pvebc: Fix dependency for non EBC guests

For guests that do not make use of the EBC feature the boot should not
be impacted by this module. This requires removing the boot.mount unit
because it will unconditionally create a dependency on a unit that
conflicts with that idea. The downside is that mounting of the boot
partition has to be done manually.

Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/202
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/Makefile

@@ -114,9 +114,10 @@ ifneq ($(HAVE_DRACUT),0)
 	$(INSTALL) -m 755 pvebc/$(SEL_EBC_MODDIR)/module-setup.sh \
 		pvebc/$(SEL_EBC_MODDIR)/override-crypttab.sh \
 		pvebc/$(SEL_EBC_MODDIR)/pvebc-wrapper.sh \
+		pvebc/$(SEL_EBC_MODDIR)/boot-mount.sh \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-modules.conf \
 		$(DESTDIR)$(DRACUTMODDIR)/$(SEL_EBC_MODDIR)
-	$(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/boot.mount \
+	$(INSTALL) -m 644 pvebc/$(SEL_EBC_MODDIR)/sel-ebc-boot-mount.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-override-crypttab.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-paes-enforce.service \
 		pvebc/$(SEL_EBC_MODDIR)/sel-ebc-pvebc.service \

rust/pvebc/95sel-ebc/boot-mount.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# SPDX-License-Identifier: MIT
+#
+# Copyright IBM Corp.
+
+set -eu
+
+mntp="/boot"
+block_dev="$(blkid -L boot)"
+
+if [[ -z "${block_dev}" ]]; then
+	echo "Unable to find partition with label boot"
+	exit 1
+elif [[ ! -b "${block_dev}" ]]; then
+	echo "Unable to find block device ${block_dev}"
+	exit 1
+else
+	echo "Found block device ${block_dev}"
+fi
+
+if [[ ! -d "${mntp}" ]]; then
+	echo "Mountpoint ${mntp} does not exist, creating..."
+	mkdir "${mntp}"
+else
+	echo "Mountpoint ${mntp} exists"
+fi
+
+echo "Mounting ${block_dev} to ${mntp}"
+mount --options ro "${block_dev}" "${mntp}"
+
+exit 0

rust/pvebc/95sel-ebc/boot.mount

@@ -1,28 +0,0 @@
-[Unit]
-Description=Mount /boot early in initramfs
-
-# Initramfs requirement
-DefaultDependencies=no
-# Make absolutely sure this only runs in initramfs (and not post-pivot if the
-# unit ever appears there)
-ConditionPathExists=/etc/initrd-release
-ConditionKernelCommandLine=root
-
-# we use /dev/disk/by-label because it identifies the boot partition system
-# independently IF set up correctly
-Requires=dev-disk-by\x2dlabel-boot.device
-
-# Ordering dependencies
-After=dev-disk-by\x2dlabel-boot.device
-Before=sel-ebc-pvebc.service
-
-[Mount]
-# system independent identification of boot partition requires that the label
-# boot is set for the boot partition
-What=/dev/disk/by-label/boot
-Where=/boot
-Type=auto
-Options=defaults
-
-[Install]
-WantedBy=sel-ebc-pvebc.service

rust/pvebc/95sel-ebc/module-setup.sh

@@ -43,8 +43,8 @@ install() {
 		"$systemdsystemunitdir/sel-ebc-paes-enforce.service"
 	inst_simple "$moddir/sel-ebc-override-crypttab.service" \
 		"$systemdsystemunitdir/sel-ebc-override-crypttab.service"
-	inst_simple "$moddir/boot.mount" \
-		"$systemdsystemunitdir/boot.mount"
+	inst_simple "$moddir/sel-ebc-boot-mount.service" \
+		"$systemdsystemunitdir/sel-ebc-boot-mount.service"
 
 	# already exisitng unit we depend on for kernel modules
 	inst_simple /usr/lib/systemd/system/systemd-modules-load.service \
@@ -58,6 +58,10 @@ install() {
 	inst_simple "$moddir/override-crypttab.sh" \
 		"/etc/sel-ebc/override-crypttab.sh"
 
+	# mount boot partition to /boot
+	inst_simple "$moddir/boot-mount.sh" \
+		"/etc/sel-ebc/boot-mount.sh"
+
 	# install kernel module dependencies
 	inst_simple "$moddir/sel-ebc-modules.conf" \
 		"/usr/lib/modules-load.d/sel-ebc-modules.conf"
@@ -76,5 +80,5 @@ install() {
 	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-override-crypttab.service
 	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-paes-enforce.service
 	systemctl --root "$initdir" --no-reload --quiet enable systemd-modules-load.service
-	systemctl --root "$initdir" --no-reload --quiet enable boot.mount
+	systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-boot-mount.service
 }

rust/pvebc/95sel-ebc/override-crypttab.sh

@@ -15,6 +15,11 @@ cp "${IBM_RSRC_DIR}/crypttab" "/etc/crypttab"
 
 systemctl daemon-reload
 
-systemctl restart systemd-cryptsetup@cryptroot_mapper.service
+udevadm trigger --subsystem-match=block --settle
+
+if ! systemctl restart systemd-cryptsetup@cryptroot_mapper.service; then
+        systemctl status systemd-cryptsetup@cryptroot_mapper.service
+        exit 1
+fi
 
 exit 0

rust/pvebc/95sel-ebc/sel-ebc-boot-mount.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Mount a partition identified by label boot to /boot
+
+# Ensure this runs before the handoff to the real root, if that's required:
+Before=sel-ebc-pvebc.service
+
+# Initramfs requirement
+DefaultDependencies=no
+# Make absolutely sure this only runs in initramfs
+ConditionPathExists=/etc/initrd-release
+ConditionKernelCommandLine=rd.sel-ebc
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash /etc/sel-ebc/boot-mount.sh
+RemainAfterExit=yes
+# On failure immediately abort boot
+FailureAction=poweroff-immediate
+
+[Install]
+RequiredBy=sel-ebc-pvebc.service

rust/pvebc/95sel-ebc/sel-ebc-override-crypttab.service

@@ -4,10 +4,8 @@ Description=Override crypttab
 # boot partition contains SICS
 # Loading of kernel modules is required which are needed for protected keys
 Requires=systemd-modules-load.service
-Requires=boot.mount
 
 # Ensure this runs before the handoff to the real root, if that's required:
-After=boot.mount
 After=systemd-modules-load.service
 Before=cryptsetup-pre.target
 Before=cryptsetup.target

rust/pvebc/95sel-ebc/sel-ebc-pvebc.service

@@ -4,14 +4,14 @@ Description=Run pvebc during early boot to process SICS
 # boot partition contains SICS
 # Loading of kernel modules is required which are needed for protected keys
 Requires=systemd-modules-load.service
-Wants=boot.mount
+Requires=sel-ebc-boot-mount.service
 
 # Ensure this runs before the handoff to the real root, if that's required:
 Before=initrd-root-device.target
 Before=cryptsetup-pre.target
 Before=cryptsetup.target
-After=boot.mount
 After=systemd-modules-load.service
+After=sel-ebc-boot-mount.service
 
 # Initramfs requirement
 DefaultDependencies=no