ostree-sign.ed25519/spki: Fix double free in set_sk()
When the gvariant is G_VARIANT_TYPE_BYTESTRING we need to duplicate
the data we get from g_variant_get_fixed_array(), otherwise we will
double-free it when we later free sign->secret_key.
Support using composefs signatures also with bootc commits
When using bootc, if you convert a signed ostree commit into an OCI
image `rpm-ostree compose container-encapsulate` you end up with a new
commit that isn't signed. However, the base commit object, and its
commitmeta are still in the image and will end up the repo, and
since https://github.com/bootc-dev/bootc/pull/1600 the base commit
id is available as the parent commit.
So, we change ostree-prepare-root to fall back to using the base
commit+commitmeta to find the expected composefs digest if the main
commit is not signed.
Note: This will only work with ostree-only commits. If you have any
layered data, then the content will change, and the composefs digest
in the base commit will not match the deployed one. This is expected
with such sealed commits though. If you want to layer, either disable
sealing, or create a new sealed ostree commit for the new image.
prepare-root: add allow_noent argument to load_variant
This is a minor preparation for a later change. Instead of
hand-rolling the G_FILE_ERROR_NOENT error check we add
a new allow_noent option.
Additionally, we move the handling of a no commitmeta being
an error to the caller of load_commit_for_deploy(), because
this check will be slightly more complex in the future.
Revert "Add ostree-shutdown.service: hide /sysroot and make /etc read-only"
Instead of adding a shutdown service, we rework how we create the mounts.
After the 2 previous commits, sysroot.mount umount works, and
systemd-shutdown will take care of remounting etc.mount read-only and
calling sync() as needed.
The composefs at /run/nextboot uses /sysroot, so systemd fails to
umount sysroot.mount during soft-reboot.
Create a temporary bind-mount, use it to prepare /run/nextboot
and MNT_DETACH it when we are done.
Moving the physical root at /sysroot, we end up
with a mount cycle between / and /sysroot, forcing us to use
MS_DETACH during shutdown (d0c454c23637dceda6d7395dd2141b564e3efa47).
We can replace ostree-shutdown.service by reworking how we mount
/sysroot, in short use MS_BIND instead of MS_MOVE.
Jo Zzsi [Sun, 31 Aug 2025 04:56:10 +0000 (00:56 -0400)]
Move dracut module from 98 ordering to the recommended 50 ordering
In dracut release v108 or later the recommended ordering for out
out of tree modules is 50. The following is a section from dracut
documentation:
> Not using the 50-59 range for out of tree dracut modules will likely
> lead to unintended errors in the initramfs generation process as your
> dracut module will either run too early or too late in the generation process.
> You have been warned.
Colin Walters [Thu, 28 Aug 2025 17:53:14 +0000 (13:53 -0400)]
Add ostree-shutdown.service: hide /sysroot and make /etc read-only
We have a lot of bind mounts; these are usually set up in the initramfs.
So far during shutdown we've let systemd just try to sort things out
via auto-generated mount units i.e. `sysroot.mount` and `etc.mount`
and so on.
systemd has some special casing for `-.mount` (i.e. `/`) and `etc.mount`
https://github.com/systemd/systemd/blob/e91bfad241799b449df73efc30d833b9c5937001/src/shared/fstab-util.c#L72
However it doesn't special case `/sysroot` - which is currently
an ostree-specific invention (when used in the real root).
We cannot actually unmount `/sysroot` while it's in use, and it
is because `/etc` is a bind mount into it. And we can't tear
down `/etc` because it's just expected that e.g. pid 1 and other
things hold open references to it - until things finally
transition into systemd-shutdown.
What we can do though is explicitly detach it during the shutdown
phase; this ensures that systemd won't try to clean it up then,
suppressing errors about its inability to do so.
While we're here, let's also remount `/etc` read-only; while
systemd itself will try to do so during systemd-shutdown.
Per comments if this service fails, it's a bug in something
else to be fixed.
Closes: https://github.com/ostreedev/ostree/issues/3513 Signed-off-by: Colin Walters <walters@verbum.org>
Daniel Hast [Fri, 29 Aug 2025 18:17:15 +0000 (14:17 -0400)]
fix: double free in checkout_tree_at_recurse
Both `xattrs` and `modified_xattrs` are declared with `g_autoptr`, but
`xattrs` is later simply assigned to be equal to `modified_xattrs`,
meaning the automatic cleanup is a double-free.
This is fixed by instead using `g_steal_pointer` to assign the old value
of `xattrs` to a temporary variable, which is used to create the new
value.
I believe this is the cause of issue #3303, and this should fix #3303.
(I can consistently reproduce the issue by attempting to deploy a
rechunked image with bootc, and with this patch, the issue no longer
occurs and the deployment succeeds.)
Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
Colin Walters [Thu, 21 Aug 2025 09:57:03 +0000 (11:57 +0200)]
Deduplicate repo+sysroot syncfs logic
This is a followup to https://github.com/ostreedev/ostree/pull/3504/commits/6e5a27a29d33d50a2a4380c406405435d919b6b4
which I believe is correct as is. However, we already have a file
descriptor open for the ostree repo, which *must* be on
the same filesystem as `/sysroot/ostree` (the deployment
code forces hardlinking today).
It's hence cleaner to reuse that extant fd instead of opening
a new one - we know we did writes to that fd.
But going farther here, there already is logic to use syncfs
for the repo when downloading objects (in a common case
we actually syncfs twice).
Since these are really the same operation, unify them:
- Add journaling to the repo one syncfs case
- Change the sysroot case to just call it
- Since we log consistently to the journal for all syncfs/fsfreeze
operations now, drop the SyncStats bits which was a way
to add info about that to a later journal message
Additionally, let's add an extra check when we're
opening the repo that it's on the same device just on general
principle.
Colin Walters [Wed, 20 Aug 2025 13:51:10 +0000 (15:51 +0200)]
prepare-root: Log to journal, not stdout
Since this can now be used as part of the shared library for
soft reboots, we shouldn't have a library write to stdout.
I noticed this in bootc. Use the journal instead.
In full_system_sync we were calling syncfs(/) expecting
all the recent modification in /ostree to be synced to disk.
With / now being composefs, syncfs(/) is a noop, so call
syncfs(/ostree) as that is what we really want.
The code in get_kernel_from_tree_usrlib_modules() that checks for an
"aboot.cfg" does nothing with it (and in fact may leak the fd in case
its there). In practice, /usr/lib/modules never has an aboot.cfg, so
this is just completely dead code.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
The change in https://github.com/ostreedev/ostree/pull/3413/ was meant
to change when the abootcfg option is set in the BLS file. However,
it also changed the value of this key, using the wrong directory
(bootcsumdir instead of /usr/lib/ostree-boot).
This means that during update, aboot-update gets the wrong path to the
config and cannot correctly write the aboot partition.
Signed-off-by: Alexander Larsson <alexl@redhat.com>
Colin Walters [Tue, 22 Jul 2025 14:52:45 +0000 (10:52 -0400)]
rust: Fix a few warnings
- Unused imports because we weren't actually exporting the structs
from those modules
- glib prelude is empty now?
- mount namespace usage is conditional
Colin Walters [Wed, 16 Jul 2025 15:08:00 +0000 (11:08 -0400)]
Add root.transient-ro
An example use case for this is having privileged code
add dynamic new toplevel mountpoints (that don't persist across
reboots/upgrades), while still keeping the rootfs readonly
for processes by default.
Closes: https://github.com/ostreedev/ostree/issues/3471 Signed-off-by: Colin Walters <walters@verbum.org>
Igor Opaniuk [Wed, 11 Sep 2024 16:03:10 +0000 (18:03 +0200)]
sysroot: Support boot counting for boot entries
Add support for boot counting for bootloader entries [1].
The boot counting data is stored in the name of the boot loader entry.
A boot loader entry file name may contain a plus (+) followed by a number.
This may optionally be followed by a minus (-) followed by a second number.
The dot (.) and file name suffix (conf or efi) must immediately follow.
The feature is enabled via sysroot configuration:
[sysroot]
boot-counting-tries=3
$ ls /boot/loader/entries
ostree-1.conf ostree-2+3.conf
[1] https://uapi-group.org/specifications/specs/boot_loader_specification/#boot-counting Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io> Signed-off-by: Colin Walters <walters@verbum.org>
Colin Walters [Wed, 9 Jul 2025 22:04:08 +0000 (18:04 -0400)]
repo: Add new API to write config with reload+validation
The `ostree config set` CLI should really disallow
writing invalid values. To implement that, add a new
API that also *reloads* to the new config, and
rolls back on failure.
Closes: https://github.com/ostreedev/ostree/issues/1827 Signed-off-by: Colin Walters <walters@verbum.org>
Colin Walters [Tue, 8 Jul 2025 22:26:26 +0000 (18:26 -0400)]
docs: Remove <authorgroup>
We've just been copy pasting this; for some commands it's
true, but others have been written by other people. Most of
the commands just call into the library code which is written
by various people.
Colin Walters [Mon, 30 Jun 2025 21:07:18 +0000 (17:07 -0400)]
soft-reboot: Many changes
- Add --reboot and --reset arguments
- Don't compile on centos stream 9 (missing `open_tree` glibc wrapper)
as the functionality isn't supported by systemd there; that said
we should also do dynamic detection
- Fix /sysroot writability
- If we target as soft reboot a deployment
*other* than the staged one, automatically clear the staged
deployment as otherwise the semantics are too confusing.
- Rename the APIs so they all say `soft_reboot` and not `next_root`
Colin Walters [Tue, 1 Jul 2025 18:38:10 +0000 (14:38 -0400)]
deploy: Don't create deployment object before deploying
Just pass the bits of the new deployment we want down into the
checkout function. This lets us reuse the common helper
to init a deployment which now always captures the device/inode.
Colin Walters [Tue, 1 Jul 2025 14:54:52 +0000 (10:54 -0400)]
sysroot: Cache deployment device/inode
This is a lot cleaner. In particular, it's prep
for having soft reboot finalize at shutdown time, because
we weren't correctly handling the staged deployment in
that case.
To implement this we need to basically stop using
ostree_deployment_new() in most places, and instead ensure that all
callers use this path which cache the device/inode.
Colin Walters [Mon, 30 Jun 2025 20:34:11 +0000 (16:34 -0400)]
deploy: Default quiet for forked systemctl
I'm checking over the codebase for places we fork children; doing
so from a library means we may end up printing to stdout/stderr
of our caller, which we shouldn't do.
- Also add an error prefix with information about the service
if we fail
projects / ostree.git / log