From 8a52693acc2d28a90b92029dd95267c56f79b052 Mon Sep 17 00:00:00 2001 From: Finn Callies Date: Fri, 3 Jul 2026 09:17:41 +0200 Subject: [PATCH] 95sel-ebc: Fix SICS existence check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix the sel-ebc-pvebc.service unit to execute the failure action when the sics directory does not exist instead of getting skipped. Reviewed-by: Holger Dengler Signed-off-by: Finn Callies Signed-off-by: Jan Höppner --- rust/pvebc/95sel-ebc/pvebc-wrapper.sh | 6 ++++++ rust/pvebc/95sel-ebc/sel-ebc-pvebc.service | 1 - 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/rust/pvebc/95sel-ebc/pvebc-wrapper.sh b/rust/pvebc/95sel-ebc/pvebc-wrapper.sh index 107580a2..198a9965 100644 --- a/rust/pvebc/95sel-ebc/pvebc-wrapper.sh +++ b/rust/pvebc/95sel-ebc/pvebc-wrapper.sh @@ -20,6 +20,12 @@ if [[ $(cat $SYSFS) -ne 1 ]]; then fi echo "Running in SEL guest." +# Check SICS existence +if [[ ! -d "${SICS}" ]]; then + echo "${SICS} does not exist" + exit 1 +fi + # Copy EBC resources from /boot/sics to tmpfs for security # This protects against host injection attacks by moving resources to UV-protected RAM echo "Copying EBC resources from $SICS to $EBC_TMPFS" diff --git a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service index 2b214e2d..73bd0448 100644 --- a/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service +++ b/rust/pvebc/95sel-ebc/sel-ebc-pvebc.service @@ -17,7 +17,6 @@ After=sel-ebc-boot-mount.service DefaultDependencies=no # Make absolutely sure this only runs in initramfs ConditionPathExists=/etc/initrd-release -AssertPathIsDirectory=/boot/sics ConditionKernelCommandLine=rd.sel-ebc [Service]