diff --git a/features.in/Makefile b/features.in/Makefile
index 640afc35..0e0434c1 100644
--- a/features.in/Makefile
+++ b/features.in/Makefile
@@ -36,8 +36,8 @@ include $(BUILDDIR)/distcfg.mk
 
 # first rsync what's static, and make backups (*~) --
 # these might signal of file clashes (or plain dirt);
-# second, care for toplevel and tagged script dirs;
-# then handle two more ways of implementing a feature
+# second, care for toplevel dirs;
+# then handle feature generator scripts
 #
 # NB: some subprofiles will be specified as "src/dst"
 #     -- then both src/ and dst/ can hold the addons;
@@ -58,6 +58,11 @@ prep:
 	fi
 
 # feat
+# NB: this is somewhat complicated since it has to handle "$sub" like:
+#     - "/": copy feature's toplevel parts to the BUILDDIR toplevel
+#     - "stage1": copy feature's stage1 parts into stage1 subprofile
+#     - "stage2@live": copy feature's stage2 parts into live subprofile
+#     - "rootfs@/": copy feature's rootfs parts into BUILDDIR toplevel
 $(FEATURES):
 	@feat=$@; \
 	if [ -n "$(GLOBAL_DEBUG)" ]; then \
@@ -71,6 +76,13 @@ $(FEATURES):
 		else \
 			src="$${sub%@*}"; \
 			dst="$${sub#*@}"; \
+			if [ "$$src" = / ]; then \
+				echo "** src=/: you don't want this" >&2; \
+				exit 1; \
+			fi; \
+			if [ "$$dst" = / -o "$$dst" = "" ]; then \
+				dst="."; \
+			fi; \
 			srcdirs=; \
 			if [ -d "$$src" ]; then \
 				srcdirs="$$src"; \
@@ -78,9 +90,9 @@ $(FEATURES):
 			if [ -d "$$dst" -a "$$dst" != "$$src" ]; then \
 				srcdirs="$${srcdirs:+$$srcdirs }$$dst"; \
 			fi; \
+			: "why this overduplication was done? (still needed)"; \
 			for srcdir in $$srcdirs; do \
-				rsync -qab --exclude tagged \
-					"$$srcdir/" "$(BUILDDIR)/$$dst/"; \
+				rsync -qab "$$srcdir/" "$(BUILDDIR)/$$dst/"; \
 			done; \
 		fi; \
 		if [ -n "$(GLOBAL_DEBUG)" ]; then \
@@ -98,7 +110,7 @@ $(FEATURES):
 			done; \
 			popd >&/dev/null; \
 		done; \
-		if [ -n "$$dst" ]; then \
+		if [ -n "$$dst" -a "$$dst" != "." ]; then \
 			the="$$sub subprofile"; \
 		else \
 			the="toplevel"; \
diff --git a/features.in/build-ve/config.mk b/features.in/build-ve/config.mk
index dbbaffaa..d1fc693e 100644
--- a/features.in/build-ve/config.mk
+++ b/features.in/build-ve/config.mk
@@ -1,3 +1,3 @@
 # hooked from ../../lib/sugar.mk
-use/build-ve:
+use/build-ve: sub/rootfs@/
 	@$(call add_feature)
diff --git a/features.in/build-vm/config.mk b/features.in/build-vm/config.mk
index 6a2f7343..8210d903 100644
--- a/features.in/build-vm/config.mk
+++ b/features.in/build-vm/config.mk
@@ -1,4 +1,4 @@
 # hooked from ../../lib/sugar.mk
-use/build-vm:
+use/build-vm: sub/rootfs@/
 	@$(call add_feature)
 	@$(call xport,ROOTPW)
diff --git a/features.in/build-vm/image-scripts.d/90-firsttime b/features.in/build-vm/image-scripts.d/90-firsttime
deleted file mode 100755
index f92c8df2..00000000
--- a/features.in/build-vm/image-scripts.d/90-firsttime
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-# Run scripts from /etc/firsttime.d at first start
-[ -f "/var/lock/TMP_1ST" ] || touch "/var/lock/TMP_1ST"
diff --git a/features.in/live/config.mk b/features.in/live/config.mk
index 5a192cfc..a0c6b000 100644
--- a/features.in/live/config.mk
+++ b/features.in/live/config.mk
@@ -2,7 +2,7 @@
 
 # copy stage2 as live
 # NB: starts to preconfigure but doesn't use/cleanup yet
-use/live: use/stage2 sub/stage2@live
+use/live: use/stage2 sub/rootfs@live sub/stage2@live
 	@$(call add_feature)
 	@$(call add,CLEANUP_PACKAGES,'installer*')
 
diff --git a/features.in/services/README b/features.in/services/README
new file mode 100644
index 00000000..f80e86d6
--- /dev/null
+++ b/features.in/services/README
@@ -0,0 +1,10 @@
+Данная фича конфигурирует автоматический запуск сервисов
+при загрузке системы.
+
+Поскольку в конкретном образе может быть желательно перекрыть
+умолчания предыдущей конфигурации, рекомендуется в фичах работать
+с переменными DEFAULT_SERVICES_* и оставить переменные SERVICES_*
+для релиз-менеджеров.
+
+Выключение сервиса в каждой из этих пар имеет приоритет перед
+включением.
diff --git a/features.in/services/config.mk b/features.in/services/config.mk
new file mode 100644
index 00000000..23718db3
--- /dev/null
+++ b/features.in/services/config.mk
@@ -0,0 +1,14 @@
+use/services: sub/rootfs
+	@$(call add_feature)
+	@$(call xport,DEFAULT_SERVICES_ENABLE)
+	@$(call xport,DEFAULT_SERVICES_DISABLE)
+	@$(call xport,SERVICES_ENABLE)
+	@$(call xport,SERVICES_DISABLE)
+
+# some presets
+
+use/services/network: use/services
+	@$(call add,DEFAULT_SERVICES_ENABLE,network)
+
+use/services/ssh: use/services use/services/network
+	@$(call add,DEFAULT_SERVICES_ENABLE,sshd)
diff --git a/features.in/services/rootfs/image-scripts.d/10-services b/features.in/services/rootfs/image-scripts.d/10-services
new file mode 100755
index 00000000..45a2cd93
--- /dev/null
+++ b/features.in/services/rootfs/image-scripts.d/10-services
@@ -0,0 +1,35 @@
+#!/bin/sh
+# this script implements the services regulation
+# according to what has been decided in the profile
+
+CHKCONFIG=
+SYSTEMCTL=
+
+[ ! -x /sbin/chkconfig ] || CHKCONFIG=1
+[ ! -x /bin/systemctl  ] || SYSTEMCTL=1
+
+[ -n "$CHKCONFIG$SYSTEMCTL" ] || exit 0
+
+switch() {
+	case "$2" in
+	on)
+		cc=on; sc=enable;;
+	off)
+		cc=off; sc=disable;;
+	esac
+
+	{
+		[ -z "$SYSTEMCTL" ] || /bin/systemctl --no-reload $sc $1.service
+		[ -z "$CHKCONFIG" ] || /sbin/chkconfig $1 $cc
+	} # 2>/dev/null
+}
+
+# defaults (most likely features.in ones)
+for i in $GLOBAL_DEFAULT_SERVICES_ENABLE;  do switch $i on;  done
+for i in $GLOBAL_DEFAULT_SERVICES_DISABLE; do switch $i off; done
+
+# explicitly specified behaviour (e.g. via conf.d)
+for i in $GLOBAL_SERVICES_ENABLE;  do switch $i on;  done
+for i in $GLOBAL_SERVICES_DISABLE; do switch $i off; done
+
+:
diff --git a/lib/distro.mk b/lib/distro.mk
index d28ad1db..d221d9f4 100644
--- a/lib/distro.mk
+++ b/lib/distro.mk
@@ -6,10 +6,6 @@ endif
 
 ifeq (distro,$(IMAGE_CLASS))
 
-# request particular image subprofile inclusion
-sub/%:
-	@$(call add,SUBPROFILES,$(@:sub/%=%))
-
 # install media bootloader
 boot/%:
 	@$(call set,BOOTLOADER,$*)
diff --git a/lib/sugar.mk b/lib/sugar.mk
index 763af890..75a389c4 100644
--- a/lib/sugar.mk
+++ b/lib/sugar.mk
@@ -14,5 +14,9 @@ config/pack/%: use/pack/%
 config/name/%:
 	@$(call set,IMAGE_NAME,$*)
 
+# request particular image subprofile inclusion
+sub/%:
+	@$(call add,SUBPROFILES,$(@:sub/%=%))
+
 # the final thing will pull the rest in
 build: postclean; @:
diff --git a/sub.in/Makefile b/sub.in/Makefile
index 4a476e94..7ac47c8e 100644
--- a/sub.in/Makefile
+++ b/sub.in/Makefile
@@ -8,14 +8,21 @@ include $(BUILDDIR)/distcfg.mk
 
 # if the subprofile is specified in src/dst notation,
 # take src/ and put it as dst/ (for stage2 variants)
+# NB: rootfs may come in first
 all:
 	@for sub in $(SUBPROFILES); do \
 		src="$${sub%@*}" && \
 		dst="$${sub#*@}" && \
 		neq="$${src#$$dst}" && \
+		dstdir=""$(BUILDDIR)/$$dst/"" && \
+		if [ -d "$$dstdir" ]; then \
+			action="complemented"; \
+		else \
+			action="initialized"; \
+		fi; \
 		rsync -qa "$$src/" "$(BUILDDIR)/$$dst/" && \
 		mp-commit "$(BUILDDIR)/$$dst/" \
-			"$$dst subprofile initialized$${neq:+ (using $$src)}"; \
+			"$$dst subprofile $$action$${neq:+ (using $$src)}"; \
 	done
 
 clean:
diff --git a/sub.in/rootfs/README b/sub.in/rootfs/README
new file mode 100644
index 00000000..b3079019
--- /dev/null
+++ b/sub.in/rootfs/README
@@ -0,0 +1,18 @@
+=== sub.in/rootfs ===
+
+Этот каталог содержит общие компоненты, добавляемые в "пользовательскую"
+корневую файловую систему вне зависимости от того, с чем именно в итоге
+столкнётся пользователь: livecd, vm, arm...
+
+Соответственно функциональность вроде настройки автоматического входа
+в систему, которая должна быть задействована вне зависимости от того,
+какая часть профиля отвечает за формирование итоговой "пользоФС",
+может быть помещена в подкаталог rootfs/ (аналогично stage2/ для фич,
+дополняющих все производные субпрофиля stage2).
+
+В фичах, опирающихся на функциональность rootfs, следует указывать
+зависимость на sub/rootfs@нужное (например, sub/rootfs@live в фиче
+live, порождающей субпрофиль live из субпрофиля stage2).
+
+Зависимость на sub/rootfs не имеет смысла, указывать подобное не следует
+ни в фичах, дополняющих rootfs, ни в фичах, опирающихся на неё.
diff --git a/features.in/build-ve/image-scripts.d/90-firsttime b/sub.in/rootfs/image-scripts.d/90-firsttime
similarity index 100%
rename from features.in/build-ve/image-scripts.d/90-firsttime
rename to sub.in/rootfs/image-scripts.d/90-firsttime