WIP: Changes for booting composefs native systems #3874
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| bootc-initramfs-setup |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| [Unit] | ||
| Description=CoreOS Root Setup | ||
| Documentation=man:bootc(1) | ||
| DefaultDependencies=no | ||
| ConditionKernelCommandLine=|composefs | ||
|
Member
There was a problem hiding this comment. Ideally...we don't hardcode this because I'd like the ability to change it in the future. That already came up because e.g. not having a But also, maybe we actually switch to key based mounting per composefs/composefs-rs#226 So...how about
Member
Author
There was a problem hiding this comment.
This sounds good to me, but I don't know if systemd will OR this with the kernel cmdline condition. I'll need to check |
||
| ConditionKernelCommandLine=|ostree | ||
| ConditionPathExists=/etc/initrd-release | ||
| After=sysroot.mount | ||
| Requires=sysroot.mount | ||
| Before=initrd-root-fs.target | ||
|
|
||
| OnFailure=emergency.target | ||
| OnFailureJobMode=isolate | ||
|
|
||
| [Service] | ||
| Type=oneshot | ||
| ExecStart=/usr/libexec/coreos-root-setup | ||
| StandardInput=null | ||
| StandardOutput=journal | ||
| StandardError=journal+console | ||
| RemainAfterExit=yes | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| #!/bin/bash | ||
|
|
||
| have_karg() { | ||
| local arg="$1" | ||
| IFS=" " read -r -a cmdline <<< "$(</proc/cmdline)" | ||
| local i | ||
| for i in "${cmdline[@]}"; do | ||
| if [[ "$i" =~ "$arg=" ]]; then | ||
| return 0 | ||
| fi | ||
| done | ||
| return 1 | ||
| } | ||
|
|
||
| if have_karg composefs; then | ||
| /usr/lib/bootc/initramfs-setup setup-root | ||
| elif have_karg ostree; then | ||
| /usr/lib/ostree/ostree-prepare-root /sysroot | ||
| else | ||
| echo "Neither ostree nor composefs found in cmdline" | ||
| exit 1 | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| #!/bin/bash | ||
|
|
||
| check() { | ||
| return 0 | ||
| } | ||
|
|
||
| depends() { | ||
| return 0 | ||
| } | ||
|
|
||
| install() { | ||
| local service=coreos-root-setup.service | ||
|
|
||
| inst_script "$moddir/coreos-root-setup.sh" /usr/libexec/coreos-root-setup | ||
|
|
||
| inst "$moddir/bootc-initramfs-setup" /usr/lib/bootc/initramfs-setup | ||
|
|
||
| inst_simple "$moddir/${service}" "${systemdsystemunitdir}/${service}" | ||
| mkdir -p "${initdir}${systemdsystemconfdir}/initrd-root-fs.target.wants" | ||
| ln_r "${systemdsystemunitdir}/${service}" \ | ||
| "${systemdsystemconfdir}/initrd-root-fs.target.wants/${service}" | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| [Unit] | ||
| Description=Boot Partition Discovery Complete | ||
| Documentation=man:systemd.special(7) | ||
| ConditionPathExists=/etc/initrd-release | ||
| # After=local-fs-pre.target | ||
| # Before=local-fs.target | ||
| Requires=boot-part-discovery.service |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| [Unit] | ||
| Description=Discover Boot Partition Availability | ||
| ConditionPathExists=/etc/initrd-release | ||
| Before=boot-part-discovered.target | ||
| After=local-fs-pre.target | ||
| Before=local-fs.target | ||
|
|
||
| [Service] | ||
| Type=oneshot | ||
| ExecStart=/usr/libexec/boot-part-discovery.sh | ||
| RemainAfterExit=yes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| #!/bin/bash | ||
|
|
||
| XBOOTLDR_UUID="BC13C2FF-59E6-4262-A352-B275FD6F7172" | ||
|
Member
There was a problem hiding this comment. Hmm it'd be nice to not write new load-bearing bash code run as root. In this case...can't the GPT auto generator mount this?
Member
Author
There was a problem hiding this comment.
Yes, it could, and would mount /boot if the partuuid follows DPS, which it does after my other PR. This was mainly supposed to be a sync target for a lot of other services that depend on a boot partition being present. |
||
| BOOT_STATUS_DIR="/run/coreos" | ||
| BOOT_STATUS_FILE="${BOOT_STATUS_DIR}/boot-partition-status" | ||
|
|
||
| boot_part_exists() { | ||
| LSBLK_JSON="$(lsblk -o name,parttype,uuid,mountpoint,parttypename,label --json)" | ||
|
|
||
| while read -r part; do | ||
| parttype="$(jq -r '.parttype // empty' <<<"$part" | tr '[:lower:]' '[:upper:]')" | ||
| name="$(jq -r '.name' <<<"$part")" | ||
|
|
||
| [[ -n "$parttype" ]] || echo "Partition '$name' has no parttype" | ||
|
|
||
| if [[ "$parttype" == "$XBOOTLDR_UUID" ]]; then | ||
| return 0 | ||
| fi | ||
| done < <(echo "$LSBLK_JSON" | jq -c '.blockdevices[].children[]?') | ||
|
|
||
| return 1 | ||
| } | ||
|
|
||
| # Only run when executed directly, not when sourced | ||
| if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then | ||
| if boot_part_exists; then | ||
| mkdir -p "$BOOT_STATUS_DIR" | ||
| echo "available" > "$BOOT_STATUS_FILE" | ||
| else | ||
| echo "Boot partition not found" | ||
| fi | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -306,9 +306,32 @@ case "${1:-}" in | |
| if [ -d "${saved_root}" ]; then | ||
| echo "Restoring rootfs from RAM..." | ||
| mount_and_restore_filesystem_by_label root /sysroot "${saved_root}" | ||
|
Member
There was a problem hiding this comment. Discussing this live: For the sealed UKI case let's say we want to do the DPS. Then probably we should detect whether the disk has the DPS root UUID and if the bootloader set the BLI variable. I think we could make this a clean distinct prep commit right? Basically "support DPS booting". Questions:
|
||
|
|
||
| chcon -v --reference "${saved_root}" /sysroot # the root of the fs itself | ||
|
|
||
| cfs_digest=$(karg composefs) | ||
|
|
||
| if [[ "$cfs_digest" == "" ]]; then | ||
| chattr +i $(ls -d /sysroot/ostree/deploy/*/deploy/*/) | ||
| elif [[ ${cfs_digest:0:1} != "?" ]]; then | ||
| echo "Re-enabling fsverity on composefs repo..." | ||
| # tmpfs has no fsverity, so we need to reenable fsverity | ||
| hash_alg="" | ||
|
|
||
| if [[ $cfs_digest =~ ^[0-9a-fA-F]{64}$ ]]; then | ||
| hash_alg="sha256" | ||
| elif [[ $cfs_digest =~ ^[0-9a-fA-F]{128}$ ]]; then | ||
| hash_alg="sha512" | ||
| else | ||
| echo "Bad verity in cmdline '$cfs_digest'" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "Enabling fs-verity again..." | ||
| find /sysroot/composefs/objects -type f -exec fsverity enable {} --hash-alg $hash_alg \; | ||
|
Member
There was a problem hiding this comment. Eeek. This is another thing exactly like ostreedev/ostree#3094 I think at a minimum we could put this in rust in the bootc initramfs setup like Also note that once we have composefs/composefs-rs#268 then the tooling itself will immediately know the expected digest size just looking at the repo.
Member
Author
There was a problem hiding this comment.
agreed. That would be much cleaner And yes, repo metdata would help here |
||
| fi | ||
| fi | ||
|
|
||
| if [ -d "${saved_boot}" ]; then | ||
| echo "Restoring bootfs from RAM..." | ||
| mount_and_restore_filesystem_by_label boot /sysroot/boot "${saved_boot}" | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm this is effectively a generic synchronization point between "ostree or composefs" right? I think we could just add this to bootc upstream as say
bootc-root-setup.target- which then we ensure via a generator depends on the right service.The bash code executed here is just reimplementing the upstream services which I think we don't want.