sysext: provide systemd-{sysext,confext}-sysroot.service services (#41161)
This should pretty much close #38985 The new services are used to activate system and configuration extensions for the main system from the initrd, this allows to overcome the limitation that sysext/confext cannot be used to update the resources which are required in the earliest boot of the system (before systemd-sysext/systemd-confext start). To make it possible to disable sysext/confext merging logic, `systemd.sysext=0`, `systemd.confext=0`, `rd.systemd.sysext=0`, `rd.systemd.confext=0` kernel cmdline options are introduced. Closes #38985
This commit is contained in:
Lennart Poettering
@@ -28,6 +28,15 @@ CHANGES WITH 261 in spe:
|
||||
require direct IMDS access. The new meson option "-Dimds-network="
|
||||
can be used to change the default mode to "locked" at build-time.
|
||||
|
||||
Changes in systemd-sysext/systemd-confext:
|
||||
|
||||
* New initrd services systemd-sysext-sysroot.service and
|
||||
systemd-confext-sysroot.service are provided. These services are
|
||||
used to merge system and configuration extensions for the main system
|
||||
from the initrd. This overcomes the limitation that system and
|
||||
configuration extensions merged from the main system itself cannot be
|
||||
used to modify the resources which are used in the early boot.
|
||||
|
||||
CHANGES WITH 260:
|
||||
|
||||
Feature Removals and Incompatible Changes:
|
||||
@@ -689,9 +698,9 @@ CHANGES WITH 259:
|
||||
systemd-sysext/systemd-confext:
|
||||
|
||||
* systemd-sysext and systemd-confext now support configuration files
|
||||
/etc/systemd/systemd-sysext.conf and /etc/systemd/systemd-confext.conf,
|
||||
which can be used to configure mutability or the image policy to
|
||||
apply to DDI images.
|
||||
/etc/systemd/sysext.conf and /etc/systemd/confext.conf, which can be
|
||||
used to configure mutability or the image policy to apply to DDI
|
||||
images.
|
||||
|
||||
* systemd-sysext's and systemd-confext's --mutable= switch now accepts
|
||||
a new value "help" for listing available mutability modes.
|
||||
|
||||
@@ -119,6 +119,8 @@ Deprecations and removals:
|
||||
similar "devices"
|
||||
|
||||
Features:
|
||||
* sysext: make systemd-{sys,conf}ext-sysroot.service work in the split '/var'
|
||||
configuration.
|
||||
|
||||
* sd-varlink: add fully async modes of the protocol upgrade stuff
|
||||
|
||||
@@ -1769,9 +1771,6 @@ Features:
|
||||
|
||||
* in sd-id128: also parse UUIDs in RFC4122 URN syntax (i.e. chop off urn:uuid: prefix)
|
||||
|
||||
* systemd-sysext: optionally, run it in initrd already, before transitioning
|
||||
into host, to open up possibility for services shipped like that.
|
||||
|
||||
* whenever we receive fds via SCM_RIGHTS make sure none got dropped due to the
|
||||
reception limit the kernel silently enforces.
|
||||
|
||||
|
||||
@@ -829,6 +829,22 @@
|
||||
<xi:include href="version-info.xml" xpointer="v261"/></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><varname>systemd.sysext=</varname></term>
|
||||
<term><varname>systemd.confext=</varname></term>
|
||||
<term><varname>rd.systemd.sysext=</varname></term>
|
||||
<term><varname>rd.systemd.confext=</varname></term>
|
||||
|
||||
<listitem><para>Take boolean arguments, default to on. Control whether system and configuration
|
||||
extensions for the initrd (<varname>rd.systemd.sysext=</varname>, <varname>rd.systemd.confext=</varname>)
|
||||
and for the main system (<varname>systemd.sysext=</varname>, <varname>systemd.confext=</varname>) are
|
||||
merged automatically on boot. See
|
||||
<citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||
for details.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v261"/></listitem>
|
||||
</varlistentry>
|
||||
|
||||
</variablelist>
|
||||
</refsect1>
|
||||
|
||||
|
||||
@@ -1197,8 +1197,10 @@ manpages = [
|
||||
'8',
|
||||
['systemd-confext',
|
||||
'systemd-confext-initrd.service',
|
||||
'systemd-confext-sysroot.service',
|
||||
'systemd-confext.service',
|
||||
'systemd-sysext-initrd.service',
|
||||
'systemd-sysext-sysroot.service',
|
||||
'systemd-sysext.service'],
|
||||
'ENABLE_SYSEXT'],
|
||||
['systemd-system-update-generator', '8', [], ''],
|
||||
|
||||
+37
-15
@@ -20,9 +20,11 @@
|
||||
<refname>systemd-sysext</refname>
|
||||
<refname>systemd-sysext.service</refname>
|
||||
<refname>systemd-sysext-initrd.service</refname>
|
||||
<refname>systemd-sysext-sysroot.service</refname>
|
||||
<refname>systemd-confext</refname>
|
||||
<refname>systemd-confext.service</refname>
|
||||
<refname>systemd-confext-initrd.service</refname>
|
||||
<refname>systemd-confext-sysroot.service</refname>
|
||||
<refpurpose>Activates System Extension Images</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
@@ -114,27 +116,47 @@
|
||||
<citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry> with
|
||||
extension images found in the system's EFI System Partition.</para>
|
||||
|
||||
<para>During boot OS extension images are activated automatically, if the
|
||||
<filename>systemd-sysext.service</filename> is enabled. Note that this service runs only after the
|
||||
underlying file systems where system extensions may be located have been mounted. This means they are not
|
||||
suitable for shipping resources that are processed by subsystems running in earliest boot. Specifically,
|
||||
OS extension images are not suitable for shipping system services or
|
||||
<para>During boot, system and configuration extension images are activated automatically if the
|
||||
<filename>systemd-sysext.service</filename> and <filename>systemd-confext.service</filename> services are
|
||||
enabled. Note that these services run only after the underlying file systems where system and configuration
|
||||
extensions may be located have been mounted. To make it possible to ship resources that are processed by
|
||||
subsystems running in the earliest boot stages (for example, system services or
|
||||
<citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||
definitions. See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> page
|
||||
for a simple mechanism for shipping system services in disk images, in a similar fashion to OS
|
||||
extensions. Note the different isolation on these two mechanisms: while system extension directly extend
|
||||
the underlying OS image with additional files that appear in a way very similar to as if they were
|
||||
shipped in the OS image itself and thus imply no security isolation, portable services imply service
|
||||
level sandboxing in one way or another. The <filename>systemd-sysext.service</filename> service is
|
||||
guaranteed to finish start-up before <filename>basic.target</filename> is reached; i.e. at the time
|
||||
definitions), the <filename>systemd-sysext-sysroot.service</filename> and
|
||||
<filename>systemd-confext-sysroot.service</filename> initrd services are provided. Currently, these
|
||||
services cannot be used to merge system extensions from <filename>/sysroot/var/lib/extensions/</filename>
|
||||
and configuration extensions from <filename>/sysroot/var/lib/confexts/</filename> when the
|
||||
<filename>/var/</filename> partition is split off. These extensions are later merged by the
|
||||
<filename>systemd-sysext.service</filename> and <filename>systemd-confext.service</filename> services
|
||||
during the main OS boot process.</para>
|
||||
|
||||
<para>Also, see the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink>
|
||||
page for a simple mechanism for shipping system services in disk images, in a similar fashion to OS
|
||||
extensions. Note the differences in isolation between these two mechanisms: while system extensions directly extend
|
||||
the underlying OS image with additional files that appear as if they were shipped in the OS image itself
|
||||
and thus imply no security isolation, portable services imply service-level sandboxing in one way or another.</para>
|
||||
|
||||
<para>The <filename>systemd-sysext.service</filename> and <filename>systemd-confext.service</filename>
|
||||
services are guaranteed to finish start-up before <filename>basic.target</filename> is reached; i.e., by the time
|
||||
regular services initialize (those which do not use <varname>DefaultDependencies=no</varname>), the files
|
||||
and directories system extensions provide are available in <filename>/usr/</filename> and
|
||||
<filename>/opt/</filename> and may be accessed.</para>
|
||||
and directories provided by system and configuration extensions are available in <filename>/usr/</filename>,
|
||||
<filename>/opt/</filename>, and <filename>/etc/</filename> and may be accessed.</para>
|
||||
|
||||
<para>System and configuration extensions can also be used to extend the initrd, and the
|
||||
<filename>systemd-sysext-initrd.service</filename> and <filename>systemd-confext-initrd.service</filename>
|
||||
initrd services are provided. Note that some limitations apply: resources that are used in the earliest boot
|
||||
stages of the initrd (e.g. system services) cannot be updated.</para>
|
||||
|
||||
<para>Note that there is no concept of enabling/disabling installed system extension images: all
|
||||
installed extension images are automatically activated at boot. However, you can place an empty directory
|
||||
named like the extension (no <filename>.raw</filename>) in <filename>/etc/extensions/</filename> to "mask"
|
||||
an extension with the same name in a system folder with lower precedence.</para>
|
||||
an extension with the same name in a system folder with lower precedence. It is also possible to disable
|
||||
automatic merging altogether using the <varname>rd.systemd.sysext=</varname>, <varname>rd.systemd.confext=</varname>,
|
||||
<varname>systemd.sysext=</varname>, and <varname>systemd.confext=</varname> kernel command line options.
|
||||
Note that <filename>systemd-sysext-sysroot.service</filename> and
|
||||
<filename>systemd-confext-sysroot.service</filename> are controlled by the <varname>systemd.sysext=</varname>
|
||||
and <varname>systemd.confext=</varname> options, as these services merge system and configuration
|
||||
extensions for the main system, not for the initrd.</para>
|
||||
|
||||
<para>A simple mechanism for version compatibility is enforced: a system extension image must carry a
|
||||
<filename>/usr/lib/extension-release.d/extension-release.<replaceable>NAME</replaceable></filename>
|
||||
|
||||
@@ -9,12 +9,14 @@
|
||||
|
||||
# Settings for systemd units distributed with systemd itself, specific to initrds.
|
||||
|
||||
enable systemd-confext-sysroot.service
|
||||
enable systemd-journald-audit.socket
|
||||
enable systemd-network-generator.service
|
||||
enable systemd-networkd.service
|
||||
enable systemd-networkd-wait-online.service
|
||||
enable systemd-pstore.service
|
||||
enable systemd-resolved.service
|
||||
enable systemd-sysext-sysroot.service
|
||||
enable systemd-tpm2-clear.service
|
||||
|
||||
disable console-getty.service
|
||||
|
||||
@@ -52,7 +52,9 @@ disable proc-sys-fs-binfmt_misc.mount
|
||||
disable syslog.socket
|
||||
|
||||
disable systemd-boot-check-no-failures.service
|
||||
disable systemd-confext-sysroot.service
|
||||
disable systemd-journal-gatewayd.*
|
||||
disable systemd-journal-remote.*
|
||||
disable systemd-journal-upload.*
|
||||
disable systemd-sysext-sysroot.service
|
||||
disable systemd-time-wait-sync.service
|
||||
|
||||
@@ -51,6 +51,7 @@
|
||||
#include "path-util.h"
|
||||
#include "pidref.h"
|
||||
#include "pretty-print.h"
|
||||
#include "proc-cmdline.h"
|
||||
#include "process-util.h"
|
||||
#include "rm-rf.h"
|
||||
#include "runtime-scope.h"
|
||||
@@ -3038,6 +3039,22 @@ static int run(int argc, char *argv[]) {
|
||||
if (r <= 0)
|
||||
return r;
|
||||
|
||||
/* PROC_CMDLINE_STRIP_RD_PREFIX cannot be used here as we need to be able to distinguish between
|
||||
* rd.systemd.{sysext,confext} and systemd.{sysext,confext} in the initrd where they are both used
|
||||
* and have different meaning. */
|
||||
const char *string_class = image_class_to_string(arg_image_class);
|
||||
const char *cmdline_opt = strjoina(in_initrd() && !arg_root ? "rd." : "", "systemd.", string_class);
|
||||
|
||||
bool enabled;
|
||||
r = proc_cmdline_get_bool(cmdline_opt, PROC_CMDLINE_TRUE_WHEN_MISSING, &enabled);
|
||||
if (r < 0)
|
||||
log_debug_errno(r, "Failed to check '%s=' kernel command line option, proceeding: %m", cmdline_opt);
|
||||
else if (!enabled && invoked_by_systemd()) {
|
||||
/* Kernel command line option should not affect manual invocation. */
|
||||
log_notice("Disabled by the kernel command line option '%s=', skipping execution.", cmdline_opt);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Parse configuration file after argv because it needs --root=.
|
||||
* The config entries will not overwrite values set already by
|
||||
* env/argv because we track initialization. */
|
||||
|
||||
@@ -311,6 +311,10 @@ units = [
|
||||
'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'],
|
||||
'symlinks' : ['initrd.target.wants/'],
|
||||
},
|
||||
{
|
||||
'file' : 'systemd-confext-sysroot.service',
|
||||
'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'],
|
||||
},
|
||||
{
|
||||
'file' : 'systemd-coredump.socket',
|
||||
'conditions' : ['ENABLE_COREDUMP'],
|
||||
@@ -759,6 +763,10 @@ units = [
|
||||
'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'],
|
||||
'symlinks' : ['initrd.target.wants/'],
|
||||
},
|
||||
{
|
||||
'file' : 'systemd-sysext-sysroot.service',
|
||||
'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'],
|
||||
},
|
||||
{
|
||||
'file' : 'systemd-sysext.socket',
|
||||
'conditions' : ['ENABLE_SYSEXT'],
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Merge System Configuration Images into /etc/
|
||||
Description=Merge System Configuration Images into /etc/ of the initrd
|
||||
Documentation=man:systemd-confext-initrd.service(8)
|
||||
|
||||
ConditionCapability=CAP_SYS_ADMIN
|
||||
@@ -19,6 +19,7 @@ ConditionDirectoryNotEmpty=|/usr/lib/confexts
|
||||
ConditionDirectoryNotEmpty=|/.extra/confext
|
||||
ConditionDirectoryNotEmpty=|/.extra/global_confext
|
||||
ConditionPathExists=/etc/initrd-release
|
||||
ConditionKernelCommandLine=!rd.systemd.confext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
Before=local-fs-pre.target cryptsetup-pre.target systemd-tmpfiles-setup.service
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
#
|
||||
# This file is part of systemd.
|
||||
#
|
||||
# systemd is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU Lesser General Public License as published by
|
||||
# the Free Software Foundation; either version 2.1 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Merge System Configuration Images into /sysroot/etc/
|
||||
Documentation=man:systemd-confext-sysroot.service(8)
|
||||
|
||||
ConditionCapability=CAP_SYS_ADMIN
|
||||
ConditionDirectoryNotEmpty=|/sysroot/var/lib/confexts
|
||||
ConditionDirectoryNotEmpty=|/sysroot/usr/local/lib/confexts
|
||||
ConditionDirectoryNotEmpty=|/sysroot/usr/lib/confexts
|
||||
ConditionPathExists=/etc/initrd-release
|
||||
ConditionKernelCommandLine=!systemd.confext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
Conflicts=shutdown.target
|
||||
Before=initrd-root-fs.target shutdown.target
|
||||
Wants=modprobe@loop.service modprobe@dm_mod.service
|
||||
After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount sysroot-usr.mount systemd-volatile-root.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=systemd-confext --root=/sysroot refresh
|
||||
|
||||
[Install]
|
||||
WantedBy=initrd.target
|
||||
@@ -17,6 +17,7 @@ ConditionDirectoryNotEmpty=|/var/lib/confexts
|
||||
ConditionDirectoryNotEmpty=|/usr/local/lib/confexts
|
||||
ConditionDirectoryNotEmpty=|/usr/lib/confexts
|
||||
ConditionPathExists=!/etc/initrd-release
|
||||
ConditionKernelCommandLine=!systemd.confext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
After=local-fs.target
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Merge System Extension Images into /usr/ and /opt/
|
||||
Description=Merge System Extension Images into /usr/ and /opt/ of the initrd
|
||||
Documentation=man:systemd-sysext-initrd.service(8)
|
||||
|
||||
ConditionCapability=CAP_SYS_ADMIN
|
||||
@@ -18,6 +18,7 @@ ConditionDirectoryNotEmpty=|/var/lib/extensions
|
||||
ConditionDirectoryNotEmpty=|/.extra/sysext
|
||||
ConditionDirectoryNotEmpty=|/.extra/global_sysext
|
||||
ConditionPathExists=/etc/initrd-release
|
||||
ConditionKernelCommandLine=!rd.systemd.sysext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
Before=local-fs-pre.target cryptsetup-pre.target systemd-tmpfiles-setup.service
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
#
|
||||
# This file is part of systemd.
|
||||
#
|
||||
# systemd is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU Lesser General Public License as published by
|
||||
# the Free Software Foundation; either version 2.1 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Merge System Extension Images into /sysroot/usr/ and /sysroot/opt/
|
||||
Documentation=man:systemd-sysext-sysroot.service(8)
|
||||
|
||||
ConditionCapability=CAP_SYS_ADMIN
|
||||
ConditionDirectoryNotEmpty=|/sysroot/etc/extensions
|
||||
ConditionDirectoryNotEmpty=|/sysroot/var/lib/extensions
|
||||
ConditionPathExists=/etc/initrd-release
|
||||
ConditionKernelCommandLine=!systemd.sysext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
Conflicts=shutdown.target
|
||||
Before=initrd-root-fs.target shutdown.target
|
||||
Wants=modprobe@loop.service modprobe@dm_mod.service
|
||||
After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount sysroot-usr.mount systemd-volatile-root.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=systemd-sysext --root=/sysroot refresh
|
||||
|
||||
[Install]
|
||||
WantedBy=initrd.target
|
||||
@@ -17,6 +17,7 @@ ConditionDirectoryNotEmpty=|/run/extensions
|
||||
ConditionDirectoryNotEmpty=|/var/lib/extensions
|
||||
ConditionDirectoryNotEmpty=|/var/lib/extensions.mutable
|
||||
ConditionPathExists=!/etc/initrd-release
|
||||
ConditionKernelCommandLine=!systemd.sysext=0
|
||||
|
||||
DefaultDependencies=no
|
||||
After=local-fs.target
|
||||
|
||||
Reference in New Issue
Block a user