particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

distro/rhel: make edge images properly sysroot.readonly=true

Browse source 
Make edge raw images (both the raw image type and the same in the edge
simplified installer) mount the /sysroot as read-only.  This was already
done in Fedora 37+ (547f7a66b3).

Copied commit message from 6f89e9d499 to a
comment in all places where the accompanying "rw" kernel option is set
explaining the requirement, since the option is counter-intuitive.

Signed-off-by: Antonio Murdaca <runcom@linux.com>
Signed-off-by: Antonio Murdaca <antoniomurdaca@gmail.com>
Co-Authored-By: Achilleas Koutsou <achilleas@koutsou.net>
This commit is contained in:
Antonio Murdaca 2022-10-07 16:07:51 +02:00 • committed by Tomáš Hozza
parent 6bb7de5269
commit 6d15dc144c
6 changed files with 64 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

2
internal/distro/fedora/images.go
View file

@ -365,6 +365,8 @@ func iotRawImage(workload workload.Workload,
img.Users = users.UsersFromBP(customizations.GetUsers())
img.Groups = users.GroupsFromBP(customizations.GetGroups())
// "rw" kernel option is required when /sysroot is mounted read-only to
// keep stateful parts of the filesystem writeable (/var/ and /etc)
img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
img.Keyboard = "us"
img.Locale = "C.UTF-8"

5
internal/distro/rhel8/pipelines.go
View file

@ -953,9 +953,12 @@ func ostreeDeployPipeline(
OSName: osname,
},
))
p.AddStage(osbuild.NewOSTreeConfigStage(ostreeConfigStageOptions(repoPath, false)))
p.AddStage(osbuild.NewOSTreeConfigStage(ostreeConfigStageOptions(repoPath, true)))
p.AddStage(osbuild.NewMkdirStage(efiMkdirStageOptions()))
kernelOpts := osbuild.GenImageKernelOptions(pt)
// "rw" kernel option is required when /sysroot is mounted read-only to
// keep stateful parts of the filesystem writeable (/var/ and /etc)
kernelOpts = append(kernelOpts, "rw")
p.AddStage(osbuild.NewOSTreeDeployStage(
&osbuild.OSTreeDeployStageOptions{
OsName: osname,

10
internal/distro/rhel9/images.go
View file

@ -326,9 +326,12 @@ func edgeRawImage(workload workload.Workload,
img.Users = users.UsersFromBP(customizations.GetUsers())
img.Groups = users.GroupsFromBP(customizations.GetGroups())
img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
// "rw" kernel option is required when /sysroot is mounted read-only to
// keep stateful parts of the filesystem writeable (/var/ and /etc)
img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
img.Keyboard = "us"
img.Locale = "C.UTF-8"
img.SysrootReadOnly = true
img.Platform = t.platform
img.Workload = workload
@ -370,9 +373,12 @@ func edgeSimplifiedInstallerImage(workload workload.Workload,
rawImg.Users = users.UsersFromBP(customizations.GetUsers())
rawImg.Groups = users.GroupsFromBP(customizations.GetGroups())
rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
// "rw" kernel option is required when /sysroot is mounted read-only to
// keep stateful parts of the filesystem writeable (/var/ and /etc)
rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
rawImg.Keyboard = "us"
rawImg.Locale = "C.UTF-8"
rawImg.SysrootReadOnly = true
rawImg.Platform = t.platform
rawImg.Workload = workload