From 851f63eb03fc08d5715242eab5ffdf77f87d3bfc Mon Sep 17 00:00:00 2001 From: Finn Callies Date: Wed, 6 May 2026 11:57:17 +0200 Subject: [PATCH] pvebc: Fix dependency for non EBC guests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For guests that do not make use of the EBC feature the boot should not be impacted by this module. This requires removing the boot.mount unit because it will unconditionally create a dependency on a unit that conflicts with that idea. The downside is that mounting of the boot partition has to be done manually. Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/202 Reviewed-by: Holger Dengler Signed-off-by: Finn Callies Signed-off-by: Jan Höppner --- rust/Makefile | 3 +- rust/pvebc/95sel-ebc/boot-mount.sh | 31 +++++++++++++++++++ rust/pvebc/95sel-ebc/boot.mount | 28 ----------------- rust/pvebc/95sel-ebc/module-setup.sh | 10 ++++-- rust/pvebc/95sel-ebc/override-crypttab.sh | 7 ++++- .../95sel-ebc/sel-ebc-boot-mount.service | 21 +++++++++++++ .../sel-ebc-override-crypttab.service | 2 -- rust/pvebc/95sel-ebc/sel-ebc-pvebc.service | 4 +-- 8 files changed, 69 insertions(+), 37 deletions(-) create mode 100644 rust/pvebc/95sel-ebc/boot-mount.sh delete mode 100644 rust/pvebc/95sel-ebc/boot.mount create mode 100644 rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service diff --git a/rust/Makefile b/rust/Makefile index 07686cb9..93d1f738 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -114,9 +114,10 @@ ifneq ($(HAVE_DRACUT),0) $(INSTALL) -m 755 pvebc/$(SEL_EBC_MODDIR)/module-setup.sh \ pvebc/$(SEL_EBC_MODDIR)/override-crypttab.sh \ pvebc/$(SEL_EBC_MODDIR)/pvebc-wrapper.sh \ + pvebc/$(SEL_EBC_MODDIR)/boot-mount.sh \ pvebc/$(SEL_EBC_MODDIR)/sel-ebc-modules.conf \ $(DESTDIR)$(DRACUTMODDIR)/$(SEL_EBC_MODDIR) - $(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/boot.mount \ + $(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/sel-ebc-boot-mount.service \ pvebc/$(SEL_EBC_MODDIR)/sel-ebc-override-crypttab.service \ pvebc/$(SEL_EBC_MODDIR)/sel-ebc-paes-enforce.service \ pvebc/$(SEL_EBC_MODDIR)/sel-ebc-pvebc.service \ diff --git a/rust/pvebc/95sel-ebc/boot-mount.sh b/rust/pvebc/95sel-ebc/boot-mount.sh new file mode 100644 index 00000000..adc8bdb8 --- /dev/null +++ b/rust/pvebc/95sel-ebc/boot-mount.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# SPDX-License-Identifier: MIT +# +# Copyright IBM Corp. + +set -eu + +mntp="/boot" +block_dev="$(blkid -L boot)" + +if [[ -z "${block_dev}" ]]; then + echo "Unable to find partition with label boot" + exit 1 +elif [[ ! -b "${block_dev}" ]]; then + echo "Unable to find block device ${block_dev}" + exit 1 +else + echo "Found block device ${block_dev}" +fi + +if [[ ! -d "${mntp}" ]]; then + echo "Mountpoint ${mntp} does not exist, creating..." + mkdir "${mntp}" +else + echo "Mountpoint ${mntp} exists" +fi + +echo "Mounting ${block_dev} to ${mntp}" +mount --options ro "${block_dev}" "${mntp}" + +exit 0 diff --git a/rust/pvebc/95sel-ebc/boot.mount b/rust/pvebc/95sel-ebc/boot.mount deleted file mode 100644 index b672bcd6..00000000 --- a/rust/pvebc/95sel-ebc/boot.mount +++ /dev/null @@ -1,28 +0,0 @@ -[Unit] -Description=Mount /boot early in initramfs - -# Initramfs requirement -DefaultDependencies=no -# Make absolutely sure this only runs in initramfs (and not post-pivot if the -# unit ever appears there) -ConditionPathExists=/etc/initrd-release -ConditionKernelCommandLine=root - -# we use /dev/disk/by-label because it identifies the boot partition system -# independently IF set up correctly -Requires=dev-disk-by\x2dlabel-boot.device - -# Ordering dependencies -After=dev-disk-by\x2dlabel-boot.device -Before=sel-ebc-pvebc.service - -[Mount] -# system independent identification of boot partition requires that the label -# boot is set for the boot partition -What=/dev/disk/by-label/boot -Where=/boot -Type=auto -Options=defaults - -[Install] -WantedBy=sel-ebc-pvebc.service diff --git a/rust/pvebc/95sel-ebc/module-setup.sh b/rust/pvebc/95sel-ebc/module-setup.sh index d804f6fd..8ada0473 100644 --- a/rust/pvebc/95sel-ebc/module-setup.sh +++ b/rust/pvebc/95sel-ebc/module-setup.sh @@ -43,8 +43,8 @@ install() { "$systemdsystemunitdir/sel-ebc-paes-enforce.service" inst_simple "$moddir/sel-ebc-override-crypttab.service" \ "$systemdsystemunitdir/sel-ebc-override-crypttab.service" - inst_simple "$moddir/boot.mount" \ - "$systemdsystemunitdir/boot.mount" + inst_simple "$moddir/sel-ebc-boot-mount.service" \ + "$systemdsystemunitdir/sel-ebc-boot-mount.service" # already exisitng unit we depend on for kernel modules inst_simple /usr/lib/systemd/system/systemd-modules-load.service \ @@ -58,6 +58,10 @@ install() { inst_simple "$moddir/override-crypttab.sh" \ "/etc/sel-ebc/override-crypttab.sh" + # mount boot partition to /boot + inst_simple "$moddir/boot-mount.sh" \ + "/etc/sel-ebc/boot-mount.sh" + # install kernel module dependencies inst_simple "$moddir/sel-ebc-modules.conf" \ "/usr/lib/modules-load.d/sel-ebc-modules.conf" @@ -76,5 +80,5 @@ install() { systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-override-crypttab.service systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-paes-enforce.service systemctl --root "$initdir" --no-reload --quiet enable systemd-modules-load.service - systemctl --root "$initdir" --no-reload --quiet enable boot.mount + systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-boot-mount.service } diff --git a/rust/pvebc/95sel-ebc/override-crypttab.sh b/rust/pvebc/95sel-ebc/override-crypttab.sh index fb17498a..78b7d79b 100644 --- a/rust/pvebc/95sel-ebc/override-crypttab.sh +++ b/rust/pvebc/95sel-ebc/override-crypttab.sh @@ -15,6 +15,11 @@ cp "${IBM_RSRC_DIR}/crypttab" "/etc/crypttab" systemctl daemon-reload -systemctl restart systemd-cryptsetup@cryptroot_mapper.service +udevadm trigger --subsystem-match=block --settle + +if ! systemctl restart systemd-cryptsetup@cryptroot_mapper.service; then + systemctl status systemd-cryptsetup@cryptroot_mapper.service + exit 1 +fi exit 0 diff --git a/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service b/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service new file mode 100644 index 00000000..8316d129 --- /dev/null +++ b/rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service @@ -0,0 +1,21 @@ +[Unit] +Description=Mount a partition identified by label boot to /boot + +# Ensure this runs before the handoff to the real root, if that's required: +Before=sel-ebc-pvebc.service + +# Initramfs requirement +DefaultDependencies=no +# Make absolutely sure this only runs in initramfs +ConditionPathExists=/etc/initrd-release +ConditionKernelCommandLine=rd.sel-ebc + +[Service] +Type=oneshot +ExecStart=/bin/bash /etc/sel-ebc/boot-mount.sh +RemainAfterExit=yes +# On failure immediately abort boot +FailureAction=poweroff-immediate + +[Install] +RequiredBy=sel-ebc-pvebc.service diff --git a/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service b/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service index ee03a19f..7d30fee7 100644 --- a/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service +++ b/rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service @@ -4,10 +4,8 @@ Description=Override crypttab # boot partition contains SICS # Loading of kernel modules is required which are needed for protected keys Requires=systemd-modules-load.service -Requires=boot.mount # Ensure this runs before the handoff to the real root, if that's required: -After=boot.mount After=systemd-modules-load.service Before=cryptsetup-pre.target Before=cryptsetup.target diff --git a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service index 70dff16e..13652621 100644 --- a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service +++ b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service @@ -4,14 +4,14 @@ Description=Run pvebc during early boot to process SICS # boot partition contains SICS # Loading of kernel modules is required which are needed for protected keys Requires=systemd-modules-load.service -Wants=boot.mount +Requires=sel-ebc-boot-mount.service # Ensure this runs before the handoff to the real root, if that's required: Before=initrd-root-device.target Before=cryptsetup-pre.target Before=cryptsetup.target -After=boot.mount After=systemd-modules-load.service +After=sel-ebc-boot-mount.service # Initramfs requirement DefaultDependencies=no