handle
-         return -1;
- #  endif
- }
-+
-+#  define name_to_handle_at missing_name_to_handle_at
- #endif
- 
- /* ======================================================================= */
-@@ -174,7 +184,7 @@ static inline int name_to_handle_at(int fd, const char *name, struct file_handle
- #    endif
- #  endif
- 
--static inline int setns(int fd, int nstype) {
-+static inline int missing_setns(int fd, int nstype) {
- #  ifdef __NR_setns
-         return syscall(__NR_setns, fd, nstype);
- #  else
-@@ -182,6 +192,8 @@ static inline int setns(int fd, int nstype) {
-         return -1;
- #  endif
- }
-+
-+#  define setns missing_setns
- #endif
- 
- /* ======================================================================= */
-@@ -227,7 +239,7 @@ static inline pid_t raw_getpid(void) {
- #    endif
- #  endif
- 
--static inline int renameat2(int oldfd, const char *oldname, int newfd, const char *newname, unsigned flags) {
-+static inline int missing_renameat2(int oldfd, const char *oldname, int newfd, const char *newname, unsigned flags) {
- #  ifdef __NR_renameat2
-         return syscall(__NR_renameat2, oldfd, oldname, newfd, newname, flags);
- #  else
-@@ -235,12 +247,14 @@ static inline int renameat2(int oldfd, const char *oldname, int newfd, const cha
-         return -1;
- #  endif
- }
-+
-+#  define renameat2 missing_renameat2
- #endif
- 
- /* ======================================================================= */
- 
- #if !HAVE_DECL_KCMP
--static inline int kcmp(pid_t pid1, pid_t pid2, int type, unsigned long idx1, unsigned long idx2) {
-+static inline int missing_kcmp(pid_t pid1, pid_t pid2, int type, unsigned long idx1, unsigned long idx2) {
- #  ifdef __NR_kcmp
-         return syscall(__NR_kcmp, pid1, pid2, type, idx1, idx2);
- #  else
-@@ -248,36 +262,45 @@ static inline int kcmp(pid_t pid1, pid_t pid2, int type, unsigned long idx1, uns
-         return -1;
- #  endif
- }
-+
-+#  define kcmp missing_kcmp
- #endif
- 
-+
- /* ======================================================================= */
- 
- #if !HAVE_DECL_KEYCTL
--static inline long keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4,unsigned long arg5) {
-+static inline long missing_keyctl(int cmd, unsigned long arg2, unsigned long arg3, unsigned long arg4,unsigned long arg5) {
- #  ifdef __NR_keyctl
-         return syscall(__NR_keyctl, cmd, arg2, arg3, arg4, arg5);
- #  else
-         errno = ENOSYS;
-         return -1;
- #  endif
-+
-+#  define keyctl missing_keyctl
- }
- 
--static inline key_serial_t add_key(const char *type, const char *description, const void *payload, size_t plen, key_serial_t ringid) {
-+static inline key_serial_t missing_add_key(const char *type, const char *description, const void *payload, size_t plen, key_serial_t ringid) {
- #  ifdef __NR_add_key
-         return syscall(__NR_add_key, type, description, payload, plen, ringid);
- #  else
-         errno = ENOSYS;
-         return -1;
- #  endif
-+
-+#  define add_key missing_add_key
- }
- 
--static inline key_serial_t request_key(const char *type, const char *description, const char * callout_info, key_serial_t destringid) {
-+static inline key_serial_t missing_request_key(const char *type, const char *description, const char * callout_info, key_serial_t destringid) {
- #  ifdef __NR_request_key
-         return syscall(__NR_request_key, type, description, callout_info, destringid);
- #  else
-         errno = ENOSYS;
-         return -1;
- #  endif
-+
-+#  define request_key missing_request_key
- }
- #endif
- 
-@@ -304,10 +327,10 @@ static inline key_serial_t request_key(const char *type, const char *description
- #    endif
- #  endif
- 
--static inline ssize_t copy_file_range(int fd_in, loff_t *off_in,
--                                      int fd_out, loff_t *off_out,
--                                      size_t len,
--                                      unsigned int flags) {
-+static inline ssize_t missing_copy_file_range(int fd_in, loff_t *off_in,
-+                                              int fd_out, loff_t *off_out,
-+                                              size_t len,
-+                                              unsigned int flags) {
- #  ifdef __NR_copy_file_range
-         return syscall(__NR_copy_file_range, fd_in, off_in, fd_out, off_out, len, flags);
- #  else
-@@ -315,4 +338,6 @@ static inline ssize_t copy_file_range(int fd_in, loff_t *off_in,
-         return -1;
- #  endif
- }
-+
-+#  define copy_file_range missing_copy_file_range
- #endif
diff --git a/meta-citadel/recipes-initrd/systemd-initrd/files/libmount.patch b/meta-citadel/recipes-initrd/systemd-initrd/files/libmount.patch
deleted file mode 100644
index b59d5b7..0000000
--- a/meta-citadel/recipes-initrd/systemd-initrd/files/libmount.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-From 227b8a762fea1458547be2cdf0e6e4aac0079730 Mon Sep 17 00:00:00 2001
-From: Michael Olbrich <m.olbrich@pengutronix.de>
-Date: Mon, 26 Mar 2018 17:34:53 +0200
-Subject: [PATCH] core: don't include libmount.h in a header file (#8580)
-
-linux/fs.h sys/mount.h, libmount.h and missing.h all include MS_*
-definitions.
-
-To avoid problems, only one of linux/fs.h, sys/mount.h and libmount.h
-should be included. And missing.h must be included last.
-
-Without this, building systemd may fail with:
-
-In file included from [...]/libmount/libmount.h:31:0,
-                 from ../systemd-238/src/core/manager.h:23,
-                 from ../systemd-238/src/core/emergency-action.h:37,
-                 from ../systemd-238/src/core/unit.h:34,
-                 from ../systemd-238/src/core/dbus-timer.h:25,
-                 from ../systemd-238/src/core/timer.c:26:
-[...]/sys/mount.h:57:2: error: expected identifier before numeric constant
----
- src/core/dbus-execute.c | 1 +
- src/core/manager.h      | 3 ++-
- src/core/mount.c        | 2 ++
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
-index 7344623ebf6..c342093bca4 100644
---- a/src/core/dbus-execute.c
-+++ b/src/core/dbus-execute.c
-@@ -18,6 +18,7 @@
-   along with systemd; If not, see <http://www.gnu.org/licenses/>.
- ***/
- 
-+#include <sys/mount.h>
- #include <sys/prctl.h>
- #include <stdio_ext.h>
- 
-diff --git a/src/core/manager.h b/src/core/manager.h
-index 28c5da225b1..e09e0cdf5e9 100644
---- a/src/core/manager.h
-+++ b/src/core/manager.h
-@@ -20,7 +20,6 @@
-   along with systemd; If not, see <http://www.gnu.org/licenses/>.
- ***/
- 
--#include <libmount.h>
- #include <stdbool.h>
- #include <stdio.h>
- 
-@@ -34,6 +33,8 @@
- #include "list.h"
- #include "ratelimit.h"
- 
-+struct libmnt_monitor;
-+
- /* Enforce upper limit how many names we allow */
- #define MANAGER_MAX_NAMES 131072 /* 128K */
- 
-diff --git a/src/core/mount.c b/src/core/mount.c
-index 0e755da5c02..0154ebda5d6 100644
---- a/src/core/mount.c
-+++ b/src/core/mount.c
-@@ -23,6 +23,8 @@
- #include <stdio.h>
- #include <sys/epoll.h>
- 
-+#include <libmount.h>
-+
- #include "sd-messages.h"
- 
- #include "alloc-util.h"
diff --git a/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_234.bb b/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_234.bb
deleted file mode 100644
index 044302a..0000000
--- a/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_234.bb
+++ /dev/null
@@ -1,348 +0,0 @@
-
-SUMMARY = "systemd configured for use in initramfs"
-HOMEPAGE = "http://www.freedesktop.org/wiki/Software/systemd"
-
-LICENSE = "GPLv2 & LGPLv2.1"
-LIC_FILES_CHKSUM = "file://LICENSE.GPL2;md5=751419260aa954499f7abaabaa882bbe \
-                    file://LICENSE.LGPL2.1;md5=4fbd65380cdd255951079008b364516c"
-
-DEPENDS = "intltool-native gperf-native libcap libcgroup util-linux kmod cryptsetup"
-inherit useradd pkgconfig autotools 
-SRCREV = "c1edab7ad1e7ccc9be693bedfd464cd1cbffb395"
-
-# Added by useradd class
-DEPENDS_remove = "base-files"
-
-SRC_URI = "git://github.com/systemd/systemd.git;protocol=git"
-
-SRC_URI += "file://0032-memfd.patch \
-            file://libmount.patch \
-"
-S = "${WORKDIR}/git"
-
-USERADD_PACKAGES = "${PN}"
-GROUPADD_PARAM_${PN} = "-r lock; -r systemd-journal; -r kvm"
-# Hardcode target binary paths to avoid AC_PROG_PATH in the systemd
-# configure script detecting and setting paths from sysroot or host.
-CACHED_CONFIGUREVARS_class-target = " \
-    ac_cv_path_KEXEC=${sbindir}/kexec \
-    ac_cv_path_KILL=${base_bindir}/kill \
-    ac_cv_path_KMOD=${base_bindir}/kmod \
-    ac_cv_path_MOUNT_PATH=${base_bindir}/mount \
-    ac_cv_path_QUOTACHECK=${sbindir}/quotacheck \
-    ac_cv_path_QUOTAON=${sbindir}/quotaon \
-    ac_cv_path_SULOGIN=${base_sbindir}/sulogin \
-    ac_cv_path_UMOUNT_PATH=${base_bindir}/umount \
-"
-
-# Helper variables to clarify locations.  This mirrors the logic in systemd's
-# build system.
-rootprefix ?= "${root_prefix}"
-rootlibdir ?= "${base_libdir}"
-systemd_unitdir = "${rootprefix}/lib"
-
-EXTRA_OECONF = " \
-    --without-python \
-    --with-rootlibdir=${rootlibdir} \
-    --with-rootprefix=${rootprefix} \
-    --with-sysvrcnd-path=${sysconfdir} \
-    --disable-audit \
-    --disable-binfmt \
-    --disable-bzip2 \
-    --disable-coredump \
-    --disable-dbus \
-    --disable-efi \
-    --disable-elfutils \
-    --disable-firstboot \
-    --disable-gcrypt \
-    --disable-hibernate \
-    --disable-ima \
-    --disable-importd \
-    --disable-libiptc \
-    --disable-libcurl \
-    --disable-libidn \
-    --disable-localed \
-    --disable-lz4 \
-    --disable-machined \
-    --disable-manpages \
-    --disable-microhttpd \
-    --disable-myhostname \
-    --disable-networkd \
-    --disable-nss-systemd \
-    --disable-pam \
-    --disable-polkit \
-    --disable-qrencode \
-    --disable-quotacheck \
-    --disable-randomseed \
-    --disable-resolved \
-    --disable-rfkill \
-    --disable-seccomp \
-    --disable-selinux \
-    --disable-smack \
-    --disable-sysusers \
-    --disable-timedated \
-    --disable-timesyncd \
-    --disable-utmp \
-    --disable-xkbcommon \
-    --disable-xz \
-    --disable-zlib \
-    \
-    --enable-backlight \
-    --enable-libcryptsetup \
-    --enable-split-usr \
-    --enable-vconsole \
-    --enable-logind \
-"
-
-COMPILER_NM ?= "${HOST_PREFIX}gcc-nm"
-COMPILER_AR ?= "${HOST_PREFIX}gcc-ar"
-COMPILER_RANLIB ?= "${HOST_PREFIX}gcc-ranlib"
-
-do_configure_prepend() {
-	export NM="${COMPILER_NM}"
-	export AR="${COMPILER_AR}"
-	export RANLIB="${COMPILER_RANLIB}"
-	export KMOD="${base_bindir}/kmod"
-	if [ -d ${S}/units.pre_sed ] ; then
-		cp -r ${S}/units.pre_sed ${S}/units
-	else
-		cp -r ${S}/units ${S}/units.pre_sed
-	fi
-	sed -i -e 's:-DTEST_DIR=\\\".*\\\":-DTEST_DIR=\\\"${PTEST_PATH}/tests/test\\\":' ${S}/Makefile.am
-	sed -i -e 's:-DCATALOG_DIR=\\\".*\\\":-DCATALOG_DIR=\\\"${PTEST_PATH}/tests/catalog\\\":' ${S}/Makefile.am
-}
-
-do_install() {
-	autotools_do_install
-	# Provide support for initramfs
-        install -d ${D}/sysroot
-	[ ! -e ${D}/init ] && ln -s ${systemd_unitdir}/systemd/systemd ${D}/init
-	#[ ! -e ${D}/${base_sbindir}/udevd ] && ln -s ${systemd_unitdir}/systemd/systemd-udevd ${D}/${base_sbindir}/udevd
-
-	# Create machine-id
-	# 20:12 < mezcalero> koen: you have three options: a) run systemd-machine-id-setup at install time, b) have / read-only and an empty file there (for stateless) and c) boot with / writable
-	touch ${D}${sysconfdir}/machine-id
-
-	install -d ${D}${sysconfdir}/udev/rules.d/
-	install -d ${D}${sysconfdir}/tmpfiles.d
-	#install -m 0644 ${WORKDIR}/*.rules ${D}${sysconfdir}/udev/rules.d/
-	#install -d ${D}${libdir}/pkgconfig
-	#install -m 0644 ${B}/src/udev/udev.pc ${D}${libdir}/pkgconfig/
-
-	#install -m 0644 ${WORKDIR}/00-create-volatile.conf ${D}${sysconfdir}/tmpfiles.d/
-
-	#chown root:systemd-journal ${D}/${localstatedir}/log/journal
-
-	# Delete journal README, as log can be symlinked inside volatile.
-	rm -f ${D}/${localstatedir}/log/README
-
-	# Set the maximium size of runtime journal to 64M as default
-	sed -i -e 's/.*RuntimeMaxUse.*/RuntimeMaxUse=64M/' ${D}${sysconfdir}/systemd/journald.conf
-
-	# this file is needed to exist if networkd is disabled but timesyncd is still in use since timesyncd checks it
-	# for existence else it fails
-	if [ -s ${D}${exec_prefix}/lib/tmpfiles.d/systemd.conf ]; then
-		${@bb.utils.contains('PACKAGECONFIG', 'networkd', ':', 'sed -i -e "\$ad /run/systemd/netif/links 0755 root root -" ${D}${exec_prefix}/lib/tmpfiles.d/systemd.conf', d)}
-	fi
-	if ! ${@bb.utils.contains('PACKAGECONFIG', 'resolved', 'true', 'false', d)}; then
-		echo 'L! ${sysconfdir}/resolv.conf - - - - ../run/systemd/resolve/resolv.conf' >>${D}${exec_prefix}/lib/tmpfiles.d/etc.conf
-		echo 'd /run/systemd/resolve 0755 root root -' >>${D}${exec_prefix}/lib/tmpfiles.d/systemd.conf
-		echo 'f /run/systemd/resolve/resolv.conf 0644 root root' >>${D}${exec_prefix}/lib/tmpfiles.d/systemd.conf
-		ln -s ../run/systemd/resolve/resolv.conf ${D}${sysconfdir}/resolv-conf.systemd
-	else
-		sed -i -e "s%^L! /etc/resolv.conf.*$%L! /etc/resolv.conf - - - - ../run/systemd/resolve/resolv.conf%g" ${D}${exec_prefix}/lib/tmpfiles.d/etc.conf
-		ln -s ../run/systemd/resolve/resolv.conf ${D}${sysconfdir}/resolv-conf.systemd
-	fi
-	install -Dm 0755 ${S}/src/systemctl/systemd-sysv-install.SKELETON ${D}${systemd_system_unitdir}/systemd-sysv-install
-
-	# If polkit is setup fixup permissions and ownership
-	if ${@bb.utils.contains('PACKAGECONFIG', 'polkit', 'true', 'false', d)}; then
-		if [ -d ${D}${datadir}/polkit-1/rules.d ]; then
-			chmod 700 ${D}${datadir}/polkit-1/rules.d
-			chown polkitd:root ${D}${datadir}/polkit-1/rules.d
-		fi
-	fi
-}
-
-PACKAGES += "${PN}-analyze ${PN}-not-used"
-
-FILES_${PN}-analyze = "${bindir}/systemd-analyze"
-RDEPENDS_${PN}-analyze = "${PN}"
-
-RDEPENDS_${PN}-not-used = "bash"
-FILES_${PN}-not-used = "\
-    ${sysconfdir} \
-    ${datadir}/zsh \
-    ${datadir}/dbus-1 \
-    ${datadir}/bash-completion \
-    ${datadir}/factory \
-    ${libdir}/udev/hwdb.d \
-    ${libdir}/udev/collect \
-    ${libdir}/udev/v4l_id \
-    ${libdir}/udev/mtd_probe \
-    ${libdir}/rpm \
-    ${libdir}/environment.d \
-    ${libdir}/kernel/install.d \
-    ${libdir}/modules-load.d \
-    ${libdir}/tmpfiles.d \
-    ${bindir}/systemd-* \
-    ${bindir}/busctl \
-    ${bindir}/hostnamectl \
-    ${bindir}/loginctl \
-    ${bindir}/kernel-install \
-    ${systemd_unitdir}/systemd/systemd-hostnamed \
-    ${systemd_unitdir}/systemd/systemd-backlight \
-    ${systemd_unitdir}/systemd/systemd-logind \
-    ${systemd_unitdir}/systemd/systemd-socket-proxyd \
-    ${systemd_unitdir}/systemd/systemd-sleep \
-    ${systemd_unitdir}/systemd/systemd-volatile-root \
-    ${systemd_unitdir}/systemd/systemd-dissect \
-    ${systemd_unitdir}/systemd/systemd-remount-fs \
-    ${systemd_unitdir}/systemd/systemd-ac-power \
-    ${systemd_unitdir}/systemd/systemd-update-done \
-    ${systemd_unitdir}/systemd/systemd-initctl \
-    ${systemd_unitdir}/systemd \
-    ${localstatedir}/lib/systemd \
-"
-
-INSANE_SKIP_${PN} += "dev-so"
-PRIVATE_LIBS = "libsystemd-shared-${PV}.so libsystemd.so.0 libudev.so.1"
-
-FILES_${PN} = "\
-    ${libdir}/libudev* \
-    ${libdir}/libsystemd* \
-    ${systemd_unitdir}/systemd/libsystemd-shared* \
-    \
-    ${systemd_unitdir}/systemd/systemd \
-    ${systemd_unitdir}/systemd/systemd-cgroups-agent \
-    ${systemd_unitdir}/systemd/systemd-cryptsetup \
-    ${systemd_unitdir}/systemd/systemd-shutdown \
-    ${systemd_unitdir}/systemd/systemd-reply-password \
-    ${systemd_unitdir}/systemd/systemd-fsck \
-    ${systemd_unitdir}/systemd/systemd-udevd \
-    ${systemd_unitdir}/systemd/systemd-journald \
-    ${systemd_unitdir}/systemd/systemd-sysctl \
-    ${systemd_unitdir}/systemd/systemd-modules-load \
-    ${systemd_unitdir}/systemd/systemd-veritysetup \
-    ${systemd_unitdir}/systemd/systemd-vconsole-setup \
-    ${systemd_unitdir}/systemd/system-generators/systemd-fstab-generator \
-    ${systemd_unitdir}/systemd/system-generators/systemd-gpt-auto-generator \
-    ${systemd_unitdir}/systemd/system-generators/systemd-cryptsetup-generator \
-    \
-    ${systemd_system_unitdir}/cryptsetup-pre.target \
-    ${systemd_system_unitdir}/cryptsetup.target \
-    ${systemd_system_unitdir}/emergency.target \
-    ${systemd_system_unitdir}/emergency.service \
-    ${systemd_system_unitdir}/sysinit.target \
-    ${systemd_system_unitdir}/basic.target \
-    ${systemd_system_unitdir}/halt.target \
-    ${systemd_system_unitdir}/kexec.target \
-    ${systemd_system_unitdir}/local-fs.target \
-    ${systemd_system_unitdir}/local-fs-pre.target \
-    ${systemd_system_unitdir}/remote-fs.target \
-    ${systemd_system_unitdir}/remote-fs-pre.target \
-    ${systemd_system_unitdir}/multi-user.target \
-    ${systemd_system_unitdir}/network.target \
-    ${systemd_system_unitdir}/network-pre.target \
-    ${systemd_system_unitdir}/network-online.target \
-    ${systemd_system_unitdir}/nss-lookup.target \
-    ${systemd_system_unitdir}/nss-user-lookup.target \
-    ${systemd_system_unitdir}/poweroff.target \
-    ${systemd_system_unitdir}/reboot.target \
-    ${systemd_system_unitdir}/rescue.target \
-    ${systemd_system_unitdir}/rpcbind.target \
-    ${systemd_system_unitdir}/shutdown.target \
-    ${systemd_system_unitdir}/final.target \
-    ${systemd_system_unitdir}/sigpwr.target \
-    ${systemd_system_unitdir}/sockets.target \
-    ${systemd_system_unitdir}/swap.target \
-    ${systemd_system_unitdir}/timers.target \
-    ${systemd_system_unitdir}/paths.target \
-    ${systemd_system_unitdir}/umount.target \
-    \
-    ${systemd_system_unitdir}/sys-kernel-config.mount \
-    \
-    ${systemd_system_unitdir}/kmod-static-nodes.service \
-    ${systemd_system_unitdir}/systemd-tmpfiles-setup.service \
-    ${systemd_system_unitdir}/systemd-tmpfiles-setup-dev.service \
-    ${systemd_system_unitdir}/systemd-ask-password-console.path \
-    ${systemd_system_unitdir}/systemd-udevd-control.socket \
-    ${systemd_system_unitdir}/systemd-udevd-kernel.socket \
-    ${systemd_system_unitdir}/systemd-ask-password-plymouth.path \
-    ${systemd_system_unitdir}/systemd-journald.socket \
-    ${systemd_system_unitdir}/systemd-journald-audit.socket \
-    ${systemd_system_unitdir}/systemd-ask-password-console.service \
-    ${systemd_system_unitdir}/systemd-modules-load.service \
-    ${systemd_system_unitdir}/systemd-halt.service \
-    ${systemd_system_unitdir}/systemd-poweroff.service \
-    ${systemd_system_unitdir}/systemd-reboot.service \
-    ${systemd_system_unitdir}/systemd-kexec.service \
-    ${systemd_system_unitdir}/systemd-fsck@.service \
-    ${systemd_system_unitdir}/systemd-udevd.service \
-    ${systemd_system_unitdir}/systemd-udev-trigger.service \
-    ${systemd_system_unitdir}/systemd-udev-settle.service \
-    ${systemd_system_unitdir}/systemd-ask-password-plymouth.service \
-    ${systemd_system_unitdir}/systemd-journald.service \
-    ${systemd_system_unitdir}/systemd-vconsole-setup.service \
-    ${systemd_system_unitdir}/systemd-random-seed-load.service \
-    ${systemd_system_unitdir}/systemd-random-seed.service \
-    ${systemd_system_unitdir}/systemd-sysctl.service \
-    \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-modules-load.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-ask-password-console.path \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-journald.service \
-    ${systemd_system_unitdir}/sockets.target.wants/systemd-udevd-control.socket \
-    ${systemd_system_unitdir}/sockets.target.wants/systemd-udevd-kernel.socket \
-    ${systemd_system_unitdir}/sockets.target.wants/systemd-journald.socket \
-    ${systemd_system_unitdir}/sockets.target.wants/systemd-journald-audit.socket \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-udevd.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-udev-trigger.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/kmod-static-nodes.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-tmpfiles-setup-dev.service \
-    ${systemd_system_unitdir}/sysinit.target.wants/systemd-sysctl.service \
-    \
-    ${systemd_system_unitdir}/ctrl-alt-del.target \
-    ${systemd_system_unitdir}/reboot.target \
-    ${systemd_system_unitdir}/systemd-reboot.service \
-    ${systemd_system_unitdir}/syslog.socket \
-    \
-    ${systemd_system_unitdir}/slices.target \
-    ${systemd_system_unitdir}/system.slice \
-    ${systemd_system_unitdir}/-.slice \
-    \
-    ${libdir}/sysctl.d/50-default.conf \
-    ${libdir}/tmpfiles.d/systemd.conf \
-    ${libdir}/udev/rules.d \
-    ${libdir}/udev/ata_id \
-    ${libdir}/udev/cdrom_id \
-    ${libdir}/udev/scsi_id \
-    \
-    ${bindir}/journalctl \
-    ${bindir}/systemctl \
-    ${bindir}/systemd-ask-password \
-    ${bindir}/systemd-run \
-    ${bindir}/systemd-escape \
-    ${bindir}/systemd-cgls \
-    ${bindir}/systemd-tmpfiles \
-    ${bindir}/systemd-tty-ask-password-agent \
-    ${bindir}/udevadm \
-    \
-    ${systemd_system_unitdir}/initrd.target \
-    ${systemd_system_unitdir}/initrd-fs.target \
-    ${systemd_system_unitdir}/initrd-root-device.target \
-    ${systemd_system_unitdir}/initrd-fs.target \
-    ${systemd_system_unitdir}/initrd-root-fs.target \
-    ${systemd_system_unitdir}/initrd-switch-root.target \
-    ${systemd_system_unitdir}/initrd-switch-root.service \
-    ${systemd_system_unitdir}/initrd-cleanup.service \
-    ${systemd_system_unitdir}/initrd-udevadm-cleanup-db.service \
-    ${systemd_system_unitdir}/initrd-parse-etc.service \
-    \
-    ${localstatedir}/log \
-    ${localstatedir}/volatile/log \
-    /init \
-    /sysroot \
-    \
-    ${systemd_unitdir}/systemd/systemd-sulogin-shell \
-"
diff --git a/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_239.bb b/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_239.bb
new file mode 100644
index 0000000..cf49e4a
--- /dev/null
+++ b/meta-citadel/recipes-initrd/systemd-initrd/systemd-initrd_239.bb
@@ -0,0 +1,141 @@
+
+
+FILESEXTRAPATHS_prepend := "${COREBASE}/meta/recipes-core/systemd/systemd:"
+require ${COREBASE}/meta/recipes-core/systemd/systemd_${PV}.bb
+
+PROVIDES_remove = "udev"
+RDEPENDS_${PN}_remove = "dbus"
+
+PACKAGECONFIG = "acl cryptsetup usrmerge kmod"
+
+do_install() {
+    meson_do_install
+
+    install -d ${D}/sysroot
+    [ ! -e ${D}/init ] && ln -s ${rootlibexecdir}/systemd/systemd ${D}/init
+
+    chown root:systemd-journal ${D}/${localstatedir}/log/journal
+}
+
+ALTERNATIVE_${PN}_remove = "resolv-conf"
+
+sockets_wants = "${systemd_system_unitdir}/sockets.target.wants"
+sysinit_wants = "${systemd_system_unitdir}/sysinit.target.wants"
+SYSTEMD_WANTS = "\
+    ${sockets_wants}/systemd-journald-audit.socket \
+    ${sockets_wants}/systemd-journald.socket \
+    ${sockets_wants}/systemd-journald-udevd-control.socket \
+    ${sockets_wants}/systemd-journald-udevd-kernel.socket \
+    \
+    ${sysinit_wants}/kmod-static-nodes.service \
+    ${sysinit_wants}/systemd-ask-password-console.path \
+    ${sysinit_wants}/systemd-journald.service \
+    ${sysinit_wants}/systemd-modules-load.service \
+    ${sysinit_wants}/systemd-sysctl.service \
+    ${sysinit_wants}/systemd-udev-trigger.service \
+    ${sysinit_wants}/systemd-udevd.service \
+"
+SYSTEMD_TARGETS = "\
+    ${systemd_system_unitdir}/sysinit.target \
+    ${systemd_system_unitdir}/basic.target \
+    ${systemd_system_unitdir}/cryptsetup-pre.target \
+    ${systemd_system_unitdir}/cryptsetup.target \
+    ${systemd_system_unitdir}/sockets.target \
+    ${systemd_system_unitdir}/paths.target \
+    ${systemd_system_unitdir}/slices.target \
+    ${systemd_system_unitdir}/halt.target \
+    ${systemd_system_unitdir}/poweroff.target \
+    ${systemd_system_unitdir}/reboot.target \
+    ${systemd_system_unitdir}/rescue.target \
+    ${systemd_system_unitdir}/shutdown.target \
+    ${systemd_system_unitdir}/final.target \
+    ${systemd_system_unitdir}/sigpwr.target \
+    ${systemd_system_unitdir}/sockets.target \
+    ${systemd_system_unitdir}/swap.target \
+    ${systemd_system_unitdir}/timers.target \
+    ${systemd_system_unitdir}/paths.target \
+    ${systemd_system_unitdir}/umount.target \
+    ${systemd_system_unitdir}/local-fs.target \
+    ${systemd_system_unitdir}/local-fs-pre.target \
+"
+
+generators = "${systemd_unitdir}/system-generators"
+SYSTEMD_GENERATORS = "\
+    ${generators}/systemd-debug-generator \
+    ${generators}/systemd-cryptsetup-generator \
+    ${generators}/systemd-fstab-generator \
+"
+
+SYSTEMD_BINARIES = "\
+    ${bindir}/journalctl \
+    ${bindir}/systemctl \
+    ${bindir}/systemd-ask-password \
+    ${bindir}/systemd-run \
+    ${bindir}/systemd-escape \
+    ${bindir}/systemd-cgls \
+    ${bindir}/systemd-tmpfiles \
+    ${bindir}/systemd-tty-ask-password-agent \
+"
+
+SYSTEMD_UNITS = "\
+    ${systemd_system_unitdir}/emergency.target \
+    ${systemd_system_unitdir}/emergency.service \
+    ${systemd_system_unitdir}/rescue.target \
+    ${systemd_system_unitdir}/rescue.service \
+    ${systemd_system_unitdir}/debug-shell.service \
+    \
+    ${systemd_system_unitdir}/initrd.target \
+    ${systemd_system_unitdir}/initrd-fs.target \
+    ${systemd_system_unitdir}/initrd-root-device.target \
+    ${systemd_system_unitdir}/initrd-root-fs.target \
+    ${systemd_system_unitdir}/initrd-switch-root.target \
+    ${systemd_system_unitdir}/initrd-switch-root.service \
+    ${systemd_system_unitdir}/initrd-cleanup.service \
+    ${systemd_system_unitdir}/initrd-udevadm-cleanup-db.service \
+    ${systemd_system_unitdir}/initrd-parse-etc.service \
+    ${systemd_system_unitdir}/kmod-static-nodes.service \
+    ${systemd_system_unitdir}/systemd-ask-password-console.path \
+    ${systemd_system_unitdir}/systemd-ask-password-console.service \
+    ${systemd_system_unitdir}/systemd-journald.service \
+    ${systemd_system_unitdir}/systemd-ask-password-plymouth.path \
+    ${systemd_system_unitdir}/systemd-ask-password-plymouth.service \
+    ${systemd_system_unitdir}/systemd-fsck@.service \
+    ${systemd_system_unitdir}/systemd-fsck-root.service \
+    ${systemd_system_unitdir}/systemd-journald.socket \
+    ${systemd_system_unitdir}/systemd-journald-audit.socket \
+    ${systemd_system_unitdir}/systemd-udevd-control.socket \
+    ${systemd_system_unitdir}/systemd-udevd-kernel.socket \
+    ${systemd_system_unitdir}/systemd-modules-load.service \
+    ${systemd_system_unitdir}/systemd-sysctl.service \
+    ${systemd_system_unitdir}/systemd-udevd.service \
+    ${systemd_system_unitdir}/systemd-udev-trigger.service \
+    ${systemd_system_unitdir}/systemd-udev-settle.service \
+    ${systemd_system_unitdir}/systemd-volatile-root \
+"
+
+FILES_${PN} = "\
+    /init /sysroot \
+    ${libdir}/lib* \
+    ${libdir}/sysctl.d/50-default.conf \
+    ${libdir}/tmpfiles.d/systemd.conf \
+    ${systemd_unitdir}/libsystemd* \
+    ${systemd_unitdir}/systemd* \
+    ${base_sbindir} \
+    ${SYSTEMD_WANTS} \
+    ${SYSTEMD_TARGETS} \
+    ${SYSTEMD_UNITS} \
+    ${SYSTEMD_GENERATORS} \
+    ${SYSTEMD_BINARIES} \
+"
+python populate_packages_prepend() {
+    # hack to sabotage do_split_packages
+    d.setVar("rootlibdir", "/nowhere")
+}
+
+PRIVATE_LIBS = "libsystemd-shared-${PV}.so libsystemd.so.0 libudev.so.1"
+
+PACKAGES = "${PN} ${PN}-dbg ${PN}-dev ${PN}-unused"
+RDEPENDS_${PN}-unused += "bash ${PN}"
+FILES_${PN}-unused = "/"
+
+