Systemd first boot with rw rootfs

Systemd first boot with rw rootfs

[Gylstorff Quirin]

Hi all,


currently we trigger a first boot by removing the machine-id from the
root file system[1]. In case of a writable root filesystem systemd will 
enable all units in /usr/lib/systemd/system with the vendor preset 
enable. This will also enable units in /usr/lib/systemd/system which are 
disable during the installation like ssh.socket[2].

This will not happen in a Debian installation as first boot is the 
installation boot as defined by:
"For normal operating system installations, where a custom image is 
created for a specific machine, /etc/machine-id should be populated 
during installation."[3]


If a first boot is not detected, e.g. by using an empty /etc/machine-id, 
the units are started as defined during the installation [4].

Another possibility is to mask the units during the the installation.

[1]: 
https://github.com/ilbers/isar/blob/49854b625a6b0dc9339a33c3b4d78b2ce418b377/meta/classes/image-postproc-extension.bbclass#L57
[2]: https://gitlab.com/cip-project/cip-core/isar-cip-core/-/issues/48
[3]: 
https://manpages.debian.org/bullseye/systemd/machine-id.5.en.html#INITIALIZATION
[4]: 
https://manpages.debian.org/bullseye/systemd/machine-id.5.en.html#FIRST_BOOT_SEMANTICS
-- 


With best regards,
Quirin Gylstorff

Siemens AG
Technology

[RFC] image-postproc-extension: Configurable systemd first boot

[Quirin Gylstorff]

From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

The Default implementation will not trigger the first boot condition.

In case of a writable root file system systemd will enable all
units in /usr/lib/systemd/system with the vendor preset enable.
This will also enable units in /usr/lib/systemd/system which are
disable during the installation like ssh.socket.

This will not happen in a Debian installation as first boot is
the installation boot as defined by:
"For normal operating system installations, where a custom image
is created for a specific machine, /etc/machine-id should be
populated during installation."

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 meta/classes/image-postproc-extension.bbclass | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/meta/classes/image-postproc-extension.bbclass b/meta/classes/image-postproc-extension.bbclass
index 4a901cb..7e3b8e0 100644
--- a/meta/classes/image-postproc-extension.bbclass
+++ b/meta/classes/image-postproc-extension.bbclass
@@ -53,15 +53,14 @@ image_postprocess_mark() {
         --build-id "${BUILD_ID}" --variant "${DESCRIPTION}" --version "${PV}"
 }
 
+ENABLE_SYSTEMD_FIRST_BOOT ??= "0"
 ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_machine_id"
 image_postprocess_machine_id() {
-    # systemd(1) takes care of recreating the machine-id on first boot
-    # for systemd < v247, set to empty string, else set to uninitialized
-    # (required if initramfs with ro root is used)
     SYSTEMD_VERSION=$( sudo chroot ${IMAGE_ROOTFS} dpkg-query --showformat='${source:Upstream-Version}' --show systemd || echo "0" )
-    MACHINE_ID="uninitialized"
-    if dpkg --compare-versions "$SYSTEMD_VERSION" "lt" "247"; then
-        MACHINE_ID=""
+    MACHINE_ID=""
+    if [ "${ENABLE_SYSTEMD_FIRST_BOOT}" = "1" ] && \
+        dpkg --compare-versions "$SYSTEMD_VERSION" "gt" "247"; then
+        MACHINE_ID="uninitialized"
     fi
     echo "$MACHINE_ID" | sudo tee '${IMAGE_ROOTFS}/etc/machine-id'
     sudo rm -f '${IMAGE_ROOTFS}/var/lib/dbus/machine-id'
-- 
2.35.1

Re: [RFC] image-postproc-extension: Configurable systemd first boot

[Gylstorff Quirin]

On 11/29/22 11:46, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> 
> The Default implementation will not trigger the first boot condition.
> 
> In case of a writable root file system systemd will enable all
> units in /usr/lib/systemd/system with the vendor preset enable.
> This will also enable units in /usr/lib/systemd/system which are
> disable during the installation like ssh.socket.
> 
> This will not happen in a Debian installation as first boot is
> the installation boot as defined by:
> "For normal operating system installations, where a custom image
> is created for a specific machine, /etc/machine-id should be
> populated during installation."
> 
> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> ---
>   meta/classes/image-postproc-extension.bbclass | 11 +++++------
>   1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/meta/classes/image-postproc-extension.bbclass b/meta/classes/image-postproc-extension.bbclass
> index 4a901cb..7e3b8e0 100644
> --- a/meta/classes/image-postproc-extension.bbclass
> +++ b/meta/classes/image-postproc-extension.bbclass
> @@ -53,15 +53,14 @@ image_postprocess_mark() {
>           --build-id "${BUILD_ID}" --variant "${DESCRIPTION}" --version "${PV}"
>   }
>   
> +ENABLE_SYSTEMD_FIRST_BOOT ??= "0"
>   ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_machine_id"
>   image_postprocess_machine_id() {
> -    # systemd(1) takes care of recreating the machine-id on first boot
> -    # for systemd < v247, set to empty string, else set to uninitialized
> -    # (required if initramfs with ro root is used)
>       SYSTEMD_VERSION=$( sudo chroot ${IMAGE_ROOTFS} dpkg-query --showformat='${source:Upstream-Version}' --show systemd || echo "0" )
> -    MACHINE_ID="uninitialized"
> -    if dpkg --compare-versions "$SYSTEMD_VERSION" "lt" "247"; then
> -        MACHINE_ID=""
> +    MACHINE_ID=""
> +    if [ "${ENABLE_SYSTEMD_FIRST_BOOT}" = "1" ] && \
> +        dpkg --compare-versions "$SYSTEMD_VERSION" "gt" "247"; then
> +        MACHINE_ID="uninitialized"
>       fi
>       echo "$MACHINE_ID" | sudo tee '${IMAGE_ROOTFS}/etc/machine-id'
>       sudo rm -f '${IMAGE_ROOTFS}/var/lib/dbus/machine-id'

Ping
Quirin

Re: [RFC] image-postproc-extension: Configurable systemd first boot

[Michael Adler]

Hi Quirin,

> In case of a writable root file system systemd will enable all
> units in /usr/lib/systemd/system with the vendor preset enable.
> This will also enable units in /usr/lib/systemd/system which are
> disable during the installation like ssh.socket.

I've stumbled upon the same problem. It took me quite a while to figure out
why systemd services which where explicitly *not* enabled at build time where
somehow still enabled and started on system boot. I did not suspect systemd to
be the culprit! This behavior is unexpected and irritating to say the least.

> The Default implementation will not trigger the first boot condition.

That makes sense. After all, we are fully in control of the root filesystem at
build time. I don't want to deal with surprises at boot time.

Kind Regards,
  Michael

-- 
Michael Adler

Siemens AG
Technology
Connectivity & Edge
Smart Embedded Systems
T CED SES-DE
Otto-Hahn-Ring 6
81739 Munich, Germany

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann
Snabe; Managing Board: Roland Busch, Chairman, President and Chief Executive
Officer; Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese;
Registered offices: Berlin and Munich, Germany; Commercial registries:
Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322