Colin Walters [Thu, 17 Aug 2023 12:26:29 +0000 (08:26 -0400)]
repo: Bump lock timeout to 5 minutes
And update the doc text to talk about having a timeout at all
by default being a mistake.
Timeouts are really best handled at a higher level; if two processes
are contending for the ostree lock and one is actually frozen,
resolving this is something an admin may want to handle and introspect/debug
instead of having the waiter error out.
Most people using ostree are doing it in a way in which they have
higher level timeouts (e.g. on a container pod).
Colin Walters [Wed, 16 Aug 2023 20:16:24 +0000 (16:16 -0400)]
deploy: Add some error prefixing
We saw a bare
`Txn Rebase on <osname> failed: Failed to find kernel in /usr/lib/modules, /usr/lib/ostree-boot or /boot`
which isn't bad, but it'd be better to be a bit more specific.
Colin Walters [Mon, 14 Aug 2023 18:30:42 +0000 (14:30 -0400)]
prepare-root: Check for empty string, not strlen > 0
No point in doing a full strlen, we can just check the first byte.
Also, invert the conditional using `continue` to avoid another
level of indentation.
Colin Walters [Mon, 14 Aug 2023 13:48:49 +0000 (09:48 -0400)]
README.md: Drop dead mailing list, link to GH discussions
While I resisted taking the next step in binding ourselves
more to GH with discussions...it's way, way better than answering
questions out of band in private (also proprietary) chats.
We haven't been successful in using the GNOME discussion forums.
Read composefs configuration from initrd instead of commandline
This drops the `ot-composefs` kernel commandline in favour
of a `[composefs]` section in the `prepare-rootfs.conf` file.
You can set `composefs.enabled` to `signed`, `yes`, `no` or `maybe`,
with `maybe` being the default.
You can also set `composefs.keypath` (or rely on the default
`/etc/ostree/initramfs-root-binding.key`) to point to ed25519 public
keys, one of which which the commit must be signed with, or boot
fails.
The ostree dracut module adds `/etc/ostree/initramfs-root-binding.key`
to the initrd if it exists.
NOTE: This drop the option to define a digest in the commandline.
However, that was currently unused
(i.e. ComposefsConfig.expected_digest was never read).
Additionally it very hard to actually store the composefs digest in
the initrd, as the initrd is typically part of the commit and thus the
composefs. It may be possible to handle this, but lets add it back
when we know exactly how that will work.
Colin Walters [Fri, 4 Aug 2023 02:49:48 +0000 (22:49 -0400)]
deploy: Fix mutex locking for global sync timeout
The locking here was always too long - by holding the mutex
during the `sync()` call, it means `g_cond_wait_until()` can
never wake up (because its API requires the mutex to be locked).
Confusingly though of course we do still print the "timed out"
message, and I think that tricked us when we were doing testing
here.
We only need to lock the mutex when we're manipulating shared
state, which basically boils down to the `gboolean success`.
Colin Walters [Tue, 1 Aug 2023 12:58:27 +0000 (08:58 -0400)]
os-init: Create a mount namespace
Today on anything using readonly sysroot `os-init` fails, because
we don't create a mount namespace if the `UNLOCKED` flag is specified
because we assume it's a readonly operation.
Since technically this is a mutation, let's just lock the sysroot
and use the tested path.
Colin Walters [Sat, 29 Jul 2023 12:47:47 +0000 (08:47 -0400)]
deploy: Support an empty `/etc` and populated `/usr/etc`
In preparation for support for a transient `/etc`:
https://github.com/ostreedev/ostree/issues/2868
particularly in combination with composefs.
Basically it's just much more elegant if we can directly mount
an overlayfs on the *empty* `etc` directory, using `usr/etc` as
the lower.
In the composefs case, we'd have to mount the composefs overlayfs
itself writable (and call `mkdir`) *just* so we can make that
empty `etc` directory which is ugly.
Colin Walters [Fri, 28 Jul 2023 21:54:37 +0000 (17:54 -0400)]
tests/destructive: Turn off global sync()
Let's verify that things work with that off, as they should.
Previously:
https://github.com/ostreedev/ostree/pull/2519/commits/cb731294837736e957ee595ce11ab115277dbb36
"deploy: Add a 5s max timeout on global filesystem sync()"
But we may still have problems even with that, see
https://issues.redhat.com/browse/OCPBUGS-15917
where it might be that even a thread doesn't work because
we're locked in the kernel.
Coverity warns when we're checking the return value in most-but-not-all
instances. The code is correct in these instances; we're initializing
the values to defaults. So add a `(void)` cast like we are doing
in many other places.
Colin Walters [Sun, 23 Jul 2023 18:39:04 +0000 (14:39 -0400)]
prepare-root: Don't parse target root when composefs enabled
We shouldn't load anything from the target root filesystem *before*
verifying its integrity if composefs is enabled.
In effect, we want to force composefs users to migrate to
`/usr/lib/ostree/prepare-root.conf` which lives in the initramfs.
(But because we enable sysroot.readonly=true if composefs is enabled
too, they don't actually need to)
Colin Walters [Sun, 23 Jul 2023 14:40:20 +0000 (10:40 -0400)]
generator: Stop creating `/run/ostree-booted`
This must have always been dead code. We're trying to iterate
towards a place where it's only `ostree-prepare-root.c` which
parses the `ostree=` kernel argument, and canonically sets up
`/run/ostree-booted`.
Colin Walters [Sat, 22 Jul 2023 19:31:52 +0000 (15:31 -0400)]
composefs: Use lowerdir in /run
I just noticed that this was another constant string duplicated
between prepare-root.c and libostree-1.so, and I went to make
it a common `#define` in libotcore.la.
But then I thought "it's ugly to have this directory mixed into
the deployment namespace" because in some theoretical world
it could also be in the ostree commit, which would cause weird
behavior.
I think this is transient state that is better in `/run`, so move
it there.
Colin Walters [Thu, 20 Jul 2023 13:13:43 +0000 (09:13 -0400)]
Add an always-on `inode64` feature
As I (and others) will be backporting the fix in
https://github.com/ostreedev/ostree/pull/2874/commits/de6fddc6adee09a93901243dc7074090828a1912
pretty far, I want a way for sysadmins and OS builders to
be able to reliably see when their version of ostree has this fix
(Because comparing version numbers isn't portable).
Eric Curtin [Thu, 20 Jul 2023 10:32:30 +0000 (11:32 +0100)]
bootloader: fold all Android Bootloader specific logic into prepare-root
Now that we use androidboot.slot_suffix karg to determine whether we
boot into /ostree/root.a or /ostree/root.b, we can use ostree= karg
simply for parsing the stateroot, although we will still boot into
what's pointed to by /ostree/root.a or /ostree/root.b.
Colin Walters [Wed, 19 Jul 2023 13:13:53 +0000 (09:13 -0400)]
prepare-root: Drop more dead code
Most of this was used for the old composefs signature model. We
now reuse the core signature code and link to glib, so we don't
need reimplementations of hex strings and reading files.
Colin Walters [Mon, 17 Jul 2023 17:48:35 +0000 (13:48 -0400)]
generator: Deduplicate ostree= karg parsing
Avoid having two copies of a regular expression for parsing
the `ostree=` kernel argument. Because the `ostree-system-generator`
binary already has access to the internals because it's implemented
in the shared library, expose the sysroot version internally
and use that.
Motivated by an attempt to change one of these copies but not
the other.
Colin Walters [Tue, 18 Jul 2023 11:54:03 +0000 (07:54 -0400)]
sign-ed25519: Don't set sk unless we've validated it
The semantics of this function now keep the key assigned
even if we fail to validate it, which is ugly. Only assign
the key after verifying its length.
Eric Curtin [Mon, 17 Jul 2023 12:22:49 +0000 (13:22 +0100)]
android-boot: Remove dependency on ostree= karg, use androidboot.slot_suffix=
Given the kernel argument androidboot.slot_suffix= is required in
Android AB updates [1] there is no need to check for ostree= or ostree=aboot
at all in the aboot case. This also ensures if the dependancy on ostree=
is removed, the android-boot technique will work regardless.
Colin Walters [Fri, 14 Jul 2023 23:20:45 +0000 (19:20 -0400)]
commit: Add `--sign-from-file`
Passing the private key via a direct command line argument
is just a bad idea because it's highly likely to get logged
or appear in `ps`.
Spotted in review of work for composefs signatures.
Colin Walters [Thu, 13 Jul 2023 20:37:41 +0000 (16:37 -0400)]
prepare-root: Refactor composefs config handling
- Convert the current enum into a struct, using `OtTristate` and
two member variables (expected signature and digest)
- Factor out a helper function to parse this config
- Clean up the logging by consistently using `composefs:` as a prefix
- Add more assertions to more strictly verify our runtime state
since this is security relevant
projects / ostree.git / log