Colin Walters [Mon, 14 Aug 2023 18:30:42 +0000 (14:30 -0400)]
prepare-root: Check for empty string, not strlen > 0
No point in doing a full strlen, we can just check the first byte.
Also, invert the conditional using `continue` to avoid another
level of indentation.
Colin Walters [Mon, 14 Aug 2023 13:48:49 +0000 (09:48 -0400)]
README.md: Drop dead mailing list, link to GH discussions
While I resisted taking the next step in binding ourselves
more to GH with discussions...it's way, way better than answering
questions out of band in private (also proprietary) chats.
We haven't been successful in using the GNOME discussion forums.
Read composefs configuration from initrd instead of commandline
This drops the `ot-composefs` kernel commandline in favour
of a `[composefs]` section in the `prepare-rootfs.conf` file.
You can set `composefs.enabled` to `signed`, `yes`, `no` or `maybe`,
with `maybe` being the default.
You can also set `composefs.keypath` (or rely on the default
`/etc/ostree/initramfs-root-binding.key`) to point to ed25519 public
keys, one of which which the commit must be signed with, or boot
fails.
The ostree dracut module adds `/etc/ostree/initramfs-root-binding.key`
to the initrd if it exists.
NOTE: This drop the option to define a digest in the commandline.
However, that was currently unused
(i.e. ComposefsConfig.expected_digest was never read).
Additionally it very hard to actually store the composefs digest in
the initrd, as the initrd is typically part of the commit and thus the
composefs. It may be possible to handle this, but lets add it back
when we know exactly how that will work.
Colin Walters [Fri, 4 Aug 2023 02:49:48 +0000 (22:49 -0400)]
deploy: Fix mutex locking for global sync timeout
The locking here was always too long - by holding the mutex
during the `sync()` call, it means `g_cond_wait_until()` can
never wake up (because its API requires the mutex to be locked).
Confusingly though of course we do still print the "timed out"
message, and I think that tricked us when we were doing testing
here.
We only need to lock the mutex when we're manipulating shared
state, which basically boils down to the `gboolean success`.
Colin Walters [Tue, 1 Aug 2023 12:58:27 +0000 (08:58 -0400)]
os-init: Create a mount namespace
Today on anything using readonly sysroot `os-init` fails, because
we don't create a mount namespace if the `UNLOCKED` flag is specified
because we assume it's a readonly operation.
Since technically this is a mutation, let's just lock the sysroot
and use the tested path.
Colin Walters [Sat, 29 Jul 2023 12:47:47 +0000 (08:47 -0400)]
deploy: Support an empty `/etc` and populated `/usr/etc`
In preparation for support for a transient `/etc`:
https://github.com/ostreedev/ostree/issues/2868
particularly in combination with composefs.
Basically it's just much more elegant if we can directly mount
an overlayfs on the *empty* `etc` directory, using `usr/etc` as
the lower.
In the composefs case, we'd have to mount the composefs overlayfs
itself writable (and call `mkdir`) *just* so we can make that
empty `etc` directory which is ugly.
Colin Walters [Fri, 28 Jul 2023 21:54:37 +0000 (17:54 -0400)]
tests/destructive: Turn off global sync()
Let's verify that things work with that off, as they should.
Previously:
https://github.com/ostreedev/ostree/pull/2519/commits/cb731294837736e957ee595ce11ab115277dbb36
"deploy: Add a 5s max timeout on global filesystem sync()"
But we may still have problems even with that, see
https://issues.redhat.com/browse/OCPBUGS-15917
where it might be that even a thread doesn't work because
we're locked in the kernel.
Coverity warns when we're checking the return value in most-but-not-all
instances. The code is correct in these instances; we're initializing
the values to defaults. So add a `(void)` cast like we are doing
in many other places.
Colin Walters [Sun, 23 Jul 2023 18:39:04 +0000 (14:39 -0400)]
prepare-root: Don't parse target root when composefs enabled
We shouldn't load anything from the target root filesystem *before*
verifying its integrity if composefs is enabled.
In effect, we want to force composefs users to migrate to
`/usr/lib/ostree/prepare-root.conf` which lives in the initramfs.
(But because we enable sysroot.readonly=true if composefs is enabled
too, they don't actually need to)
Colin Walters [Sun, 23 Jul 2023 14:40:20 +0000 (10:40 -0400)]
generator: Stop creating `/run/ostree-booted`
This must have always been dead code. We're trying to iterate
towards a place where it's only `ostree-prepare-root.c` which
parses the `ostree=` kernel argument, and canonically sets up
`/run/ostree-booted`.
Colin Walters [Sat, 22 Jul 2023 19:31:52 +0000 (15:31 -0400)]
composefs: Use lowerdir in /run
I just noticed that this was another constant string duplicated
between prepare-root.c and libostree-1.so, and I went to make
it a common `#define` in libotcore.la.
But then I thought "it's ugly to have this directory mixed into
the deployment namespace" because in some theoretical world
it could also be in the ostree commit, which would cause weird
behavior.
I think this is transient state that is better in `/run`, so move
it there.
Colin Walters [Thu, 20 Jul 2023 13:13:43 +0000 (09:13 -0400)]
Add an always-on `inode64` feature
As I (and others) will be backporting the fix in
https://github.com/ostreedev/ostree/pull/2874/commits/de6fddc6adee09a93901243dc7074090828a1912
pretty far, I want a way for sysadmins and OS builders to
be able to reliably see when their version of ostree has this fix
(Because comparing version numbers isn't portable).
Eric Curtin [Thu, 20 Jul 2023 10:32:30 +0000 (11:32 +0100)]
bootloader: fold all Android Bootloader specific logic into prepare-root
Now that we use androidboot.slot_suffix karg to determine whether we
boot into /ostree/root.a or /ostree/root.b, we can use ostree= karg
simply for parsing the stateroot, although we will still boot into
what's pointed to by /ostree/root.a or /ostree/root.b.
Colin Walters [Wed, 19 Jul 2023 13:13:53 +0000 (09:13 -0400)]
prepare-root: Drop more dead code
Most of this was used for the old composefs signature model. We
now reuse the core signature code and link to glib, so we don't
need reimplementations of hex strings and reading files.
Colin Walters [Mon, 17 Jul 2023 17:48:35 +0000 (13:48 -0400)]
generator: Deduplicate ostree= karg parsing
Avoid having two copies of a regular expression for parsing
the `ostree=` kernel argument. Because the `ostree-system-generator`
binary already has access to the internals because it's implemented
in the shared library, expose the sysroot version internally
and use that.
Motivated by an attempt to change one of these copies but not
the other.
Colin Walters [Tue, 18 Jul 2023 11:54:03 +0000 (07:54 -0400)]
sign-ed25519: Don't set sk unless we've validated it
The semantics of this function now keep the key assigned
even if we fail to validate it, which is ugly. Only assign
the key after verifying its length.
Eric Curtin [Mon, 17 Jul 2023 12:22:49 +0000 (13:22 +0100)]
android-boot: Remove dependency on ostree= karg, use androidboot.slot_suffix=
Given the kernel argument androidboot.slot_suffix= is required in
Android AB updates [1] there is no need to check for ostree= or ostree=aboot
at all in the aboot case. This also ensures if the dependancy on ostree=
is removed, the android-boot technique will work regardless.
Colin Walters [Fri, 14 Jul 2023 23:20:45 +0000 (19:20 -0400)]
commit: Add `--sign-from-file`
Passing the private key via a direct command line argument
is just a bad idea because it's highly likely to get logged
or appear in `ps`.
Spotted in review of work for composefs signatures.
Colin Walters [Thu, 13 Jul 2023 20:37:41 +0000 (16:37 -0400)]
prepare-root: Refactor composefs config handling
- Convert the current enum into a struct, using `OtTristate` and
two member variables (expected signature and digest)
- Factor out a helper function to parse this config
- Clean up the logging by consistently using `composefs:` as a prefix
- Add more assertions to more strictly verify our runtime state
since this is security relevant
Colin Walters [Thu, 13 Jul 2023 11:47:32 +0000 (07:47 -0400)]
remount: Use new metadata in `/run/ostree-booted` for composefs
Since we now have a generalized more structured way of serializing
state in the initramfs instead of "stamp files", use it for
passing the composefs state.
Colin Walters [Wed, 12 Jul 2023 20:48:56 +0000 (16:48 -0400)]
prepare-root: Add metadata for composefs to `/run/ostree-booted`
Particularly for the signature case, having this metadata
acts as a reliable "proof of execution" of the signature verification
code (as opposed to parsing a log file or so).
Besides that, this is also just a stronger check for "we're using
composefs" instead of checking for "overlayfs on /".
Colin Walters [Tue, 11 Jul 2023 18:09:42 +0000 (14:09 -0400)]
build: Drop `make syntax-check`
As of lately it emits a ton of errors from `grep` about having `*`
at the start of a line, but more generally it's only generally
found papercut-style issues that aren't worth carrying a distinct
checking system for.
ostree-prepare-root: Validate ed25519 signatures when requested
If requested, by specifying ot-composefs=signed=/path/to/pub.key then
the commit object is validated against the specified ed25519 public
key, and if valid, the composefs digest from the commit object is used
to ensure we boot the right digest.
Colin Walters [Fri, 7 Jul 2023 20:31:58 +0000 (16:31 -0400)]
Factor out a libotcore
This will contain logic shared between ostree-prepare-root
and libostree-1.so. It will just link to libgio.so, so as
to avoid pulling in e.g. libcurl and other things.
In other words, `ostree-prepare-root` will not link to `libostree-1.so`,
but will pull in just what it needs from this library.
The checksum utils uses the crypto lib, but we're not explicitly linking
to it. I think this is why the CI got this error when using openssl
on debian, during ostree binary linking:
/usr/bin/ld: ./.libs/libotutil.a(libotutil_la-ot-checksum-utils.o): undefined reference to symbol 'EVP_DigestInit_ex@@OPENSSL_3.0.0'
/usr/bin/ld: /lib/x86_64-linux-gnu/libcrypto.so.3: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
projects / ostree.git / log