1
0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Commit Graph

64 Commits

Author SHA1 Message Date
Luca Boccassi
446d737cba mkosi: use inetutils package instead of hostname for Archlinux
In Arch the hostname binary is in a different package

Follow-up for cf48bde7ae
2024-12-11 14:21:06 +00:00
Yu Watanabe
627d1a9ac1
core: Add ProtectHostname=private (#35447)
This PR allows an option for systemd exec units to enable UTS namespaces
but not restrict changing hostname via seccomp. Thus, units can change
hostname without affecting the host. This is useful for OS-like
containers running as units where they should have freedom to change
their container hostname if they want, but not the host's hostname.

Fixes: #30348
2024-12-11 10:17:25 +09:00
Daan De Meyer
ade7d04479 mkosi: Reduce kernel command line size
The kernel command line has a size limit and we've hit it before so
let's move some stuff to configuration files or scripts to reduce the
kernel command line size a bit.
2024-12-08 12:55:43 +01:00
Ryan Wilson
cf48bde7ae core: Add ProtectHostname=private
This allows an option for systemd exec units to enable UTS namespaces
but not restrict changing hostname via seccomp. Thus, units can change
hostname without affecting the host.

Fixes: #30348
2024-12-06 13:34:04 -08:00
Daan De Meyer
c45174f05d ci: Implement coverage on top of mkosi 2024-12-05 00:21:57 +01:00
Daan De Meyer
aed18d7e9a mkosi: Simplify sanitizer setup
Let's get rid of 20-sanitizers.conf and just move it into
mkosi.sanitizers instead.
2024-11-29 00:40:36 +00:00
Daan De Meyer
bb486fe9df mkosi: Use shared extra tree between initrd and main image
Let's share more between initrd and main system and use a shared
extra tree to achieve that.
2024-11-25 15:09:58 +09:00
Daan De Meyer
977fc93603 Rework TEST-86-MULTI-PROFILE-UKI
Now that mkosi supports generating UKI profiles, let's make use of
that to generate the UKI profiles required for the test instead of
doing it within the test itself.
2024-10-21 17:24:14 +02:00
Daan De Meyer
963157ca78 mkosi: Fix sections for settings
Upstream we moved settings around a bit to different sections, let's
adapt to those changes in the systemd repo.
2024-10-09 20:36:57 +02:00
Daan De Meyer
7d9464ceac mkosi: Update to latest 2024-10-09 20:36:57 +02:00
Daan De Meyer
d98b6c66ff mkosi: Stop installing bpftrace
bpftrace nudges the Fedora Rawhide images towards compiler-rt18 while the
sanitizer builds pull in clang19, leading to the sanitizer libraries
not being found at runtime. Let's drop bpftrace for now so that compiler-rt19
is pulled in in the main image.
2024-10-02 11:29:34 +02:00
Daan De Meyer
345a4fcbb6 mkosi: Pass ASAN_OPTIONS to subimages
systemd built with sanitizers is installed in subimages and tools
might get invoked in postinstall scripts so we have to disable ASAN
in the subimages as well during the image build.
2024-10-02 11:29:34 +02:00
Zbigniew Jędrzejewski-Szmek
3a157e7cb4 mkosi: bump mkosi MinimumVersion
dbff64ddf0 bumped the hash to
a commit after 24.3, so let's tell the users that 25~devel is
the minimum required.
2024-09-20 16:45:44 +02:00
Daan De Meyer
c022fcd80c mkosi: Install llvm
For llvm-symbolizer which is required to sanitize address sanitizer
reports.
2024-08-14 14:18:40 +02:00
Daan De Meyer
edc6592e53 mkosi: Switch back to btrfs
The next commit will introduce a way to iterate on integration
tests which depends on btrfs specific features.

We leave CentOS on ext4 as its kernel does not support btrfs.
2024-08-05 15:00:24 +02:00
Daan De Meyer
b3db96f230 mkosi: Switch to autologin via credentials
Let's use the newly added credentials to only enable autologin for
/dev/console (systemd-nspawn) and /dev/hvc0 (qemu) instead of enabling
autologin for every tty.
2024-07-31 17:38:12 +02:00
Daan De Meyer
fffbfb4ed1 mkosi: Bump device timeout even more
I still manage to hit it in some cases so let's bump again.
2024-07-23 15:49:37 +01:00
Daan De Meyer
70510bf282 mkosi: Bump default device timeout a little
We've been getting some integration test failures due to timeouts
on finding the root partition device. Let's bump the default device
timeout a little to see if it mitigates these failures.
2024-07-19 14:20:39 +02:00
Daan De Meyer
1d914b268c mkosi: Drop udev from Packages= list
It's pulled in via VolatilePackages=, no need to put it in Packages=.
2024-07-18 12:48:48 +02:00
Daan De Meyer
1250dc6a1d mkosi: Fix formatting
All of our lists start on the next line, so let's make KernelCommandLine=
fit that as well.
2024-07-18 12:47:51 +02:00
Daan De Meyer
f5c44df929 mkosi: Remove enforcing=0 from default kernel command line
We already have selinux=0 in the default kernel command line so
enforcing=0 is redundant. Instead, pass in enforcing=0 when we
enable selinux in TEST-06-SELINUX.
2024-07-17 18:56:02 +02:00
Daan De Meyer
5319be5f0c mkosi: Stop setting apparmor=0
It doesn't get pulled in as a dependency anyway and kernel command
line space is precious so let's remove apparmor=0 as it's a noop
anyway.
2024-07-17 18:55:24 +02:00
Daan De Meyer
68ee977114 mkosi: Build initrd as a subimage
Let's make things a little more consistent and build the initrd
explicitly as a subimage as well instead of relying on mkosi building
it as part of the main image build.

We drop the opensuse initrd postinst script as we don't use erofs by
default anymore. We can always reintroduce it again later if needed.
2024-07-16 13:59:47 +02:00
Daan De Meyer
a1071c1249 mkosi: Install binutils 2024-07-15 16:17:33 +02:00
Daan De Meyer
0e4a7ab6d5 mkosi: Make epel repositories optional for CentOS Stream 9
This allows us to add CI for CentOS Stream 10 as EPEL 10 doesn't
exist yet and won't exist for quite some time.

CentOS Stream 10 will be enabled later as soon as
https://issues.redhat.com/browse/RHEL-46604 is resolved.
2024-07-15 16:17:33 +02:00
Daan De Meyer
7205fc7dc3 mkosi: Introduce build image
We want the exitrd image to be built with the latest systemd as well.
As the exitrd image is built as part of mkosi.images, and all subimages
are built before the main image, this implies the packages must be built
as a subimage in mkosi.images/ as well. So we introduce the build image and
move all logic related to building distribution packages there.

This also has the nice side effect of slimming down the main image as the
build dependencies are not installed into the main image anymore. It also
makes sure the packages are built in a "clean" chroot without any of the
other packages which we install in the main image available.
2024-07-15 16:17:33 +02:00
Daan De Meyer
14fb6354f1
Merge pull request #33636 from DaanDeMeyer/ext4
Various integration test improvements
2024-07-10 21:33:23 +02:00
Daan De Meyer
dedd712dd9 TEST-06-SELINUX: Various fixes
- Stop installing the policy in the initramfs as it's not really
supported anyway (https://github.com/fedora-selinux/selinux-policy/issues/2221)
- Stop relabeling on first boot and prefer to do it at image build time
- Disable mkosi relabeling by default but enable it in CI
- Build image as root in CI so the SELinux relabeling works properly
2024-07-10 18:52:29 +02:00
Daan De Meyer
ece66c01cf mkosi: Install erofs-utils 2024-07-10 10:05:59 +02:00
Daan De Meyer
20345a86b7 mkosi: Adapt configuration to take into account configuration rework
In https://github.com/systemd/mkosi/pull/2847, the '@' specifier is
removed, CLI arguments take priority over configuration files again
and the "main" image is defined at the top level instead of in
mkosi.images/. Additionally, not every setting from the top level
configuration is inherited by the images in mkosi.images/ anymore,
only settings which make sense to be inherited are inherited.

This commit gets rid of all the usages of '@', moves the "main" image
configuration from mkosi.images/system to the top level and gets rid
of various hacks we had in place to deal with quirks of the old
configuration parsing logic.

We also remove usages of Images= and --append as these options are
removed by the mentioned PR.
2024-07-09 08:07:09 +02:00
Daan De Meyer
d5474f78b8 ci: Switch to Ubuntu 24.04 2024-06-08 12:33:32 +02:00
Daan De Meyer
0731321d14 mkosi: Include fewer modules in the initramfs
Let's only use mkosi's default list of modules instead of all of
them.
2024-06-06 16:44:00 +02:00
Daan De Meyer
a743cacd7b mkosi: Disable scratch device by default
We include scratch space in the rootfs image itself so we don't have
need for the scratch device so let's disable it by default.
2024-06-05 18:59:41 +02:00
Daan De Meyer
8919f86f57 mkosi: Sanitizer improvements
- Let's set the environment on the kernel command line so it applies
to initrd and main system.
- Let's add the necessary wrappers that are also added in test-functions.
Unlike test-functions we don't use gcc/clang to get the library path as
that requires installing gcc/clang in the initrd.
- Let's drop the hack to get journald writing to the console and have
it write to kmsg instead. We'll get the output either way.
- Stop removing libstdc++ and sanitizer libraries from Arch Linux
initrds and other images as it's required by the sanitizer libraries.
- Add a workaround for specifying extra meson options for opensuse
- Add a leak sanitizer suppression file as a workaround for a false
positive leak in verify_selinuxmnt() in libselinux. We do a soname match
because the stacktrace can't be properly symbolized on Debian.
2024-05-31 17:26:13 +02:00
Daan De Meyer
5d2a40ab11 mkosi: Add note about kernel command line limit 2024-05-31 17:26:01 +02:00
Daan De Meyer
c95f8dd784 mkosi: Drop kernel command line to enable log context
The log context is already enabled by virtue of the log level being
set to debug, so no need to enable it explicitly.
2024-05-31 13:48:14 +02:00
Daan De Meyer
3a8e9b4a0e mkosi: Unify device timeout for CI and local runs
Now that we use KVM and don't use repart anymore to create a root
partition on first boot, let's see if we can use the same device timeout
for both local and CI runs.
2024-05-31 10:25:08 +02:00
Daan De Meyer
074ac66e88 Revert "mkosi: Sanitizer improvements"
This reverts commit aef13ad029.
2024-05-30 14:50:21 +02:00
Daan De Meyer
aef13ad029 mkosi: Sanitizer improvements
- Let's set the environment on the kernel command line so it applies
to initrd and main system.
- Let's add the necessary wrappers that are also added in test-functions.
Unlike test-functions we don't use gcc/clang to get the library path as
that requires installing gcc/clang in the initrd.
- Let's drop the hack to get journald writing to the console and have
it write to kmsg instead. We'll get the output either way.
- Stop removing libstdc++ and sanitizer libraries from Arch Linux
initrds and other images as it's required by the sanitizer libraries.
- Add a workaround for specifying extra meson options for opensuse
- Add a leak sanitizer suppression file as a workaround for a false
positive leak in verify_selinuxmnt() in libselinux. We do a soname match
because the stacktrace can't be properly symbolized on Debian.
2024-05-30 12:47:45 +02:00
Daan De Meyer
3c367df7c6 mkosi: Switch from btrfs to ext4
Mounting multiple btrfs filesystems with the same fsid only works
properly from kernel 6.7 onwards. Let's switch to ext4 for now which
does support this.
2024-05-29 14:10:50 +02:00
Daan De Meyer
8e8a1b832d mkosi: Mask mdmonitor and isc-dhcp-server services
They always fail and do not ship with proper units so we can't
disable them with presets so we mask them instead.
2024-05-14 12:43:28 +02:00
Daan De Meyer
ff45d26de0 mkosi: Make sure the kernel fails loudly on oops/panic/softlockup
Helps with noticing kernel related failures.
2024-05-09 09:57:40 +02:00
Daan De Meyer
f1d2dc187f mkosi: Add raid=noautodetect to kernel command line
Should speed up boot times a little.
2024-05-09 09:57:04 +02:00
Daan De Meyer
1c329956e5 mkosi: Insist on KVM, VSOCK and TPM by default
By default mkosi will not run VMs with these features if they're not
available, but since various stuff in systemd makes use of these, let's
fail loudly if any of these are not available by default in systemd.

Users can still override these defaults locally if they wish.
2024-05-06 10:56:45 +02:00
Daan De Meyer
c89244842b test: Don't persist journal in mkosi image if we're not debugging tests
If we're not debugging tests, there's no point in persisting the journal,
so let's use the volatile journal storage mode in that case to avoid doing
unnecessary work.

We don't disable journal storage alltogether since various tests check
that stuff is written to the journal.
2024-04-30 15:20:55 +02:00
Daan De Meyer
e7c8507977 mkosi: Introduce particle profile
Unfortunately the current mkosi partitioning setup is a bit too
avant-garde for the integration tests. Both in that distributions
aren't ready for it yet (some more than others), and that software
which we depend on in the integration tests isn't ready for it yet
(e.g. libselinux does not read its configuration from /usr).

Let's switch back to a more boring partioning setup by default but
keep the fancy stuff around as a mkosi profile. This means that it
can still be used for manually testing stuff by running
"mkosi --profile particle -f qemu".
2024-04-30 10:46:18 +02:00
Daan De Meyer
b85e54961c test: Various mkosi integration test improvements
- Stop using logging module since the default output formatting is
  pretty bad. Prefer print() for now.
- Log less, logging the full mkosi command line is rather verbose,
  especially when it contains multi-line dropins.
- Streamline the journalctl command we output for debugging failed
  tests.
- Don't force usage of the disk image format.
- Don't force running without unit tests.
- Don't force disabling RuntimeBuildSources.
- Update documentation to streamline the command for running a single
  test and remove sudo as it's not required anymore.
- Improve the console output by having the test unit's output logged
  to both the journal and the console.
- Disable journal console log forwarding as we have journal forwarding
  as a better alternative.
- Delete existing journal file before running test.
- Delete journal files of succeeded tests to reduce disk usage.
- Rename system_mkosi target to just mkosi
- Pass in mkosi source directory explicitly to accomodate arbitrary
  build directory locations.
- Add test interactive debugging if stdout is connected to a tty
- Stop explicitly using the 'system' image since it'll likely be
  dropped soon.
- Only forward journal if we're not running in debugging mode.
- Stop using testsuite.target and instead just add the necessary
  extras to the main testsuite unit via the credential dropin.
- Override type to idle so test output is not interleaved with
  status output.
- Don't build mkosi target by default
- Always add the mkosi target if mkosi is found
- Remove dependency of the integration tests on the mkosi target
  as otherwise the image is always built, even though we configure
  it to not be built by default.
- Move mkosi output, cache and build directory into build/ so that
  invocations from meson and regular invocations share the same
  directories.
- Various aesthetic cleanups.
2024-04-23 10:32:42 +02:00
Daan De Meyer
792eb0f440 mkosi: Build command line into the image
This allows using systemd-vmspawn itself while still getting a decent
experience.
2024-04-19 15:05:19 +02:00
Richard Maw
945b722f13 test: Add mkosi-based integration test runner
The first two tests are included to ensure parallel test execution is
demonstrable.
2024-04-18 16:26:38 +01:00
Richard Maw
20c7c570b9 mkosi: Extend default device timeout to 20 seconds
A moderately heavily loaded system booting an image without a rootfs
may timeout before the root device appears.
20 seconds is enough for a VM with 2 CPUs and 2GB RAM.
2024-04-18 16:26:38 +01:00