|
 |
f709f2 |
From ec2e4e70a1037b2df535e48ef7389b7b76b5a29a Mon Sep 17 00:00:00 2001
|
|
|
f709f2 |
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
|
|
|
f709f2 |
Date: Thu, 13 Jan 2022 17:35:59 +0100
|
|
|
f709f2 |
Subject: [PATCH] fix(dracut-shutdown): add cleanup handler on failure
|
|
|
f709f2 |
|
|
|
f709f2 |
It may happen that dracut-shutdown.service fails, for example on timeout
|
|
|
f709f2 |
due to very low bandwidth.
|
|
|
f709f2 |
In such case, for hardening purposes, a new dracut-shutdown-onfailure.service
|
|
|
f709f2 |
unit doing dracut-shutdown.service cleanup needs to execute to make sure
|
|
|
f709f2 |
switching root to an incomplete initramfs won't occur later.
|
|
|
f709f2 |
|
|
|
f709f2 |
Resolves: #1924587
|
|
|
f709f2 |
---
|
|
|
f709f2 |
Makefile | 1 +
|
|
|
f709f2 |
dracut.spec | 1 +
|
|
|
f709f2 |
.../98dracut-systemd/dracut-shutdown-onfailure.service | 13 +++++++++++++
|
|
|
f709f2 |
modules.d/98dracut-systemd/dracut-shutdown.service | 1 +
|
|
|
f709f2 |
modules.d/98dracut-systemd/dracut-shutdown.service.8.asc | 3 +++
|
|
|
f709f2 |
5 files changed, 19 insertions(+)
|
|
|
f709f2 |
|
|
|
f709f2 |
diff --git a/Makefile b/Makefile
|
|
|
f709f2 |
index 503d069f..1c0f48ad 100644
|
|
|
f709f2 |
--- a/Makefile
|
|
|
f709f2 |
+++ b/Makefile
|
|
|
f709f2 |
@@ -142,6 +142,7 @@ ifneq ($(enable_documentation),no)
|
|
|
f709f2 |
endif
|
|
|
f709f2 |
if [ -n "$(systemdsystemunitdir)" ]; then \
|
|
|
f709f2 |
mkdir -p $(DESTDIR)$(systemdsystemunitdir); \
|
|
|
f709f2 |
+ ln -srf $(DESTDIR)$(pkglibdir)/modules.d/98dracut-systemd/dracut-shutdown-onfailure.service $(DESTDIR)$(systemdsystemunitdir)/dracut-shutdown-onfailure.service; \
|
|
|
f709f2 |
ln -srf $(DESTDIR)$(pkglibdir)/modules.d/98dracut-systemd/dracut-shutdown.service $(DESTDIR)$(systemdsystemunitdir)/dracut-shutdown.service; \
|
|
|
f709f2 |
mkdir -p $(DESTDIR)$(systemdsystemunitdir)/sysinit.target.wants; \
|
|
|
f709f2 |
ln -s ../dracut-shutdown.service \
|
|
|
f709f2 |
diff --git a/dracut.spec b/dracut.spec
|
|
|
f709f2 |
index e1c22256..90fa903a 100644
|
|
|
f709f2 |
--- a/dracut.spec
|
|
|
f709f2 |
+++ b/dracut.spec
|
|
|
f709f2 |
@@ -404,6 +404,7 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/
|
|
|
f709f2 |
%dir %{_sharedstatedir}/initramfs
|
|
|
f709f2 |
%if %{defined _unitdir}
|
|
|
f709f2 |
%{_unitdir}/dracut-shutdown.service
|
|
|
f709f2 |
+%{_unitdir}/dracut-shutdown-onfailure.service
|
|
|
f709f2 |
%{_unitdir}/sysinit.target.wants/dracut-shutdown.service
|
|
|
f709f2 |
%{_unitdir}/dracut-cmdline.service
|
|
|
f709f2 |
%{_unitdir}/dracut-initqueue.service
|
|
|
f709f2 |
diff --git a/modules.d/98dracut-systemd/dracut-shutdown-onfailure.service b/modules.d/98dracut-systemd/dracut-shutdown-onfailure.service
|
|
|
f709f2 |
new file mode 100644
|
|
|
f709f2 |
index 00000000..96de58c5
|
|
|
f709f2 |
--- /dev/null
|
|
|
f709f2 |
+++ b/modules.d/98dracut-systemd/dracut-shutdown-onfailure.service
|
|
|
f709f2 |
@@ -0,0 +1,13 @@
|
|
|
f709f2 |
+# This file is part of dracut.
|
|
|
f709f2 |
+#
|
|
|
f709f2 |
+# See dracut.bootup(7) for details
|
|
|
f709f2 |
+
|
|
|
f709f2 |
+[Unit]
|
|
|
f709f2 |
+Description=Service executing upon dracut-shutdown failure to perform cleanup
|
|
|
f709f2 |
+Documentation=man:dracut-shutdown.service(8)
|
|
|
f709f2 |
+DefaultDependencies=no
|
|
|
f709f2 |
+
|
|
|
f709f2 |
+[Service]
|
|
|
f709f2 |
+Type=oneshot
|
|
|
f709f2 |
+ExecStart=-/bin/rm /run/initramfs/shutdown
|
|
|
f709f2 |
+StandardError=null
|
|
|
f709f2 |
diff --git a/modules.d/98dracut-systemd/dracut-shutdown.service b/modules.d/98dracut-systemd/dracut-shutdown.service
|
|
|
f709f2 |
index b7324586..dd4cf81e 100644
|
|
|
f709f2 |
--- a/modules.d/98dracut-systemd/dracut-shutdown.service
|
|
|
f709f2 |
+++ b/modules.d/98dracut-systemd/dracut-shutdown.service
|
|
|
f709f2 |
@@ -8,6 +8,7 @@ Documentation=man:dracut-shutdown.service(8)
|
|
|
f709f2 |
After=local-fs.target boot.mount boot.automount
|
|
|
f709f2 |
Wants=local-fs.target
|
|
|
f709f2 |
ConditionPathExists=!/run/initramfs/bin/sh
|
|
|
f709f2 |
+OnFailure=dracut-shutdown-onfailure.service
|
|
|
f709f2 |
|
|
|
f709f2 |
[Service]
|
|
|
f709f2 |
RemainAfterExit=yes
|
|
|
f709f2 |
diff --git a/modules.d/98dracut-systemd/dracut-shutdown.service.8.asc b/modules.d/98dracut-systemd/dracut-shutdown.service.8.asc
|
|
|
f709f2 |
index ba80b187..21ec88ca 100644
|
|
|
f709f2 |
--- a/modules.d/98dracut-systemd/dracut-shutdown.service.8.asc
|
|
|
f709f2 |
+++ b/modules.d/98dracut-systemd/dracut-shutdown.service.8.asc
|
|
|
f709f2 |
@@ -40,6 +40,9 @@ by injecting "rd.break=pre-shutdown rd.shell" or "rd.break=shutdown rd.shell".
|
|
|
f709f2 |
# touch /run/initramfs/.need_shutdown
|
|
|
f709f2 |
----
|
|
|
f709f2 |
|
|
|
f709f2 |
+In case the unpack of the initramfs fails, dracut-shutdown-onfailure.service
|
|
|
f709f2 |
+executes to make sure switch root doesn't happen, since it would result in
|
|
|
f709f2 |
+switching to an incomplete initramfs.
|
|
|
f709f2 |
|
|
|
f709f2 |
AUTHORS
|
|
|
f709f2 |
-------
|
|
|
f709f2 |
|