Fix read-only rootfs setup /wrt etc overlay - and more
v2 cover Fix read-only rootfs setup /wrt etc overlay - and more
Changes in v2:
- panic on /var mounting failure during overlay setup
- panic-reboot on initramfs failures in secure mode
- /root persistence
- faster rootfs selection under dm-verity
This addresses the problem of current read-only rootfs + /etc overlay as used for the SWUpdate setups.
Due to ordering issues in systemd startup between machine-id handling vs. making /etc writable via the overlay, various things are broken down the line, e.g. journal reporting. Reading [1], it appeared to be best to move the overlay mounting into the initramfs. And this implementation proves this to be right: simpler and working smoothly.
As a by-product, this also unifies the initramfs-abrootfs-hook, and makes it simpler as well.
Furthermore, this plugs a hole in the secure boot process if the initramfs fails (we got a shell then), makes /root persistent and optimizes the rootfs selection via dm-verity.
Jan
[1] https://www.spinics.net/lists/systemd-devel/msg05670.html
Jan Kiszka (6):
wic: Align kernel command line of qemu-amd64-efibootguard*
initramfs-abrootfs-hook: Convert to an initramfs-class recipe Convert /etc overlay from systemd mount unit to initramfs hook
customizations: Relocate /root under /home
initramfs-verify-hook: Optimize probing of partitions
secureboot: Prevent getting shell on panic
classes/image_uuid.bbclass | 6 +--
classes/secure-wic-swu-img.bbclass | 4 --
classes/wic-swu-img.bbclass | 6 ++-
kas/opt/ebg-secure-boot-snakeoil.yml | 1 +
kas/opt/ebg-swu.yml | 2 +-
recipes-core/customizations/files/postinst | 4 ++
.../etc-overlay-fs/etc-overlay-fs_0.1.bb | 32 -------------
.../etc-overlay-fs/files/etc-hostname.service | 14 ------
.../files/etc-sshd-regen-keys.conf | 6 ---
.../etc-overlay-fs/files/etc-sysusers.conf | 4 --
recipes-core/etc-overlay-fs/files/etc.mount | 13 ------
recipes-core/etc-overlay-fs/files/postinst | 4 --
.../cip-core-initramfs/cip-core-initramfs.bb | 2 +-
.../{initramfs.lsblk.hook => abrootfs.hook} | 11 ++---
.../files/abrootfs.script} | 46 +++++++++----------
.../files/initramfs.image_uuid.hook | 33 -------------
.../initramfs-abrootfs-hook/files/postinst | 6 ---
.../initramfs-abrootfs-hook_0.1.bb | 41 ++++++++++-------
.../files/etc-overlay.script | 34 ++++++++++++++
.../initramfs-etc-overlay-hook_0.1.bb | 27 +++++++++++
.../files/verity.script.tmpl | 18 ++++++--
wic/qemu-amd64-efibootguard-secureboot.wks.in | 2 +-
22 files changed, 138 insertions(+), 178 deletions(-)
delete mode 100644 recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb
delete mode 100644 recipes-core/etc-overlay-fs/files/etc-hostname.service
delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sshd-regen-keys.conf
delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sysusers.conf
delete mode 100644 recipes-core/etc-overlay-fs/files/etc.mount
delete mode 100755 recipes-core/etc-overlay-fs/files/postinst
rename recipes-initramfs/initramfs-abrootfs-hook/files/{initramfs.lsblk.hook => abrootfs.hook} (62%)
copy recipes-initramfs/{initramfs-verity-hook/files/verity.script.tmpl => initramfs-abrootfs-hook/files/abrootfs.script} (53%)
delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.image_uuid.hook
delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/postinst
create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script
create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bbSignature · 1 line
2.34.1
PATCH v2 1/6 wic: Align kernel command line of qemu-amd64-efibootguard*
From: Jan Kiszka <[email protected]>
"rw" is meaningless and misleading for the read-only rootfs we have.
--- wic/qemu-amd64-efibootguard-secureboot.wks.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
wic/qemu-amd64-efibootguard-secureboot.wks.in +1 -1
@@ -12,4 +12,4 @@ part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024 --size 1G part /var --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var --fstype=ext4 --label var --align 1024 --size 2G -bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait rw earlyprintk" +bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait earlyprintk"
Signature · 1 line
2.34.1
PATCH v2 2/6 initramfs-abrootfs-hook: Convert to an initramfs-class recipe
In reply to Jan KiszkaFrom: Jan Kiszka <[email protected]>
This unifies the pattern we generate initramfs images for non-secure and secure SWUpdate images. Besides cleaning up the related abrootfs selection hook, the unification is a precondition for adding another initramfs recipe later that will be shared between both image types
The pattern followed in the new initramfs-abrootfs-hook script is now similar to initramfs-verity-hook: a local-top hook is used, rather than a patch for Debian's local script. This hook looks for the matching rootfs by read-only mounting candidates, comparing the contained UUID against the one stored in the initramfs, unmounting again, and then setting the ROOT variable on match.
---
classes/image_uuid.bbclass | 6 +-
classes/secure-wic-swu-img.bbclass | 4 --
classes/wic-swu-img.bbclass | 6 ++
kas/opt/ebg-secure-boot-snakeoil.yml | 1 +
kas/opt/ebg-swu.yml | 2 +-
.../cip-core-initramfs/cip-core-initramfs.bb | 4 --
.../{initramfs.lsblk.hook => abrootfs.hook} | 11 +---
.../files/abrootfs.script | 66 +++++++++++++++++++
.../files/initramfs.image_uuid.hook | 33 ----------
.../initramfs-abrootfs-hook/files/postinst | 6 --
.../initramfs-abrootfs-hook_0.1.bb | 41 +++++++-----
11 files changed, 104 insertions(+), 76 deletions(-)
rename recipes-initramfs/initramfs-abrootfs-hook/files/{initramfs.lsblk.hook => abrootfs.hook} (62%)
create mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/abrootfs.script
delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.image_uuid.hook
delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/postinstclasses/image_uuid.bbclass +3 -3
@@ -1,10 +1,11 @@ # # CIP Core, generic profile # -# Copyright (c) Siemens AG, 2020 +# Copyright (c) Siemens AG, 2020-2022 # # Authors: # Quirin Gylstorff <[email protected]> +# Jan Kiszka <[email protected]> # # SPDX-License-Identifier: MIT #
@@ -27,7 +28,6 @@ do_generate_image_uuid() { sudo tee -a '${IMAGE_ROOTFS}/etc/os-release' image_do_mounts - # update initramfs to add uuid - sudo chroot '${IMAGE_ROOTFS}' update-initramfs -u + echo "TARGET_IMAGE_UUID=\"${IMAGE_UUID}\"" > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.uuid.env" } addtask generate_image_uuid before do_copy_boot_files after do_rootfs_install
classes/secure-wic-swu-img.bbclass +0 -4
@@ -9,10 +9,6 @@ # SPDX-License-Identifier: MIT # -INITRAMFS_RECIPE ?= "cip-core-initramfs" -do_wic_image[depends] += "${INITRAMFS_RECIPE}:do_build" -INITRD_IMAGE = "${INITRAMFS_RECIPE}-${DISTRO}-${MACHINE}.initrd.img" - inherit verity-img inherit wic-swu-img
classes/wic-swu-img.bbclass +6 -0
@@ -16,6 +16,12 @@ inherit wic-img inherit swupdate-img IMAGE_INSTALL += "etc-overlay-fs" + +INITRAMFS_RECIPE ?= "cip-core-initramfs" +INITRD_IMAGE = "${INITRAMFS_RECIPE}-${DISTRO}-${MACHINE}.initrd.img" + +do_wic_image[depends] += "${INITRAMFS_RECIPE}:do_build" + IMAGE_INSTALL += "home-fs" IMAGE_INSTALL += "tmp-fs"
kas/opt/ebg-secure-boot-snakeoil.yml +1 -0
@@ -25,6 +25,7 @@ local_conf_header: secure-boot-image: | IMAGE_FSTYPES = "secure-wic-swu-img" WKS_FILE = "${MACHINE}-efibootguard-secureboot.wks.in" + INITRAMFS_INSTALL_append = " initramfs-verity-hook" secure-boot: | # Add snakeoil binaries for qemu
kas/opt/ebg-swu.yml +1 -1
@@ -17,7 +17,7 @@ header: local_conf_header: initramfs: | - IMAGE_INSTALL += "initramfs-abrootfs-hook" + INITRAMFS_INSTALL_append = " initramfs-abrootfs-hook" image-option-uuid: | CIP_IMAGE_OPTIONS_append = " image-uuid.inc"
recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb +0 -4
@@ -10,7 +10,3 @@ # inherit initramfs - -INITRAMFS_INSTALL += " \ - initramfs-verity-hook \ - "
recipes-initramfs/initramfs-abrootfs-hook/files/abrootfs.hook renamed from recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.lsblk.hook +3 -8
@@ -1,9 +1,8 @@ -# This software is a part of ISAR. -# Copyright (C) Siemens AG, 2020 +#!/bin/sh +# Copyright (C) Siemens AG, 2020-2022 # # SPDX-License-Identifier: MIT -#!/bin/sh PREREQ="" prereqs()
@@ -21,9 +20,5 @@ esac . /usr/share/initramfs-tools/scripts/functions . /usr/share/initramfs-tools/hook-functions -if [ ! -x /usr/bin/lsblk ]; then - echo "Warning: couldn't find /usr/bin/lsblk!" - exit 0 -fi - copy_exec /usr/bin/lsblk +copy_file library /usr/share/abrootfs/image-uuid.env /usr/share/abrootfs/image-uuid.env
recipes-initramfs/initramfs-abrootfs-hook/files/abrootfs.script new file +66 -0
66 lines not on this page · raw message
recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.image_uuid.hook deleted +0 -33
@@ -1,33 +0,0 @@ -# This software is a part of ISAR. -# Copyright (C) Siemens AG, 2020 -# -# SPDX-License-Identifier: MIT - -#!/bin/sh -set -x -PREREQ="" - -prereqs() -{ - echo "$PREREQ" -} - -case $1 in -prereqs) - prereqs - exit 0 - ;; -esac - -. /usr/share/initramfs-tools/scripts/functions -. /usr/share/initramfs-tools/hook-functions - -if [ ! -e /etc/os-release ]; then - echo "Warning: couldn't find /etc/os-release!" - exit 0 -fi - -IMAGE_UUID=$(sed -n 's/^IMAGE_UUID="\(.*\)"/\1/p' /etc/os-release) -echo "${IMAGE_UUID}" > "${DESTDIR}/conf/image_uuid" - -exit 0
recipes-initramfs/initramfs-abrootfs-hook/files/postinst deleted +0 -6
@@ -1,6 +0,0 @@ -#!/bin/sh - -# patch local script -patch -s -p0 /usr/share/initramfs-tools/scripts/local /usr/share/initramfs-abrootfs-hook/debian-local.patch - -update-initramfs -v -u
recipes-initramfs/initramfs-abrootfs-hook/initramfs-abrootfs-hook_0.1.bb +24 -17
57 lines not on this page · raw message
Signature · 1 line
2.34.1
Re: [isar-cip-core][PATCH v2 2/6] initramfs-abrootfs-hook: Convert to an initramfs-class recipe
Quoted 51 lines · Jan Kiszka
From: Jan Kiszka <[email protected]>
This unifies the pattern we generate initramfs images for non-secure and secure SWUpdate images. Besides cleaning up the related abrootfs selection hook, the unification is a precondition for adding another initramfs recipe later that will be shared between both image types
The pattern followed in the new initramfs-abrootfs-hook script is now similar to initramfs-verity-hook: a local-top hook is used, rather than a patch for Debian's local script. This hook looks for the matching rootfs by read-only mounting candidates, comparing the contained UUID against the one stored in the initramfs, unmounting again, and then setting the ROOT variable on match.
Signed-off-by Jan Kiszka <[email protected]>--- classes/image_uuid.bbclass | 6 +- classes/secure-wic-swu-img.bbclass | 4 -- classes/wic-swu-img.bbclass | 6 ++ kas/opt/ebg-secure-boot-snakeoil.yml | 1 + kas/opt/ebg-swu.yml | 2 +- .../cip-core-initramfs/cip-core-initramfs.bb | 4 -- .../{initramfs.lsblk.hook => abrootfs.hook} | 11 +--- .../files/abrootfs.script | 66 +++++++++++++++++++ .../files/initramfs.image_uuid.hook | 33 ---------- .../initramfs-abrootfs-hook/files/postinst | 6 -- .../initramfs-abrootfs-hook_0.1.bb | 41 +++++++----- 11 files changed, 104 insertions(+), 76 deletions(-) rename recipes-initramfs/initramfs-abrootfs-hook/files/{initramfs.lsblk.hook => abrootfs.hook} (62%) create mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/abrootfs.script delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.image_uuid.hook delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/postinstclasses/image_uuid.bbclass +2
-1@@ -1,10 +1,11 @@ # # CIP Core, generic profile # -# Copyright (c) Siemens AG, 2020 +# Copyright (c) Siemens AG, 2020-2022 # # Authors: # Quirin Gylstorff <[email protected]> +# Jan Kiszka <[email protected]> # # SPDX-License-Identifier: MIT #
classes/image_uuid.bbclass do_generate_image_uuid() { · line 29
Quoted 2 lines
classes/image_uuid.bbclass +0
-0@@ -27,7 +28,6 @@ do_generate_image_uuid() { sudo tee -a '${IMAGE_ROOTFS}/etc/os-release' image_do_mounts
This line is obsolete.
classes/image_uuid.bbclass do_generate_image_uuid() { · line 33
Quoted 6 lines
classes/image_uuid.bbclass +1
-2- # update initramfs to add uuid - sudo chroot '${IMAGE_ROOTFS}' update-initramfs -u + echo "TARGET_IMAGE_UUID=\"${IMAGE_UUID}\"" > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.uuid.env" } addtask generate_image_uuid before do_copy_boot_files after do_rootfs_install
This one as well, plus it broke when no one else used DEPLOY_DIR_IMAGE before. v3 will follow, fixing a similar issue in verity-img.
Jan
Signature · 2 lines
Siemens AG, Technology Competence Center Embedded Linux
PATCH v2 3/6 Convert /etc overlay from systemd mount unit to initramfs hook
In reply to Jan KiszkaFrom: Jan Kiszka <[email protected]>
As systemd is not well prepared for read-only rootfs, specifically /wrt machine-id management and anything that depends on it, it's best to mount the /etc overlay already in the initramfs. This implies that also /var is mounted at that level. We still keep the fstab setup done by wic-swu-img class so that systemd will recognize the rootfs as read-only and not try to remount it rw which will only fail with underlying squashfs.
--- classes/wic-swu-img.bbclass | 2 -- .../etc-overlay-fs/etc-overlay-fs_0.1.bb | 32 ----------------- .../etc-overlay-fs/files/etc-hostname.service | 14 -------- .../files/etc-sshd-regen-keys.conf | 6 ---- .../etc-overlay-fs/files/etc-sysusers.conf | 4 --- recipes-core/etc-overlay-fs/files/etc.mount | 13 ------- recipes-core/etc-overlay-fs/files/postinst | 4 --- .../cip-core-initramfs/cip-core-initramfs.bb | 4 +++ .../files/etc-overlay.script | 34 +++++++++++++++++++ .../initramfs-etc-overlay-hook_0.1.bb | 27 +++++++++++++++ 10 files changed, 65 insertions(+), 75 deletions(-) delete mode 100644 recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb delete mode 100644 recipes-core/etc-overlay-fs/files/etc-hostname.service delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sshd-regen-keys.conf delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sysusers.conf delete mode 100644 recipes-core/etc-overlay-fs/files/etc.mount delete mode 100755 recipes-core/etc-overlay-fs/files/postinst create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb
classes/wic-swu-img.bbclass +0 -2
@@ -15,8 +15,6 @@ inherit squashfs-img inherit wic-img inherit swupdate-img -IMAGE_INSTALL += "etc-overlay-fs" - INITRAMFS_RECIPE ?= "cip-core-initramfs" INITRD_IMAGE = "${INITRAMFS_RECIPE}-${DISTRO}-${MACHINE}.initrd.img"
recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb deleted +0 -32
@@ -1,32 +0,0 @@ -# -# CIP Core, generic profile -# -# Copyright (c) Siemens AG, 2021 -# -# Authors: -# Quirin Gylstorff <[email protected]> -# -# SPDX-License-Identifier: MIT - -inherit dpkg-raw - -SRC_URI = "file://postinst \ - file://etc.mount \ - file://etc-hostname.service \ - file://etc-sshd-regen-keys.conf \ - file://etc-sysusers.conf" - -do_install[cleandirs]+="${D}/usr/lib/systemd/system \ - ${D}/usr/lib/systemd/system/local-fs.target.wants \ - ${D}/usr/lib/systemd/system/systemd-sysusers.service.d \ - ${D}/usr/lib/systemd/system/sshd-regen-keys.service.d \ - ${D}/var/local/etc \ - ${D}/var/local/.atomic \ - " -do_install() { - TARGET=${D}/usr/lib/systemd/system - install -m 0644 ${WORKDIR}/etc.mount ${TARGET}/etc.mount - install -m 0644 ${WORKDIR}/etc-hostname.service ${TARGET}/etc-hostname.service - install -m 0644 ${WORKDIR}/etc-sshd-regen-keys.conf ${D}/usr/lib/systemd/system/sshd-regen-keys.service.d/etc-sshd-regen-keys.conf - install -m 0644 ${WORKDIR}/etc-sysusers.conf ${D}/usr/lib/systemd/system/systemd-sysusers.service.d/etc-sysusers.service -}
recipes-core/etc-overlay-fs/files/etc-hostname.service deleted +0 -14
@@ -1,14 +0,0 @@ -[Unit] -Description=set hostname /etc overlay-aware -Before=network-pre.target -Wants=network-pre.target -Requires=etc.mount -After=etc.mount - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/bin/hostname --boot --file /etc/hostname - -[Install] -WantedBy=basic.target
recipes-core/etc-overlay-fs/files/etc-sshd-regen-keys.conf deleted +0 -6
@@ -1,6 +0,0 @@ -[Unit] -# set hostname /etc overlay-aware -Before=network-pre.target -Wants=network-pre.target -Requires=etc.mount -After=etc.mount
recipes-core/etc-overlay-fs/files/etc-sysusers.conf deleted +0 -4
@@ -1,4 +0,0 @@ -[Unit] -# make systemd-sysusers /etc overlay aware -Requires=etc.mount -After=etc.mount
recipes-core/etc-overlay-fs/files/etc.mount deleted +0 -13
@@ -1,13 +0,0 @@ -[Unit] -Description=Overlay-mount /etc -Requires=var.mount -After=var.mount - -[Mount] -What=overlay -Where=/etc -Type=overlay -Options=noauto,x-systemd.automount,lowerdir=/etc,upperdir=/var/local/etc,workdir=/var/local/.atomic - -[Install] -WantedBy=local-fs.target
recipes-core/etc-overlay-fs/files/postinst deleted +0 -4
@@ -1,4 +0,0 @@ -#!/bin/sh - -deb-systemd-helper enable etc.mount || true -deb-systemd-helper enable etc-hostname.service || true
recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb +4 -0
@@ -10,3 +10,7 @@ # inherit initramfs + +INITRAMFS_INSTALL += " \ + initramfs-etc-overlay-hook \ + "
recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script new file +34 -0
@@ -0,0 +1,34 @@ +#!/bin/sh +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka <[email protected]> +# + +PREREQ="" + +prereqs() +{ + echo "$PREREQ" +} + +case $1 in +# get pre-requisites +prereqs) + prereqs + exit 0 + ;; +esac + +. /scripts/functions + +if ! mount -t $(get_fstype /dev/disk/by-label/var) /dev/disk/by-label/var ${rootmnt}/var; then + panic "Can't mount /var partition - overlay will not work!" +fi + +mkdir -p ${rootmnt}/var/local/etc +mkdir -p ${rootmnt}/var/local/.atomic +mount -t overlay -o lowerdir=${rootmnt}/etc,upperdir=${rootmnt}/var/local/etc,workdir=${rootmnt}/var/local/.atomic overlay ${rootmnt}/etc
recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb new file +27 -0
@@ -0,0 +1,27 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Jan Kiszka <[email protected]> +# +# SPDX-License-Identifier: MIT +# + +inherit dpkg-raw + +SRC_URI += " \ + file://etc-overlay.script \ + " + +DEBIAN_DEPENDS = "initramfs-tools" + +do_install[cleandirs] += " \ + ${D}/usr/share/initramfs-tools/hooks \ + ${D}/usr/share/initramfs-tools/scripts/local-bottom" + +do_install() { + install -m 0755 "${WORKDIR}/etc-overlay.script" \ + "${D}/usr/share/initramfs-tools/scripts/local-bottom/etc-overlay" +}
Signature · 1 line
2.34.1
PATCH v2 4/6 customizations: Relocate /root under /home
In reply to Jan KiszkaFrom: Jan Kiszka <[email protected]>
This is needed for read-only rootfs setups. We could also update the account settings, but establishing a link comes with less surprises.
--- recipes-core/customizations/files/postinst | 4 ++++ 1 file changed, 4 insertions(+)
recipes-core/customizations/files/postinst +4 -0
@@ -17,3 +17,7 @@ echo "PermitRootLogin yes" >> /etc/ssh/sshd_config HOSTNAME=demo echo "$HOSTNAME" > /etc/hostname echo "127.0.0.1 $HOSTNAME" >> /etc/hosts + +# needed for read-only rootfs with writable /home +mv /root /home/ +ln -s /home/root /root
Signature · 1 line
2.34.1
Re: [isar-cip-core][PATCH v2 4/6] customizations: Relocate /root under /home
Quoted 5 lines · Jan Kiszka
From: Jan Kiszka <[email protected]>
This is needed for read-only rootfs setups. We could also update the account settings, but establishing a link comes with less surprises.
What happens if the /home mount fails? Does the system fall back to / ?
This should be the behavior according to [1].
[1]: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s14.html
Quirin
Quoted 17 lines
Signed-off-by Jan Kiszka <[email protected]>--- recipes-core/customizations/files/postinst | 4 ++++ 1 file changed, 4 insertions(+)recipes-core/customizations/files/postinst +4
-0@@ -17,3 +17,7 @@ echo "PermitRootLogin yes" >> /etc/ssh/sshd_config HOSTNAME=demo echo "$HOSTNAME" > /etc/hostname echo "127.0.0.1 $HOSTNAME" >> /etc/hosts + +# needed for read-only rootfs with writable /home +mv /root /home/ +ln -s /home/root /root
Re: [isar-cip-core][PATCH v2 4/6] customizations: Relocate /root under /home
Quoted 9 lines · Gylstorff Quirin
Quoted 5 lines · Jan Kiszka
From: Jan Kiszka <[email protected]>
This is needed for read-only rootfs setups. We could also update the account settings, but establishing a link comes with less surprises.
Quoted 5 lines
What happens if the /home mount fails? Does the system fall back to / ?
This should be the behavior according to [1].
[1]: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s14.html
Jup, managed to stress this during testing by first misspelling the link as "/homr/root".
Jan
Signature · 2 lines
Siemens AG, Technology Competence Center Embedded Linux
PATCH v2 5/6 initramfs-verify-hook: Optimize probing of partitions
In reply to Jan KiszkaFrom: Jan Kiszka <[email protected]>
Rather than verifying the complete device, match on the UUID embedded into the dm-verity superblock. That is much faster and, thus, saves boot time with large partitions and/or slow devices.
--- .../files/verity.script.tmpl | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
recipes-initramfs/initramfs-verity-hook/files/verity.script.tmpl +13 -5
@@ -37,12 +37,20 @@ case "$ROOT" in "") # No Root device was given. Use veritysetup verify to search matching roots partitions=$(blkid -o device) - for part in $partitions; do + for part in ${partitions}; do if [ "$(blkid -p ${part} --match-types novfat -s USAGE -o value)" = "filesystem" ]; then - if veritysetup verify \ - "$part" "$part" "${ROOT_HASH}" \ - --hash-offset "${HASH_OFFSET}";then - ROOT="$part" + verity_uuid=$( + veritysetup dump "${part}" --hash-offset "${HASH_OFFSET}" | \ + while IFS=":" read key value; do + if [ "${key}" = "UUID" ]; then + # this pattern must use a real tab + echo "${value##* }" + break + fi + done + ) + if [ "${UUID}" = "${verity_uuid}" ]; then + ROOT="${part}" break fi fi
Signature · 1 line
2.34.1
PATCH v2 6/6 secureboot: Prevent getting shell on panic
In reply to Jan KiszkaFrom: Jan Kiszka <[email protected]>
On panic, initramfs-tools opens up a shell unless panic=X is set on the kernel command line. Fix that because such a shell could break the chain of trust.
--- wic/qemu-amd64-efibootguard-secureboot.wks.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
wic/qemu-amd64-efibootguard-secureboot.wks.in +1 -1
@@ -12,4 +12,4 @@ part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.${VERITY_IMAGE_TYPE part /home --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/home --fstype=ext4 --label home --align 1024 --size 1G part /var --source rootfs --rootfs-dir=${IMAGE_ROOTFS}/var --fstype=ext4 --label var --align 1024 --size 2G -bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait earlyprintk" +bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait earlyprintk panic=5"
Signature · 1 line
2.34.1