Fix read-only rootfs setup /wrt etc overlay - and more

Changes in v3:
- create DEPLOY_DIR_IMAGE paths when needed in image-uuid and squashfs classes
- drop not longer needed image_do_mounts from image-uuid

Changes in v2:
- panic on /var mounting failure during overlay setup
- panic-reboot on initramfs failures in secure mode
- /root persistence
- faster rootfs selection under dm-verity

This addresses the problem of current read-only rootfs + /etc overlay as used for the SWUpdate setups.

Due to ordering issues in systemd startup between machine-id handling vs. making /etc writable via the overlay, various things are broken down the line, e.g. journal reporting. Reading [1], it appeared to be best to move the overlay mounting into the initramfs. And this implementation proves this to be right: simpler and working smoothly.

As a by-product, this also unifies the initramfs-abrootfs-hook, and makes it simpler as well.

Furthermore, this plugs a hole in the secure boot process if the initramfs fails (we got a shell then), makes /root persistent and optimizes the rootfs selection via dm-verity.

Jan

[1] https://www.spinics.net/lists/systemd-devel/msg05670.html

Jan Kiszka (7):
wic: Align kernel command line of qemu-amd64-efibootguard*
initramfs-abrootfs-hook: Convert to an initramfs-class recipe
squashfs-img: Make sure DEPLOY_DIR_IMAGE exists Convert /etc overlay from systemd mount unit to initramfs hook
customizations: Relocate /root under /home
initramfs-verify-hook: Optimize probing of partitions
secureboot: Prevent getting shell on panic

 classes/image_uuid.bbclass                    | 11 +++--
 classes/secure-wic-swu-img.bbclass            |  4 --
 classes/squashfs-img.bbclass                  |  1 +
 classes/wic-swu-img.bbclass                   |  6 ++-
 kas/opt/ebg-secure-boot-snakeoil.yml          |  1 +
 kas/opt/ebg-swu.yml                           |  2 +-
 recipes-core/customizations/files/postinst    |  4 ++
 .../etc-overlay-fs/etc-overlay-fs_0.1.bb      | 32 -------------
 .../etc-overlay-fs/files/etc-hostname.service | 14 ------
 .../files/etc-sshd-regen-keys.conf            |  6 ---
 .../etc-overlay-fs/files/etc-sysusers.conf    |  4 --
 recipes-core/etc-overlay-fs/files/etc.mount   | 13 ------
 recipes-core/etc-overlay-fs/files/postinst    |  4 --
 .../cip-core-initramfs/cip-core-initramfs.bb  |  2 +-
 .../{initramfs.lsblk.hook => abrootfs.hook}   | 11 ++---
 .../files/abrootfs.script}                    | 46 +++++++++----------
 .../files/initramfs.image_uuid.hook           | 33 -------------
 .../initramfs-abrootfs-hook/files/postinst    |  6 ---
 .../initramfs-abrootfs-hook_0.1.bb            | 41 ++++++++++-------
 .../files/etc-overlay.script                  | 34 ++++++++++++++
 .../initramfs-etc-overlay-hook_0.1.bb         | 27 +++++++++++
 .../files/verity.script.tmpl                  | 18 ++++++--
 wic/qemu-amd64-efibootguard-secureboot.wks.in |  2 +-
 23 files changed, 142 insertions(+), 180 deletions(-)
 delete mode 100644 recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb
 delete mode 100644 recipes-core/etc-overlay-fs/files/etc-hostname.service
 delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sshd-regen-keys.conf
 delete mode 100644 recipes-core/etc-overlay-fs/files/etc-sysusers.conf
 delete mode 100644 recipes-core/etc-overlay-fs/files/etc.mount
 delete mode 100755 recipes-core/etc-overlay-fs/files/postinst
 rename recipes-initramfs/initramfs-abrootfs-hook/files/{initramfs.lsblk.hook => abrootfs.hook} (62%)
 copy recipes-initramfs/{initramfs-verity-hook/files/verity.script.tmpl => initramfs-abrootfs-hook/files/abrootfs.script} (53%)
 delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/initramfs.image_uuid.hook
 delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/postinst
 create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/files/etc-overlay.script
 create mode 100644 recipes-initramfs/initramfs-etc-overlay-hook/initramfs-etc-overlay-hook_0.1.bb

2.34.1