diff --git a/NEWS b/NEWS index 573afc9bb7..dc205e6a47 100644 --- a/NEWS +++ b/NEWS @@ -28,6 +28,15 @@ CHANGES WITH 261 in spe: require direct IMDS access. The new meson option "-Dimds-network=" can be used to change the default mode to "locked" at build-time. + Changes in systemd-sysext/systemd-confext: + + * New initrd services systemd-sysext-sysroot.service and + systemd-confext-sysroot.service are provided. These services are + used to merge system and configuration extensions for the main system + from the initrd. This overcomes the limitation that system and + configuration extensions merged from the main system itself cannot be + used to modify the resources which are used in the early boot. + CHANGES WITH 260: Feature Removals and Incompatible Changes: diff --git a/TODO b/TODO index 378d318122..aca06755c0 100644 --- a/TODO +++ b/TODO @@ -119,6 +119,8 @@ Deprecations and removals: similar "devices" Features: +* sysext: make systemd-{sys,conf}ext-sysroot.service work in the split '/var' + configuration. * sd-varlink: add fully async modes of the protocol upgrade stuff @@ -1769,9 +1771,6 @@ Features: * in sd-id128: also parse UUIDs in RFC4122 URN syntax (i.e. chop off urn:uuid: prefix) -* systemd-sysext: optionally, run it in initrd already, before transitioning - into host, to open up possibility for services shipped like that. - * whenever we receive fds via SCM_RIGHTS make sure none got dropped due to the reception limit the kernel silently enforces. diff --git a/man/rules/meson.build b/man/rules/meson.build index 911a68543e..aa2653ce0d 100644 --- a/man/rules/meson.build +++ b/man/rules/meson.build @@ -1197,8 +1197,10 @@ manpages = [ '8', ['systemd-confext', 'systemd-confext-initrd.service', + 'systemd-confext-sysroot.service', 'systemd-confext.service', 'systemd-sysext-initrd.service', + 'systemd-sysext-sysroot.service', 'systemd-sysext.service'], 'ENABLE_SYSEXT'], ['systemd-system-update-generator', '8', [], ''], diff --git a/man/systemd-sysext.xml b/man/systemd-sysext.xml index c9a8f1ed01..49cfee8668 100644 --- a/man/systemd-sysext.xml +++ b/man/systemd-sysext.xml @@ -20,9 +20,11 @@ systemd-sysext systemd-sysext.service systemd-sysext-initrd.service + systemd-sysext-sysroot.service systemd-confext systemd-confext.service systemd-confext-initrd.service + systemd-confext-sysroot.service Activates System Extension Images @@ -114,22 +116,36 @@ systemd-stub7 with extension images found in the system's EFI System Partition. - During boot OS extension images are activated automatically, if the - systemd-sysext.service is enabled. Note that this service runs only after the - underlying file systems where system extensions may be located have been mounted. This means they are not - suitable for shipping resources that are processed by subsystems running in earliest boot. Specifically, - OS extension images are not suitable for shipping system services or + During boot, system and configuration extension images are activated automatically if the + systemd-sysext.service and systemd-confext.service services are + enabled. Note that these services run only after the underlying file systems where system and configuration + extensions may be located have been mounted. To make it possible to ship resources that are processed by + subsystems running in the earliest boot stages (for example, system services or systemd-sysusers8 - definitions. See the Portable Services page - for a simple mechanism for shipping system services in disk images, in a similar fashion to OS - extensions. Note the different isolation on these two mechanisms: while system extension directly extend - the underlying OS image with additional files that appear in a way very similar to as if they were - shipped in the OS image itself and thus imply no security isolation, portable services imply service - level sandboxing in one way or another. The systemd-sysext.service service is - guaranteed to finish start-up before basic.target is reached; i.e. at the time + definitions), the systemd-sysext-sysroot.service and + systemd-confext-sysroot.service initrd services are provided. Currently, these + services cannot be used to merge system extensions from /sysroot/var/lib/extensions/ + and configuration extensions from /sysroot/var/lib/confexts/ when the + /var/ partition is split off. These extensions are later merged by the + systemd-sysext.service and systemd-confext.service services + during the main OS boot process. + + Also, see the Portable Services + page for a simple mechanism for shipping system services in disk images, in a similar fashion to OS + extensions. Note the differences in isolation between these two mechanisms: while system extensions directly extend + the underlying OS image with additional files that appear as if they were shipped in the OS image itself + and thus imply no security isolation, portable services imply service-level sandboxing in one way or another. + + The systemd-sysext.service and systemd-confext.service + services are guaranteed to finish start-up before basic.target is reached; i.e., by the time regular services initialize (those which do not use DefaultDependencies=no), the files - and directories system extensions provide are available in /usr/ and - /opt/ and may be accessed. + and directories provided by system and configuration extensions are available in /usr/, + /opt/, and /etc/ and may be accessed. + + System and configuration extensions can also be used to extend the initrd, and the + systemd-sysext-initrd.service and systemd-confext-initrd.service + initrd services are provided. Note that some limitations apply: resources that are used in the earliest boot + stages of the initrd (e.g. system services) cannot be updated. Note that there is no concept of enabling/disabling installed system extension images: all installed extension images are automatically activated at boot. However, you can place an empty directory diff --git a/presets/90-systemd-initrd.preset b/presets/90-systemd-initrd.preset index e966a182f1..b7b966daca 100644 --- a/presets/90-systemd-initrd.preset +++ b/presets/90-systemd-initrd.preset @@ -9,12 +9,14 @@ # Settings for systemd units distributed with systemd itself, specific to initrds. +enable systemd-confext-sysroot.service enable systemd-journald-audit.socket enable systemd-network-generator.service enable systemd-networkd.service enable systemd-networkd-wait-online.service enable systemd-pstore.service enable systemd-resolved.service +enable systemd-sysext-sysroot.service enable systemd-tpm2-clear.service disable console-getty.service diff --git a/presets/90-systemd.preset b/presets/90-systemd.preset index 56f9e93706..cd7afb5df2 100644 --- a/presets/90-systemd.preset +++ b/presets/90-systemd.preset @@ -52,7 +52,9 @@ disable proc-sys-fs-binfmt_misc.mount disable syslog.socket disable systemd-boot-check-no-failures.service +disable systemd-confext-sysroot.service disable systemd-journal-gatewayd.* disable systemd-journal-remote.* disable systemd-journal-upload.* +disable systemd-sysext-sysroot.service disable systemd-time-wait-sync.service diff --git a/units/meson.build b/units/meson.build index 02c2db074c..16c082a623 100644 --- a/units/meson.build +++ b/units/meson.build @@ -311,6 +311,10 @@ units = [ 'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'], 'symlinks' : ['initrd.target.wants/'], }, + { + 'file' : 'systemd-confext-sysroot.service', + 'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'], + }, { 'file' : 'systemd-coredump.socket', 'conditions' : ['ENABLE_COREDUMP'], @@ -759,6 +763,10 @@ units = [ 'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'], 'symlinks' : ['initrd.target.wants/'], }, + { + 'file' : 'systemd-sysext-sysroot.service', + 'conditions' : ['ENABLE_INITRD', 'ENABLE_SYSEXT'], + }, { 'file' : 'systemd-sysext.socket', 'conditions' : ['ENABLE_SYSEXT'], diff --git a/units/systemd-confext-initrd.service b/units/systemd-confext-initrd.service index 073307edcc..67e1b1b8d3 100644 --- a/units/systemd-confext-initrd.service +++ b/units/systemd-confext-initrd.service @@ -8,7 +8,7 @@ # (at your option) any later version. [Unit] -Description=Merge System Configuration Images into /etc/ +Description=Merge System Configuration Images into /etc/ of the initrd Documentation=man:systemd-confext-initrd.service(8) ConditionCapability=CAP_SYS_ADMIN diff --git a/units/systemd-confext-sysroot.service b/units/systemd-confext-sysroot.service new file mode 100644 index 0000000000..2ca6da70aa --- /dev/null +++ b/units/systemd-confext-sysroot.service @@ -0,0 +1,32 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Merge System Configuration Images into /sysroot/etc/ +Documentation=man:systemd-confext-sysroot.service(8) + +ConditionCapability=CAP_SYS_ADMIN +ConditionDirectoryNotEmpty=|/sysroot/var/lib/confexts +ConditionDirectoryNotEmpty=|/sysroot/usr/local/lib/confexts +ConditionDirectoryNotEmpty=|/sysroot/usr/lib/confexts +ConditionPathExists=/etc/initrd-release + +DefaultDependencies=no +Conflicts=shutdown.target +Before=initrd-root-fs.target shutdown.target +Wants=modprobe@loop.service modprobe@dm_mod.service +After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount sysroot-usr.mount systemd-volatile-root.service + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=systemd-confext --root=/sysroot refresh + +[Install] +WantedBy=initrd.target diff --git a/units/systemd-sysext-initrd.service b/units/systemd-sysext-initrd.service index 4a411bb65e..c6e93a3719 100644 --- a/units/systemd-sysext-initrd.service +++ b/units/systemd-sysext-initrd.service @@ -8,7 +8,7 @@ # (at your option) any later version. [Unit] -Description=Merge System Extension Images into /usr/ and /opt/ +Description=Merge System Extension Images into /usr/ and /opt/ of the initrd Documentation=man:systemd-sysext-initrd.service(8) ConditionCapability=CAP_SYS_ADMIN diff --git a/units/systemd-sysext-sysroot.service b/units/systemd-sysext-sysroot.service new file mode 100644 index 0000000000..11841ebdcd --- /dev/null +++ b/units/systemd-sysext-sysroot.service @@ -0,0 +1,31 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Merge System Extension Images into /sysroot/usr/ and /sysroot/opt/ +Documentation=man:systemd-sysext-sysroot.service(8) + +ConditionCapability=CAP_SYS_ADMIN +ConditionDirectoryNotEmpty=|/sysroot/etc/extensions +ConditionDirectoryNotEmpty=|/sysroot/var/lib/extensions +ConditionPathExists=/etc/initrd-release + +DefaultDependencies=no +Conflicts=shutdown.target +Before=initrd-root-fs.target shutdown.target +Wants=modprobe@loop.service modprobe@dm_mod.service +After=modprobe@loop.service modprobe@dm_mod.service sysroot.mount sysroot-usr.mount systemd-volatile-root.service + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=systemd-sysext --root=/sysroot refresh + +[Install] +WantedBy=initrd.target