Skip to content

Commit 7d6d4a7

Browse files
Conan-KudoConan-Kudo
authored
Merge pull request #2800 from OSInside/support_erofs_overlaydisk
Support erofs overlaydisk
2 parents 9e7d54b + 69dafcd commit 7d6d4a7

File tree

23 files changed

+487
-191
lines changed

23 files changed

+487
-191
lines changed

‎build-tests/x86/tumbleweed/test-image-overlayroot/appliance.kiwi‎

Lines changed: 75 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
<?xml version="1.0" encoding="utf-8"?>
2-
2+
<!-- OBS-Profiles: @BUILD_FLAVOR@ -->
33
<image schemaversion="7.5" name="kiwi-test-image-overlayroot">
44
<description type="system">
55
<author>Marcus Schäfer</author>
6-
<contact>ms@suse.com</contact>
6+
<contact>marcus.schaefer@suse.com</contact>
77
<specification>Overlayroot Disk test build</specification>
88
</description>
9+
<profiles>
10+
<profile name="sdboot_erofs" description="systemd boot overlay disk using erofs"/>
11+
<profile name="sdboot_verity_erofs" description="systemd boot verity baked overlay disk using erofs"/>
12+
<profile name="grub_verity_erofs" description="grub verity baked overlay disk using erofs"/>
13+
</profiles>
914
<preferences>
1015
<version>1.42.1</version>
1116
<packagemanager>zypper</packagemanager>
@@ -14,9 +19,66 @@
1419
<timezone>Europe/Berlin</timezone>
1520
<rpm-excludedocs>true</rpm-excludedocs>
1621
<rpm-check-signatures>false</rpm-check-signatures>
17-
<bootsplash-theme>breeze</bootsplash-theme>
18-
<bootloader-theme>openSUSE</bootloader-theme>
19-
<type image="oem" filesystem="ext3" kernelcmdline="console=ttyS0" firmware="efi" format="vmdk" overlayroot="true">
22+
</preferences>
23+
<preferences profiles="sdboot_erofs">
24+
<type
25+
image="oem"
26+
filesystem="xfs"
27+
kernelcmdline="console=ttyS0"
28+
firmware="uefi"
29+
format="vmdk"
30+
overlayroot="true"
31+
overlayroot_readonly_filesystem="erofs"
32+
overlayroot_readonly_partsize="915"
33+
erofscompression="zstd,level=9"
34+
eficsm="false"
35+
bootpartition="false"
36+
efipartsize="200"
37+
>
38+
<oemconfig>
39+
<oem-resize>false</oem-resize>
40+
</oemconfig>
41+
<bootloader name="systemd_boot" timeout="10"/>
42+
<size unit="G">4</size>
43+
</type>
44+
</preferences>
45+
<preferences profiles="sdboot_verity_erofs">
46+
<type
47+
image="oem"
48+
filesystem="xfs"
49+
kernelcmdline="console=ttyS0 rd.systemd.verity=1"
50+
firmware="uefi"
51+
format="vmdk"
52+
overlayroot="true"
53+
overlayroot_readonly_filesystem="erofs"
54+
overlayroot_readonly_partsize="915"
55+
erofscompression="zstd,level=9"
56+
eficsm="false"
57+
verity_blocks="all"
58+
bootpartition="false"
59+
efipartsize="200"
60+
>
61+
<oemconfig>
62+
<oem-resize>false</oem-resize>
63+
</oemconfig>
64+
<bootloader name="systemd_boot" timeout="10"/>
65+
<size unit="G">4</size>
66+
</type>
67+
</preferences>
68+
<preferences profiles="grub_verity_erofs">
69+
<type
70+
image="oem"
71+
filesystem="btrfs"
72+
kernelcmdline="console=ttyS0 rd.systemd.verity=1"
73+
firmware="efi"
74+
format="vmdk"
75+
overlayroot="true"
76+
overlayroot_readonly_filesystem="erofs"
77+
overlayroot_readonly_partsize="915"
78+
erofscompression="zstd,level=9"
79+
eficsm="false"
80+
verity_blocks="all"
81+
>
2082
<oemconfig>
2183
<oem-resize>false</oem-resize>
2284
</oemconfig>
@@ -30,19 +92,23 @@
3092
<repository type="rpm-md">
3193
<source path="obsrepositories:/"/>
3294
</repository>
95+
<packages type="image" profiles="sdboot_verity_erofs,grub_verity_erofs">
96+
<package name="cryptsetup"/>
97+
<package name="dracut-kiwi-verity"/>
98+
</packages>
3399
<packages type="image">
34100
<package name="patterns-base-minimal_base"/>
101+
<package name="systemd-boot"/>
102+
<package name="grub2"/>
103+
<package name="grub2-x86_64-efi" arch="x86_64"/>
104+
<package name="shim"/>
35105
<package name="procps"/>
36106
<package name="bind-utils"/>
37107
<package name="systemd"/>
38108
<package name="plymouth-theme-breeze"/>
39109
<package name="plymouth-plugin-script"/>
40-
<package name="grub2-branding-openSUSE"/>
41110
<package name="iputils"/>
42111
<package name="vim"/>
43-
<package name="grub2"/>
44-
<package name="grub2-x86_64-efi" arch="x86_64"/>
45-
<package name="grub2-i386-pc"/>
46112
<package name="lvm2"/>
47113
<package name="plymouth"/>
48114
<package name="fontconfig"/>

‎build-tests/x86/tumbleweed/test-image-overlayroot/config.sh‎

Lines changed: 36 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,52 @@
11
#!/bin/bash
2-
#================
3-
# FILE : config.sh
4-
#----------------
5-
# PROJECT : OpenSuSE KIWI Image System
6-
# COPYRIGHT : (c) 2006 SUSE LINUX Products GmbH. All rights reserved
7-
# :
8-
# AUTHOR : Marcus Schaefer <[email protected]>
9-
# :
10-
# BELONGS TO : Operating System images
11-
# :
12-
# DESCRIPTION : configuration script for SUSE based
13-
# : operating systems
14-
# :
15-
# :
16-
# STATUS : BETA
17-
#----------------
18-
#======================================
19-
# Functions...
20-
#--------------------------------------
21-
test -f /.kconfig && . /.kconfig
22-
test -f /.profile && . /.profile
2+
set -ex
3+
4+
declare kiwi_iname=${kiwi_iname}
5+
declare kiwi_profiles=${kiwi_profiles}
236

247
#======================================
258
# Greeting...
269
#--------------------------------------
2710
echo "Configure image: [$kiwi_iname]..."
2811

29-
#======================================
30-
# Setup baseproduct link
31-
#--------------------------------------
32-
suseSetupProduct
33-
3412
#======================================
3513
# Activate services
3614
#--------------------------------------
37-
suseInsertService sshd
15+
systemctl enable sshd
3816

3917
#======================================
40-
# Setup default target, multi-user
18+
# kernel links
4119
#--------------------------------------
42-
baseSetRunlevel 3
43-
44-
# For image tests with an extra boot partition the
45-
# kernel must not be a symlink to another area of
46-
# the filesystem. Latest changes on SUSE changed the
47-
# layout of the kernel which breaks every image with
48-
# an extra boot partition
49-
#
50-
# All of the following is more than a hack and I
51-
# don't like it all
52-
#
53-
# Complains and discussions about this please with
54-
# the SUSE kernel team as we in kiwi can just live
55-
# with the consequences of this change
56-
#
57-
pushd /
20+
for profile in ${kiwi_profiles//,/ }; do
21+
if [ "${profile}" = "grub_verity_erofs" ]; then
22+
# For image tests with an extra boot partition the
23+
# kernel must not be a symlink to another area of
24+
# the filesystem. Latest changes on SUSE changed the
25+
# layout of the kernel which breaks every image with
26+
# an extra boot partition
27+
#
28+
# All of the following is more than a hack and I
29+
# don't like it all
30+
#
31+
# Complains and discussions about this please with
32+
# the SUSE kernel team as we in kiwi can just live
33+
# with the consequences of this change
34+
#
35+
pushd /
5836

59-
for file in /boot/* /boot/.*; do
60-
if [ -L ${file} ];then
61-
link_target=$(readlink ${file})
62-
if [[ ${link_target} =~ usr/lib/modules ]];then
63-
mv ${link_target} ${file}
64-
fi
37+
for file in /boot/* /boot/.*; do
38+
if [ -L ${file} ];then
39+
link_target=$(readlink ${file})
40+
if [[ ${link_target} =~ usr/lib/modules ]];then
41+
mv ${link_target} ${file}
42+
fi
43+
fi
44+
done
6545
fi
6646
done
47+
48+
#======================================
49+
# Include erofs module
50+
#--------------------------------------
51+
# remove from blacklist
52+
rm -f /usr/lib/modprobe.d/60-blacklist_fs-erofs.conf

‎doc/source/image_description/elements.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,11 @@ overlayroot="true|false":
825825
the squashfs root filesystem. In fact this mode is the same
826826
as not installing the `kiwi-overlay` dracut module.
827827

828+
overlayroot_readonly_filesystem="squashfs|erofs":
829+
For the `oem` type only, specifies the filesystem type to use
830+
as read-only filesystem in an `overlayroot` setup. By default
831+
`squashfs` is used
832+
828833
overlayroot_write_partition="true|false":
829834
For the `oem` type only, allows to specify if the extra read-write
830835
partition in an `overlayroot` setup should be created or not.

‎dracut/modules.d/80kiwi-verity/Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ all: build
1111

1212
.PHONY: install
1313
install: build
14-
install -Dm0755 kiwi-verity-setup.sh module-setup.sh \
14+
install -Dm0755 \
15+
kiwi-verity-setup.sh kiwi-veritytab-setup.sh module-setup.sh \
1516
-t ${buildroot}usr/lib/dracut/modules.d/80kiwi-verity
1617
install -Dm0755 $(BINARY) ${buildroot}usr/bin/$(BINARY)
1718

‎dracut/modules.d/80kiwi-verity/kiwi-veritytab-setup.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/sh
2+
# This file is part of kiwi.
3+
#
4+
# kiwi is free software: you can redistribute it and/or modify
5+
# it under the terms of the GNU General Public License as published by
6+
# the Free Software Foundation, either version 3 of the License, or
7+
# (at your option) any later version.
8+
#
9+
# kiwi is distributed in the hope that it will be useful,
10+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
# GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License
15+
# along with kiwi. If not, see <http://www.gnu.org/licenses/>
16+
#
17+
# shellcheck disable=SC1091
18+
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
19+
20+
if [ ! -e "/etc/veritytab" ];then
21+
return
22+
fi
23+
24+
read -r name data_device hash_device root_hash options < /etc/veritytab
25+
26+
if [ "$(echo "${data_device}" | cut -f1 -d=)" = "UUID" ];then
27+
data_device=/dev/disk/by-uuid/$(echo "${data_device}" | cut -f2 -d=)
28+
fi
29+
if [ "$(echo "${hash_device}" | cut -f1 -d=)" = "UUID" ];then
30+
hash_device=/dev/disk/by-uuid/$(echo "${hash_device}" | cut -f2 -d=)
31+
fi
32+
33+
veritysetup="veritysetup open "
34+
veritysetup="${veritysetup} ${data_device} ${name} ${hash_device} ${root_hash}"
35+
36+
for option in $(echo "${options}" | tr , " ");do
37+
veritysetup="${veritysetup} --${option}"
38+
done
39+
40+
eval "${veritysetup}"

‎dracut/modules.d/80kiwi-verity/module-setup.sh‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ depends() {
3030
}
3131

3232
install() {
33-
inst_multiple /usr/bin/kiwi-parse-verity /usr/sbin/veritysetup
33+
inst_multiple \
34+
/usr/bin/kiwi-parse-verity \
35+
/usr/sbin/veritysetup \
36+
cut \
37+
tr
3438
inst_hook initqueue/settled 70 "$moddir/kiwi-verity-setup.sh"
39+
inst_hook initqueue/settled 71 "$moddir/kiwi-veritytab-setup.sh"
3540
}

‎kiwi.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,6 @@
101101
# # verify that the URL for imageinclude repos is accessable
102102
# - check_image_include_repos_publicly_resolvable
103103

104-
# # verify secure boot setup disabled for overlay configured disk images
105-
# - check_efi_mode_for_disk_overlay_correctly_setup
106-
107104
# # verify for legacy kiwi boot images that they exist on the host
108105
# - check_boot_description_exists
109106

‎kiwi/bootloader/config/base.py‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ def __init__(self, xml_state, root_dir, boot_dir=None, custom_args={}):
6060
self.proc_mount = None
6161
self.sys_mount = None
6262
self.tmp_mount = None
63+
self.etc_kernel_mount = None
6364

6465
self.root_filesystem_is_overlay = xml_state.build_type.get_overlayroot()
6566
self.post_init(custom_args)
@@ -555,16 +556,24 @@ def _mount_system(
555556

556557
if self.root_filesystem_is_overlay:
557558
# In case of an overlay root system all parts of the rootfs
558-
# are read-only by squashfs except for the extra boot partition.
559-
# However tools like grub's mkconfig creates temporary files
560-
# at call time and therefore /tmp needs to be writable during
561-
# the call time of the tools
559+
# are read-only. However tools like grub's mkconfig creates
560+
# temporary files at call time and therefore /tmp needs to
561+
# be writable during the call time of the tools
562562
self.tmp_mount = MountManager(
563563
device='/tmp',
564564
mountpoint=self.root_mount.mountpoint + '/tmp'
565565
)
566566
self.tmp_mount.bind_mount()
567567

568+
# There are also tools that writes to /etc/kernel, e.g
569+
# systemd-boot. If it exists we map it to the ESP
570+
etc_kernel = f'{self.root_mount.mountpoint}/etc/kernel'
571+
if os.path.exists(etc_kernel):
572+
self.etc_kernel_mount = MountManager(
573+
device=efi_device, mountpoint=etc_kernel
574+
)
575+
self.etc_kernel_mount.mount()
576+
568577
self.device_mount = MountManager(
569578
device='/dev',
570579
mountpoint=self.root_mount.mountpoint + '/dev'
@@ -600,6 +609,8 @@ def _umount_system(self):
600609
self.efi_mount.umount()
601610
if self.tmp_mount:
602611
self.tmp_mount.umount()
612+
if self.etc_kernel_mount:
613+
self.etc_kernel_mount.umount()
603614
if self.boot_mount:
604615
self.boot_mount.umount()
605616
if self.root_mount:
@@ -626,13 +637,17 @@ def _get_root_cmdline_parameter(self, boot_device):
626637
return root_search.group(1)
627638
if boot_device:
628639
if self.xml_state.build_type.get_overlayroot():
629-
# In case of an overlay setup the root partition is a squashfs
630-
# In this case the root location can only be specified by the
631-
# partition uuid because squashfs itself doesn't have one.
640+
# In case of an overlay setup the root partition is read-only
641+
# In this case the root location will be specified by the
642+
# partition uuid because not all read-only filesystems have one.
632643
# Exception to this is if the overlay is also encrypted
644+
# Exception to this is if the overlay is on verity
645+
verity = self.xml_state.build_type.get_verity_blocks()
633646
luks = self.xml_state.get_luks_credentials()
634647
if luks is not None:
635648
return 'root=overlay:MAPPER=luks'
649+
elif verity:
650+
return 'root=overlay:MAPPER=verityroot'
636651
else:
637652
root_location = self._get_location(
638653
boot_device, 'by-partuuid'

0 commit comments

Comments
 (0)