rancher/packages
1
0
Fork 0
mirror of https://github.com/kairos-io/packages.git synced 2025-08-21 01:14:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix sysext overwriting our mounts (#901)

Browse Source
This commit is contained in:
Itxaka 2024-06-12 15:30:46 +02:00 committed by GitHub
parent bfbd02cc35
commit 401c744e07
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/static/kairos-overlay-files/collection.yaml
View File

@ -1,4 +1,4 @@
packages: packages:
- name: "kairos-overlay-files" - name: "kairos-overlay-files"
category: "static" category: "static"
version: "1.1.35" version: "1.1.36"

9
packages/static/kairos-overlay-files/files/system/oem/24_sysext.yaml → packages/static/kairos-overlay-files/files/system/oem/99_sysext.yaml
View File

@ -19,11 +19,20 @@ stages:
group: 0 group: 0
content: | content: |
[Service] [Service]
# Make it timeout early to avoid blocking boot if keys are not in there to unlock sysext
TimeoutStartSec=10 TimeoutStartSec=10
# override exec and reload to set the image policy
ExecStart=systemd-sysext refresh --image-policy="root=verity+signed+absent:usr=verity+signed+absent" ExecStart=systemd-sysext refresh --image-policy="root=verity+signed+absent:usr=verity+signed+absent"
ExecReload=systemd-sysext refresh --image-policy="root=verity+signed+absent:usr=verity+signed+absent" ExecReload=systemd-sysext refresh --image-policy="root=verity+signed+absent:usr=verity+signed+absent"
# set the sysext hierarchies so we dont overwrite our mount at /usr/local
# set them very specifically instead of a generic /usr/local as systemd <= 255 mounts the overlay as RO
# and we dont want the full /usr/local to be RO as we store state in there
# on systemd 256 we can control if they are mutable or not
Environment="SYSTEMD_SYSEXT_HIERARCHIES=/usr/local/bin:/usr/local/sbin:/usr/local/include:/usr/local/lib:/usr/local/share:/usr/local/src:/usr/bin:/usr/share:/usr/lib:/usr/include:/usr/src:/usr/sbin"
[Unit] [Unit]
# Make it timeout early to avoid blocking boot if keys are not in there to unlock sysext
JobRunningTimeoutSec=5 JobRunningTimeoutSec=5
initramfs.after:
- name: "systemd-sysext initramfs settings" - name: "systemd-sysext initramfs settings"
if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]' if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
systemctl: systemctl: