This introduces root=dissect, which is a lot like root=gpt-auto, but
uses the image dissection logic to find the root partition. It's also
based on the GPT efi var telling us about the root disk, but instead of
just picking some suitable root disk manually it uses the dissection
logic.
This is a big step forward, since it means we can actually make
use of the image policy logic for the root fs too.
Previously if we found a verity signature partition in an image, and the
image policy required "verity" (but did not allow "signature") we'd
refuse the image. This is of course unnecessarily strict: if "verity" is
allowed, we can make use of the verity data, and ignore the signature
data.
hence, relax the rules here: when we pick up a partition and want to
test it against the policy, always consider all "weaker" uses too, maybe
they are allowed if the "stronger" users isn't.
When dissecting an image, let's make use of the Verity data even if we
got told no root hash explicitly: we can simply determine it by
concatenating the data partition uuid with the verity partition uuid.
Of course, on first thought this doesn't really add much: if the root
hash is not pinned from somewhere, this does not guarantee trust in
the image.
However, this is very useful for attestation: if we have the root hash
we can measure it before mounting things, even if we don't actually
authenticate it.
Hence, at best this helps us with attestation, at worst it doesn't improve
security but certainly doesn't hurt it.
Previously, if during early enumeration of the partition table we
figured out we have a verity + verity-sig partition, we determined we are
"ready" to do verity/verity-sig, as reported by the "verity_ready" and
"verity_ready_sig" fields of DissectedImage.
Let's rework this: only determine we are ready in case the VeritySettings
structure is fully populated. Mark verity-sig/verity only as ready once
we actually *load* the verity sig metadata from the special partition.
This is conceptually more correct, as we consider things "ready" only if
we actually have all data for it loaded. It's also preparation for a
later commit that guesses the verity root hash based on what we discover.
So far the gpt-auto symlinks would point to:
1. the disk the ESP/XBOOTLDR is located on
2. or to a loopback device whose filename field is set to "rootdisk"
or "rootdisk.raw"
This makes sense in the initrd. But once we transition to the host this
is quite confusing, since the symlinks might point to a different place
than what we actually ended up transitioning too: the actual backing
device of the root file system might be different from what gpt-auto
found.
Let's clean this up: let's avoid any ambiguities here: let's extend the
rules above with one more rule:
3. if we left the initrd, we'll make gpt-auto point to the selected
root file system, if it otherwise would have been a candidate.
Or in other words, the ID_PART_GPT_AUTO_ROOT_DISK=1 udev property now
always makes sense: in the initrd it points to the future root disk, and
on the host to the actual root disk.
Fixes: #34319
Otherwise, if a test in a spurious state, it consumes quite long time.
Let's fail earlier in such case.
This also drops an unnecessary calls of 'udevadm settle' in
testcase_nvme_basic() of TEST-64-UDEV-STORAGE.
Map the FN key of TUXEDO NB02 devices that produces a scancode unrecognized by
the Linux kernel.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
All other rules in 99-systemd.rules are pretty much concerned about
SYSTEMD_READY=1 and tagging devices the service manager shall track. But
the gpt-root symlink is different, and it makes sense independently of
the service manager. Hence give it a separate file.
This introduces indentation for inner sections skipped via GOTO=. The
rules parser supports that. In order to make this more readable, let's
maybe make use of this.
We use StandardOutput=journal+console for integration test units
to make sure the output from the test ends up on both the serial
console and in the journal. Unfortunately this only works for
messages written to stdout/stderr of the test service. All journal
messages logged by systemd tools will only end up in the journal and
not on the serial console. This makes test failures harder to debug
than needed because developers have to fetch the journal to figure
out the actual error that was logged by any systemd tool that failed
when invoked from the integration test script.
To fix this, let's unset $JOURNAL_STREAM for the integration test
units. This forces all output to go through stdout, which will make
journald forward it to the console and save it in the journal.
This replaces home-grown notification method from worker processes to
manager process with sd-notify. Then, we can reuse many library
functions commonly used by many components.
Hopefully, this does not change any effective functionalities.
Lennart Poettering
Yu Watanabe
Matteo Croce
Werner Sembach
Daan De Meyer
z z
victor-ok