(RHEL-16952) UKI addons - followups #246
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This doesn't really fix anything, but in general we should put stronger emphasis on operating via dir fds rather than paths more (in particular when writing files as opposed to consuming them). No real change in behaviour. (cherry picked from commit 6b97b26) Related: RHEL-16952
…lace Let's do a careful, focussed sync at the right places instead of a blanket sync at the end. After all we want to run this on every boot soon. (cherry picked from commit 60315d5) Related: RHEL-16952
We use this pattern all the time in order to thward extension attacks, add a helper to make it shorter. (cherry picked from commit a16c65f) Related: RHEL-16952
The ESP is simply not mounted early enough for this. We want that the regular random seed handling runs as early as we possibly could, but we don't want to delay this until the ESP is actually mounted. Hence, let's remove this from random-seed.c here. A follow-up commit will then add this back in, in a separate service which just calls "bootctl random-seed". Effectively reverts: f913c78 Fixes: #25769 (cherry picked from commit 29d487a) Related: RHEL-16952
(cherry picked from commit 5019b0c) Related: RHEL-16952
…-random-seed.service This renames systemd-boot-system-token.service to systemd-boot-random-seed.service and conditions it less strictly. Previously, the job of the service was to write a "system token" EFI variable if it was missing. It called "bootctl --graceful random-seed" for that. With this change we condition it more liberally: instead of calling it only when the "system token" EFI variable isn't set, we call it whenever a boot loader interface compatible boot loader is used. This means, previously it was invoked on the first boot only: now it is invoked at every boot. This doesn#t change the command that is invoked. That's because previously already the "bootctl --graceful random-seed" did two things: set the system token if not set yet *and* refresh the random seed in the ESP. Previousy we put the focus on the former, now we shift the focus to the latter. With this simple change we can replace the logic f913c78 added, but from a service that can run much later and doesn't keep the ESP pinned. (cherry picked from commit 921fc45) Related: RHEL-16952
Let's break a huge function in two. No code change, just some refactoring. (cherry picked from commit 54978e3) Related: RHEL-16952
github-actions
bot
added
pr/needs-ci
Commit validationTracker - RHEL-16952 The following commits meet all requirements
Tracker validationSuccess🟢 Tracker RHEL-16952 has set desired product: Pull Request validationSuccess🟡 CI - Waived Auto MergeSuccess🟢 Pull Request is not marked as draft and it's not blocked by |
|
@mrc0mmand Any ideas why CI is failing? Thank you Maybe timeout is too short? |
That's actions/runner-images#9491, feel free to ignore it here. |
github-actions
bot
merged commit 6fb21c2
into
redhat-plumbers:main
27 of 29 checks passed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This set of changes reworks how we handle random-seed on ESP and hence should address following SELinux AVC.