Skip to content

Fix zfs sysext by triggering udev when sysext includes udev rules #4377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chewi wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Fix zfs sysext by triggering udev when sysext includes udev rules #4377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
70f3eff
SELinux: Label /usr and sysext image contents
pothos Dec 20, 2023
10e48ae
sys-apps/systemd: Backport EXTENSION_RESTART_UNITS feature from 262
chewi Nov 11, 2026
9ef77a5
build_sysext: Only reload systemd when actually necessary
chewi Nov 11, 2026
0b3e6a7
build_sysext: Trigger udev when sysext includes udev rules
chewi Nov 11, 2026
40a9b99
build_sysext: Trigger tmpfiles.d processing when sysext includes config
chewi Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/portage-stable-packages-list
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,6 +592,7 @@ sec-policy/selinux-base
sec-policy/selinux-base-policy
sec-policy/selinux-container
sec-policy/selinux-dbus
sec-policy/selinux-docker
sec-policy/selinux-policykit
sec-policy/selinux-sssd
sec-policy/selinux-unconfined
Expand Down
23 changes: 14 additions & 9 deletions build_library/build_image_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,6 +518,18 @@ start_image() {
--board="${BOARD}"
}

# Actions common to the dev container and the image
# but which should be run before the image branches off
# the base squashfs (used for systemd-sysext image building)
finish_image_common() {
local root_fs_dir="$1"

# Build the selinux policy
if pkg_use_enabled coreos-base/coreos selinux; then
sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp
fi
}

finish_image() {
local image_name="$1"
local disk_layout="$2"
Expand Down Expand Up @@ -634,11 +646,6 @@ EOF
"${BUILD_DIR}/${image_kconfig}"
fi

# Build the selinux policy
if pkg_use_enabled coreos-base/coreos selinux; then
sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp
fi

# Run tmpfiles once to make sure that /etc has everything in place before
# we freeze it in /usr/share/flatcar/etc as lowerdir in the overlayfs.

Expand Down Expand Up @@ -674,10 +681,8 @@ EOF
# setfiles from version 3.11 requires the passed path to have no symlinks
local real_root_fs_dir
real_root_fs_dir=$(realpath "${root_fs_dir}")
# TODO: Breaks the system:
# sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"
# sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr
# For now we only try it with /etc
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/etc
fi

Expand Down
3 changes: 3 additions & 0 deletions build_library/dev_container_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ create_dev_container() {
# The remount services are provided by coreos-base/coreos-init
systemd_enable "${root_fs_dir}" "multi-user.target" "remount-usr.service"

finish_image_common \
"${root_fs_dir}"

finish_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}"

declare -a files_to_evaluate
Expand Down
3 changes: 3 additions & 0 deletions build_library/prod_image_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,9 @@ create_prod_image() {
ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \
test_image_content "${root_fs_dir}"

finish_image_common \
"${root_fs_dir}"

local root_with_everything="${root_fs_dir}"

# Call helper script for adding sysexts to the base OS.
Expand Down
7 changes: 1 addition & 6 deletions build_library/sysext_mangle_flatcar-zfs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,8 @@ d /etc/zfs 0755 root root -
L /etc/zfs/zed.d - - - - /usr/share/zfs/etc/zfs/zed.d
L /etc/zfs/zfs-functions - - - - /usr/share/zfs/etc/zfs/zfs-functions
L /etc/zfs/zpool.d - - - - /usr/share/zfs/etc/zfs/zpool.d
C /etc/systemd/system/systemd-udevd.service.d/10-zfs.conf - - - - /usr/lib/systemd/system/systemd-udevd.service.d/10-zfs.conf
r /etc/systemd/system/systemd-udevd.service.d/10-zfs.conf - - - - -
EOF
Comment thread
Copilot marked this conversation as resolved.
Resolved

mkdir -p ./usr/lib/systemd/system/systemd-udevd.service.d
cat <<EOF >./usr/lib/systemd/system/systemd-udevd.service.d/10-zfs.conf
[Unit]
After=systemd-sysext.service
EOF
configure_modprobe flatcar-zfs
popd
20 changes: 18 additions & 2 deletions build_sysext
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,7 +244,6 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release

# Unmount in order to get rid of the overlay
umount "${BUILD_DIR}/${FLAGS_install_root_basename}"
umount "${BUILD_DIR}/fs-root"

if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
info " Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXT_ID}_pkginfo.raw'"
Expand Down Expand Up @@ -290,11 +289,19 @@ for entry in "${BUILD_DIR}/${FLAGS_install_root_basename}"/*; do
rm -rf "${entry}"
done

EXTENSION_RELOAD_MANAGER=0
[[ -d ${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/systemd ]] && EXTENSION_RELOAD_MANAGER=1

EXTENSION_RESTART_UNITS=()
[[ -d ${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/tmpfiles.d ]] && EXTENSION_RESTART_UNITS+=( systemd-tmpfiles-setup-again.service )
[[ -d ${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/udev/rules.d ]] && EXTENSION_RESTART_UNITS+=( systemd-udev-trigger.service )

grep . <<EOF | install -m0644 -D /dev/stdin "${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/extension-release.d/extension-release.${SYSEXT_ID}"
ID='flatcar'
${VERSION_FIELD_OVERRIDE:-VERSION_ID}=${FLATCAR_VERSION_ID@Q}
ARCHITECTURE=${ARCH@Q}
EXTENSION_RELOAD_MANAGER=1
EXTENSION_RELOAD_MANAGER=${EXTENSION_RELOAD_MANAGER}
EXTENSION_RESTART_UNITS='${EXTENSION_RESTART_UNITS[*]}'
SYSEXT_ID=${SYSEXT_ID@Q}
${SYSEXT_NAME:+SYSEXT_NAME=${SYSEXT_NAME@Q}}
${PVR:+SYSEXT_VERSION_ID=${PVR@Q}}
Expand All @@ -305,6 +312,15 @@ EOF
info "Removing opaque directory markers to always merge all contents"
find "${BUILD_DIR}/${FLAGS_install_root_basename}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;

if pkg_use_enabled coreos-base/coreos selinux; then
# setfiles from version 3.11 requires the passed path to have no symlinks
real_install_root=$(realpath "${BUILD_DIR}/${FLAGS_install_root_basename}")
real_fs_root=$(realpath "${BUILD_DIR}/fs-root")
sudo setfiles -Dv -r "${real_install_root}" "${real_fs_root}/etc/selinux/mcs/contexts/files/file_contexts" "${real_install_root}/usr"
fi

umount "${BUILD_DIR}/fs-root"

info "Checking for invalid file ownership"
invalid_files=$(find "${BUILD_DIR}/${FLAGS_install_root_basename}" -user sdk -or -group sdk)
if [[ -n "${invalid_files}" ]]; then
Expand Down
0 ...reos-base/coreos/coreos-0.0.1-r321.ebuild → ...reos-base/coreos/coreos-0.0.1-r322.ebuild
View file
Open in desktop
File renamed without changes.
1 change: 1 addition & 0 deletions sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,7 @@ RDEPEND="${RDEPEND}
sec-policy/selinux-base-policy
sec-policy/selinux-container
sec-policy/selinux-dbus
sec-policy/selinux-docker
sec-policy/selinux-policykit
sec-policy/selinux-unconfined
sys-apps/acl
Expand Down
30 changes: 30 additions & 0 deletions sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,36 @@ EOF

[Service]
SystemCallFilter=@mount
EOF
)

(
insinto "$(systemd_get_systemunitdir)/systemd-udev-trigger.service.d"
newins - flatcar.conf <<'EOF'
# Ensure udev rules are reloaded before triggering events with them because
# udevd caches its rules for 3 seconds. System extensions that include udev
# rules need them immediately loaded before triggering.

[Service]
ExecStartPre=-udevadm control --reload
EOF

insinto "$(systemd_get_systemunitdir)"
newins - systemd-tmpfiles-setup-again.service <<'EOF'
# System extensions that include tmpfiles.d configuration can restart this
# service to have it processed when merging.

[Unit]
Description=Create System Files and Directories After Booting
Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=systemd-tmpfiles --create --remove --exclude-prefix=/dev
SuccessExitStatus=DATAERR CANTCREAT
ImportCredential=tmpfiles.*
RestrictSUIDSGID=no
EOF
)
}
Loading
Loading