From 5585f60aa0a26eb147f84a80fc2700f2896eaa5c Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 11 2024 08:36:44 +0000 Subject: [PATCH 1/4] initramfs: Add dracut config for initramfs generation Add a default dracut configuration for initramfs generation. This is currently taken from: - https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml - https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d This will ideally be unified once we complete the Bootable Containers Initiative roadmap. --- diff --git a/fedora-common-ostree.yaml b/fedora-common-ostree.yaml index cb9e66f..9df997e 100644 --- a/fedora-common-ostree.yaml +++ b/fedora-common-ostree.yaml @@ -10,6 +10,8 @@ include: - fedora-common-ostree-pkgs.yaml # See: https://gitlab.com/fedora/ostree/sig/-/issues/1 # - bootupd.yaml + # Dracut configuration for the initramfs + - initramfs.yaml packages: # Ensure that we have a kernel. Kernel packages are not in any comps group diff --git a/initramfs.yaml b/initramfs.yaml new file mode 100644 index 0000000..02925dd --- /dev/null +++ b/initramfs.yaml @@ -0,0 +1,29 @@ +# Set dracut configuration for the initramfs +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/initramfs.yaml +# See: https://github.com/coreos/fedora-coreos-config/tree/testing-devel/overlay.d/05core/usr/lib/dracut/dracut.conf.d +# +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/dracut/dracut.conf.d + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-nohostonly.conf << 'EOF' + # Default model is server-side generated initramfs + hostonly=no + EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-nostrip.conf << 'EOF' + # We don't ship `strip` or `eu-strip` today, and even if we did, it doesn't + # save much space. So let's disable it to avoid the error-looking message. + do_strip=no + EOF From 440fa5e438bc7573de380a2a16aac2b06ce37c19 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 11 2024 08:36:44 +0000 Subject: [PATCH 2/4] initramfs: Add tpm2-tss & systemd-pcrphase for LUKS unlocking Enable both modules to make it easier to setup TPM bound LUKS device unlocking. See: https://gitlab.com/fedora/ostree/sig/-/issues/33 --- diff --git a/initramfs.yaml b/initramfs.yaml index 02925dd..002d77a 100644 --- a/initramfs.yaml +++ b/initramfs.yaml @@ -27,3 +27,12 @@ postprocess: # save much space. So let's disable it to avoid the error-looking message. do_strip=no EOF + + - | + #!/usr/bin/env bash + set -xeuo pipefail + + cat > /usr/lib/dracut/dracut.conf.d/20-atomic-tpm-luks.conf << 'EOF' + # Add support for systemd-cryptsetup and tpm2-tss LUKS locking + add_dracutmodules+=" tpm2-tss systemd-pcrphase " + EOF From 0667595535d118cc863137e8f4a20b6b1947b195 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 11 2024 08:36:44 +0000 Subject: [PATCH 3/4] ci/validate: Ignore correctly indented lines starting with [ --- diff --git a/ci/validate b/ci/validate index d9b90af..6f21443 100755 --- a/ci/validate +++ b/ci/validate @@ -30,7 +30,7 @@ for root, dirs, files, rootfd in os.fwalk('.'): print("Validating:", name) with open(os.open(name, dir_fd=rootfd, flags=os.O_RDONLY)) as f: yaml.safe_load(f) - result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^$|^#', name], encoding='UTF-8', + result = subprocess.run(['grep', '-RniEv', '^( )*[a-z#/-]|^( )*\\[|^$|^#', name], encoding='UTF-8', preexec_fn=lambda: os.fchdir(rootfd)) if result.returncode == 0: raise Exception("Found likely invalid indentation in YAML file: {}".format(name)) From 3b190aff6cac954f024dbd59aa52c13daa6b52d2 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Jun 11 2024 08:36:44 +0000 Subject: [PATCH 4/4] common: Setup read only sysroot via ostree config --- diff --git a/fedora-common-ostree.yaml b/fedora-common-ostree.yaml index 9df997e..d3baf9b 100644 --- a/fedora-common-ostree.yaml +++ b/fedora-common-ostree.yaml @@ -12,6 +12,8 @@ include: # - bootupd.yaml # Dracut configuration for the initramfs - initramfs.yaml + # Read only sysroot + - sysroot-ro.yaml packages: # Ensure that we have a kernel. Kernel packages are not in any comps group diff --git a/postprocess.sh b/postprocess.sh index c788ada..d871a85 100755 --- a/postprocess.sh +++ b/postprocess.sh @@ -1,115 +1,6 @@ #!/usr/bin/env bash set -xeuo pipefail -# Setup unit & script for readonly sysroot migration: -# - https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -# - https://bugzilla.redhat.com/show_bug.cgi?id=2060976 - -cat > /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service <<'EOF' -[Unit] -Description=Fedora Silverblue Read-Only Sysroot Migration -Documentation=https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -ConditionPathExists=!/var/lib/.fedora_silverblue_readonly_sysroot -RequiresMountsFor=/sysroot /boot -ConditionPathIsReadWrite=/sysroot - -[Service] -Type=oneshot -ExecStart=/usr/libexec/fedora-silverblue-readonly-sysroot -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target -EOF - -chmod 644 /usr/lib/systemd/system/fedora-silverblue-readonly-sysroot.service - -cat > /usr/libexec/fedora-silverblue-readonly-sysroot <<'EOF' -#!/bin/bash - -# Update an existing system to use a read only sysroot -# See https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot -# and https://bugzilla.redhat.com/show_bug.cgi?id=2060976 - -set -euo pipefail - -main() { - # Used to condition execution of this unit at the systemd level - local -r stamp_file="/var/lib/.fedora_silverblue_readonly_sysroot" - - if [[ -f "${stamp_file}" ]]; then - exit 0 - fi - - local -r ostree_sysroot_readonly="$(ostree config --repo=/sysroot/ostree/repo get "sysroot.readonly" &> /dev/null || echo "false")" - if [[ "${ostree_sysroot_readonly}" == "true" ]]; then - # Nothing to do - touch "${stamp_file}" - exit 0 - fi - - local -r boot_entries="$(ls -A /boot/loader/entries/ | wc -l)" - - # Ensure that we can read BLS entries to avoid touching systems where /boot - # is not mounted - if [[ "${boot_entries}" -eq 0 ]]; then - echo "No BLS entry found: Maybe /boot is not mounted?" 1>&2 - echo "This is unexpected thus no migration will be performed" 1>&2 - touch "${stamp_file}" - exit 0 - fi - - # Check if any existing deployment is still missing the rw karg - local rw_kargs_found=0 - local count=0 - for f in "/boot/loader/entries/"*; do - count="$(grep -c "^options .* rw" "${f}" || true)" - if [[ "${count}" -ge 1 ]]; then - rw_kargs_found=$((rw_kargs_found + 1)) - fi - done - - # Some deployments are still missing the rw karg. Let's try to update them - if [[ "${boot_entries}" -ne "${rw_kargs_found}" ]]; then - ostree admin kargs edit-in-place --append-if-missing=rw || \ - echo "Failed to edit kargs in place with ostree" 1>&2 - fi - - # Re-check if any existing deployment is still missing the rw karg - rw_kargs_found=0 - count=0 - for f in "/boot/loader/entries/"*; do - count="$(grep -c "^options .* rw" "${f}" || true)" - if [[ "${count}" -ge 1 ]]; then - rw_kargs_found=$((rw_kargs_found + 1)) - fi - done - unset count - - # If all deployments are good, then we can set the sysroot.readonly option - # in the ostree repo config - if [[ "${boot_entries}" -eq "${rw_kargs_found}" ]]; then - echo "Setting up the sysroot.readonly option in the ostree repo config" - ostree config --repo=/sysroot/ostree/repo set "sysroot.readonly" "true" - touch "${stamp_file}" - exit 0 - fi - - # If anything else before failed, we will retry on next boot - echo "Will retry next boot" 1>&2 - exit 0 -} - -main "${@}" -EOF - -chmod 755 /usr/libexec/fedora-silverblue-readonly-sysroot - -# Enable the corresponding unit -systemctl enable fedora-silverblue-readonly-sysroot.service - -### - # Workaround for Python timestamp mismatch # See: https://github.com/ostreedev/ostree/issues/1469 diff --git a/sysroot-ro.yaml b/sysroot-ro.yaml new file mode 100644 index 0000000..006863b --- /dev/null +++ b/sysroot-ro.yaml @@ -0,0 +1,13 @@ +# Set up default root config to mount sysroot as read only +# https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot +# See: https://gitlab.com/fedora/bootc/base-images/-/blob/main/tier-0/ostree.yaml +postprocess: + - | + #!/usr/bin/env bash + set -xeuo pipefail + + install -dm 0755 -o 0 -g 0 /usr/lib/ostree + cat >> /usr/lib/ostree/prepare-root.conf << 'EOF' + [sysroot] + readonly = true + EOF