From 4f9e5d7842c18d4dc2c2ec748ca9481aedb33fad Mon Sep 17 00:00:00 2001 From: Finn Callies Date: Fri, 3 Jul 2026 09:42:59 +0200 Subject: [PATCH] 95sel-ebc: Reorder PAES enforcement service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix the sel-ebc-paes-enforce.service to run AFTER the sysroot.mount which prevents a TOCTOU situation. Reviewed-by: Holger Dengler Signed-off-by: Finn Callies Signed-off-by: Jan Höppner --- rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service b/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service index e5d70ea7..b58cc9a9 100644 --- a/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service +++ b/rust/pvebc/95sel-ebc/sel-ebc-paes-enforce.service @@ -4,7 +4,8 @@ Description=Enforce PAES encrypted root fs for SEL guests # Ensure this runs before the handoff to the real root, if that's required: After=cryptsetup.target After=initrd-root-device.target -Before=sysroot.mount +After=sysroot.mount +Before=initrd-switch-root.service # Initramfs requirement DefaultDependencies=no