systemd/units/systemd-boot-system-token.service

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Store a System Token in an EFI Variable
Documentation=man:systemd-boot-system-token.service(8)

DefaultDependencies=no
After=local-fs.target systemd-random-seed.service
Conflicts=shutdown.target initrd-switch-root.target
Before=shutdown.target initrd-switch-root.target

# Don't run this in a VM environment, because there EFI variables are not
# actually stored in NVRAM, independent of regular storage.
ConditionVirtualization=no

# Only run this if the boot loader can support random seed initialization.
ConditionPathExists=/sys/firmware/efi/efivars/LoaderFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f

# Only run this if there is no system token defined yet, or …
ConditionPathExists=|!/sys/firmware/efi/efivars/LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f

# … if the boot loader didn't pass the OS a random seed (and thus probably was missing the random seed file)
ConditionPathExists=|!/sys/firmware/efi/efivars/LoaderRandomSeed-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=bootctl random-seed --graceful
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 07:23:58 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
units: automatically initialize the system token if that makes sense 2019-07-19 19:06:00 +03:00			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Store a System Token in an EFI Variable`
			`Documentation=man:systemd-boot-system-token.service(8)`
units: reorder/split unit dependency blocks The block is reordered and split to have: 1. description + documentation 2. (optionally) conditions 3. all the dependencies I think it's easier to read the units this way. Also, the Conflicts+Before is seperated out to separate lines. The ordering dependency is "fake", because it could just as well be After=, we are adding it to force ordering wrt. shutdown.target, and it plays a different role than the other Before=, which are about a real ordering on boot. 2022-09-14 14:39:10 +03:00
units: automatically initialize the system token if that makes sense 2019-07-19 19:06:00 +03:00			`DefaultDependencies=no`
			`After=local-fs.target systemd-random-seed.service`
units: add ordering dependencies on initrd-switch-root.target For shutdown, we queue shutdown.target/start, so in every unit which should be stopped before shutdown, we need both Conflicts and an ordering dependency with shutdown.target (either Before= or After= would work, because stop jobs are always ordered before start jobs). For initrd transition, we queue initrd-switch-root.service/isolate. This automatically creates a /stop job for every running unit without IgnoreOnIsolate. But no ordering dependency is created, unless the unit has a (possibly transitive) ordering dependency on initrd-switch-root.service. Since most units must stop before the transition, we should add the ordering dependency. It is nicer to use Before=initrd-switch-root.target for this. initrd-switch-root.target is ordered before initrd-switch-root.service, so the effect it the same when both are in a transaction. Fixes #23745. To also cover the case where somebody is emergency mode in the initrd and queues initrd-switch-root.service/start (not isolate), also add Conflicts=initrd-switch-root.target, so various units are stopped properly. This extends 2525682565b372b9b83c848bfe89c025fed47a1d to cover all the other services that are touched. It could be consider "operator error", but it's easy to make and it's nicer if we can make this more foolproof. 2022-09-14 14:39:10 +03:00			`Conflicts=shutdown.target initrd-switch-root.target`
			`Before=shutdown.target initrd-switch-root.target`
units: automatically initialize the system token if that makes sense 2019-07-19 19:06:00 +03:00
			`# Don't run this in a VM environment, because there EFI variables are not`
			`# actually stored in NVRAM, independent of regular storage.`
			`ConditionVirtualization=no`

			`# Only run this if the boot loader can support random seed initialization.`
			`ConditionPathExists=/sys/firmware/efi/efivars/LoaderFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f`

			`# Only run this if there is no system token defined yet, or …`
			`ConditionPathExists=\|!/sys/firmware/efi/efivars/LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f`

			`# … if the boot loader didn't pass the OS a random seed (and thus probably was missing the random seed file)`
			`ConditionPathExists=\|!/sys/firmware/efi/efivars/LoaderRandomSeed-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f`

			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
units: drop full paths for utilities in $PATH This makes things a bit simpler and the build a bit faster, because we don't have to rewrite files to do the trivial substitution. @rootbindir@ is always in our internal $PATH that we use for non-absolute paths, so there should be no functional change. 2019-12-18 11:14:57 +03:00			`ExecStart=bootctl random-seed --graceful`