[PATCH v7] image-postproc: gate systemd preset-all on masked unit state

[PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Badrikesh Prusty' via isar-users]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
---
 meta/classes-recipe/rootfs.bbclass | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..d250690f 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

 ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
 image_postprocess_populate_systemd_preset() {
-    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
-        --showformat='${db:Status-Status}' \
-        --show systemd || echo "" )
+    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

-    if (test "$SYSTEMD_INSTALLED" = "installed"); then
-        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
-    fi
+        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+            systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+                || systemctl preset-all --preset-mode="enable-only"
+        fi
+EOSH
 }

 do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
--
2.47.3

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260429130240.23780-1-badrikesh.prusty%40siemens.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> Skip systemd preset-all during image postprocessing if masked unit files
> are detected, to avoid non-fatal failures when presetting units that are
> already masked.
>
> Move execution fully inside a single chroot invocation for consistency
> and reduced overhead.
>
> Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")
>
> Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> ---
>   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
> index 8b502a50..d250690f 100644
> --- a/meta/classes-recipe/rootfs.bbclass
> +++ b/meta/classes-recipe/rootfs.bbclass
> @@ -569,13 +569,14 @@ EOSUDO
>
>   ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
>   image_postprocess_populate_systemd_preset() {
> -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> -        --showformat='${db:Status-Status}' \
> -        --show systemd || echo "" )
> +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)
>
> -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
> -    fi
> +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> +            systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
> +                || systemctl preset-all --preset-mode="enable-only"
> +        fi
> +EOSH
>   }
>
>   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> --
> 2.47.3
>

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/a4b691e5-6e24-4883-ab81-dfd3793df250%40ilbers.de.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
> 
> Zhihang
> 
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit
> > files
> > are detected, to avoid non-fatal failures when presetting units
> > that are
> > already masked.
> > 
> > Move execution fully inside a single chroot invocation for
> > consistency
> > and reduced overhead.
> > 
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > based on systemd presets")
Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all --
preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first
boot anyways.

BR Alexander

> > 
> > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > ---
> >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> >   1 file changed, 7 insertions(+), 6 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > recipe/rootfs.bbclass
> > index 8b502a50..d250690f 100644
> > --- a/meta/classes-recipe/rootfs.bbclass
> > +++ b/meta/classes-recipe/rootfs.bbclass
> > @@ -569,13 +569,14 @@ EOSUDO
> > 
> >   ROOTFS_POSTPROCESS_COMMAND +=
> > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset',
> > 'image_postprocess_populate_systemd_preset', '', d)}"
> >   image_postprocess_populate_systemd_preset() {
> > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > -        --showformat='${db:Status-Status}' \
> > -        --show systemd || echo "" )
> > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-
> > Status}' --show systemd 2>/dev/null)
> > 
> > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-
> > mode="enable-only"
> > -    fi
> > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > +            systemctl list-unit-files --state=masked --no-legend |
> > grep -q '^' \
> > +                || systemctl preset-all --preset-mode="enable-
> > only"
> > +        fi
> > +EOSH
> >   }
> > 
> >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > --
> > 2.47.3
> > 

-- 
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/04628b8c74af1c874fd657d4968e117ea4748183.camel%40siemens.com.

RE: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Prusty, Badrikesh' via isar-users]

Hi,

Here are the simple steps to reproduce the issue:

1. Check out Isar without this patch applied.

2. Create a recipe to mask a unit. Here I am using `ctrl-alt-del.target`
```
> cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
inherit dpkg-raw

SRC_URI = "file://postinst"

> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target
```

3. Install it to the rootfs:
```
> git diff
diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
index ea2bce8e..382acd29 100644
--- a/kas/package/pkg_hello.yaml
+++ b/kas/package/pkg_hello.yaml
@@ -6,4 +6,4 @@ header:

 local_conf_header:
   package-hello: |
-    IMAGE_INSTALL:append = " hello"
+    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
```

4. Trigger a build with distro set to debian-bookworm:
```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
```

Error log:
```
| DEBUG: Executing shell function image_postprocess_populate_systemd_preset
| Failed to preset unit, unit /etc/systemd/system/systemd-firstboot.service is masked.
| Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target is masked.
| Failed to preset unit, unit /lib/systemd/system/x11-common.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rc.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks-early.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rcS.service is masked.
| Failed to preset unit, unit /lib/systemd/system/hwclock.service is masked.
| Unit /etc/systemd/system/systemd-firstboot.service is masked, ignoring.
| Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
| Created symlink /etc/systemd/system/multi-user.target.wants/remote-cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
| Created symlink /etc/systemd/system/sysinit.target.wants/systemd-sysext.service → /lib/systemd/system/systemd-sysext.service.
| Unit /lib/systemd/system/x11-common.service is masked, ignoring.
| Unit /lib/systemd/system/rc.service is masked, ignoring.
| Failed to preset unit, file "/etc/systemd/system/ctrl-alt-del.target" already exists and is a symlink to "/dev/null".
```

Many thanks,
Badrikesh

-----Original Message-----
From: Heinisch, Alexander (FT RPD CED SES-AT) <alexander.heinisch@siemens.com> 
Sent: 20 June 2026 02:07
To: Prusty, Badrikesh (FT FDS CES LX PBU 2) <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com; wzh@ilbers.de
Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin, Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
> 
> Zhihang
> 
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit 
> > files are detected, to avoid non-fatal failures when presetting 
> > units that are already masked.
> > 
> > Move execution fully inside a single chroot invocation for 
> > consistency and reduced overhead.
> > 
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based 
> > on systemd presets")
Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all -- preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first boot anyways.

BR Alexander

> > 
> > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > ---
> >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> >   1 file changed, 7 insertions(+), 6 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes- 
> > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > --- a/meta/classes-recipe/rootfs.bbclass
> > +++ b/meta/classes-recipe/rootfs.bbclass
> > @@ -569,13 +569,14 @@ EOSUDO
> > 
> >   ROOTFS_POSTPROCESS_COMMAND +=
> > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 
> > 'image_postprocess_populate_systemd_preset', '', d)}"
> >   image_postprocess_populate_systemd_preset() {
> > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > -        --showformat='${db:Status-Status}' \
> > -        --show systemd || echo "" )
> > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-
> > Status}' --show systemd 2>/dev/null)
> > 
> > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset- 
> > mode="enable-only"
> > -    fi
> > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > +            systemctl list-unit-files --state=masked --no-legend |
> > grep -q '^' \
> > +                || systemctl preset-all --preset-mode="enable-
> > only"
> > +        fi
> > +EOSH
> >   }
> > 
> >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > --
> > 2.47.3
> > 

--
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/SG2PR06MB5107EE98F5B93B8C5829B18B91E12%40SG2PR06MB5107.apcprd06.prod.outlook.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an
existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by
masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly
mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset 

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle
that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your
distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
> 
> Here are the simple steps to reproduce the issue:
> 
> 1. Check out Isar without this patch applied.
> 
> 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> del.target`
> ```
> > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> inherit dpkg-raw
> 
> SRC_URI = "file://postinst"
> 
> > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
> 
> systemctl mask ctrl-alt-del.target
> ```
> 
> 3. Install it to the rootfs:
> ```
> > git diff
> diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
> index ea2bce8e..382acd29 100644
> --- a/kas/package/pkg_hello.yaml
> +++ b/kas/package/pkg_hello.yaml
> @@ -6,4 +6,4 @@ header:
> 
>  local_conf_header:
>    package-hello: |
> -    IMAGE_INSTALL:append = " hello"
> +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> ```
> 
> 4. Trigger a build with distro set to debian-bookworm:
> ```
> > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
> ```
> 
> Error log:
> ```
> > DEBUG: Executing shell function
> > image_postprocess_populate_systemd_preset
> > Failed to preset unit, unit /etc/systemd/system/systemd-
> > firstboot.service is masked.
> > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/x11-common.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > early.service is masked.
> > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/hwclock.service is
> > masked.
> > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > ignoring.
> > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > Created symlink /etc/systemd/system/multi-user.target.wants/remote-
> > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > del.target" already exists and is a symlink to "/dev/null".
> ```
> 
> Many thanks,
> Badrikesh
> 
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com> 
> Sent: 20 June 2026 02:07
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
> 
> On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > Applied to next, thanks.
> > 
> > Zhihang
> > 
> > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > Skip systemd preset-all during image postprocessing if masked
> > > unit 
> > > files are detected, to avoid non-fatal failures when presetting 
> > > units that are already masked.
> > > 
> > > Move execution fully inside a single chroot invocation for 
> > > consistency and reduced overhead.
> > > 
> > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > based 
> > > on systemd presets")
> Sorry for the (too)late reply.
> 
> Can you elaborate what this fix is about?
> 
> At least on my systems (and according to documentation) preset-all --
> preset-mode="enable-only" handles masked services gracefully.
> 
> The command emits:
> "Unit [redacted].service is masked, ignoring." correctly.
> but exits with exit code 0.
> 
> Further, the previous behavior is exactly what systemd does on first
> boot anyways.
> 
> BR Alexander
> 
> > > 
> > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > ---
> > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > > 
> > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes- 
> > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > --- a/meta/classes-recipe/rootfs.bbclass
> > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > @@ -569,13 +569,14 @@ EOSUDO
> > > 
> > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > preset', 
> > > 'image_postprocess_populate_systemd_preset', '', d)}"
> > >   image_postprocess_populate_systemd_preset() {
> > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > > -        --showformat='${db:Status-Status}' \
> > > -        --show systemd || echo "" )
> > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > showformat='${db:Status-
> > > Status}' --show systemd 2>/dev/null)
> > > 
> > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > preset- 
> > > mode="enable-only"
> > > -    fi
> > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > +            systemctl list-unit-files --state=masked --no-legend
> > > |
> > > grep -q '^' \
> > > +                || systemctl preset-all --preset-mode="enable-
> > > only"
> > > +        fi
> > > +EOSH
> > >   }
> > > 
> > >   do_rootfs_postprocess[vardeps] =
> > > "${ROOTFS_POSTPROCESS_COMMAND}"
> > > --
> > > 2.47.3
> > > 
> 
> --
> Alexander Heinisch
> Siemens AG
> www.siemens.com

-- 
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/3c44e535412fe136737a186781ebb12f446fb9cb.camel%40siemens.com.

RE: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Prusty, Badrikesh' via isar-users]

Hi,

> I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```

Thanks for the suggestion!

Unfortunately, shipping a preset file with a "disable" rule won't work
in this case, because populate_systemd_preset applies presets
with:

    systemctl preset-all --preset-mode="enable-only"

This means "disable" rules in preset files are silently ignored.

To make disable rules effective, the --preset-mode flag would need to
be dropped from populate_systemd_preset.


Many thanks,
Badrikesh

-----Original Message-----
From: Heinisch, Alexander (FT RPD CED SES-AT) <alexander.heinisch@siemens.com>
Sent: 01 July 2026 15:12
To: Prusty, Badrikesh (FT FDS CES LX PBU 2) <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com; wzh@ilbers.de
Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin, Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>
> Here are the simple steps to reproduce the issue:
>
> 1. Check out Isar without this patch applied.
>
> 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> del.target` ```
> > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> inherit dpkg-raw
>
> SRC_URI = "file://postinst"
>
> > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
>
> systemctl mask ctrl-alt-del.target
> ```
>
> 3. Install it to the rootfs:
> ```
> > git diff
> diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
> index ea2bce8e..382acd29 100644
> --- a/kas/package/pkg_hello.yaml
> +++ b/kas/package/pkg_hello.yaml
> @@ -6,4 +6,4 @@ header:
>
>  local_conf_header:
>    package-hello: |
> -    IMAGE_INSTALL:append = " hello"
> +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> ```
>
> 4. Trigger a build with distro set to debian-bookworm:
> ```
> > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
> ```
>
> Error log:
> ```
> > DEBUG: Executing shell function
> > image_postprocess_populate_systemd_preset
> > Failed to preset unit, unit /etc/systemd/system/systemd-
> > firstboot.service is masked.
> > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/x11-common.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > early.service is masked.
> > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/hwclock.service is
> > masked.
> > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > ignoring.
> > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > Created symlink /etc/systemd/system/multi-user.target.wants/remote-
> > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > del.target" already exists and is a symlink to "/dev/null".
> ```
>
> Many thanks,
> Badrikesh
>
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com>
> Sent: 20 June 2026 02:07
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
>
> On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > Applied to next, thanks.
> >
> > Zhihang
> >
> > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > Skip systemd preset-all during image postprocessing if masked unit
> > > files are detected, to avoid non-fatal failures when presetting
> > > units that are already masked.
> > >
> > > Move execution fully inside a single chroot invocation for
> > > consistency and reduced overhead.
> > >
> > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > based on systemd presets")
> Sorry for the (too)late reply.
>
> Can you elaborate what this fix is about?
>
> At least on my systems (and according to documentation) preset-all --
> preset-mode="enable-only" handles masked services gracefully.
>
> The command emits:
> "Unit [redacted].service is masked, ignoring." correctly.
> but exits with exit code 0.
>
> Further, the previous behavior is exactly what systemd does on first
> boot anyways.
>
> BR Alexander
>
> > >
> > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > ---
> > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > --- a/meta/classes-recipe/rootfs.bbclass
> > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > @@ -569,13 +569,14 @@ EOSUDO
> > >
> > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > preset', 'image_postprocess_populate_systemd_preset', '', d)}"
> > >   image_postprocess_populate_systemd_preset() {
> > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > > -        --showformat='${db:Status-Status}' \
> > > -        --show systemd || echo "" )
> > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > showformat='${db:Status-
> > > Status}' --show systemd 2>/dev/null)
> > >
> > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > preset-
> > > mode="enable-only"
> > > -    fi
> > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > +            systemctl list-unit-files --state=masked --no-legend
> > > |
> > > grep -q '^' \
> > > +                || systemctl preset-all --preset-mode="enable-
> > > only"
> > > +        fi
> > > +EOSH
> > >   }
> > >
> > >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > > --
> > > 2.47.3
> > >
>
> --
> Alexander Heinisch
> Siemens AG
> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG
http://www.siemens.com/

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/SG2PR06MB51077C6DF7E9182EE88C71C991F92%40SG2PR06MB5107.apcprd06.prod.outlook.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

On Tue, 2026-07-14 at 04:05 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>
> > I'd propose to revert that "fix" and fix the preset shipped with
> > your distribution accordingly:
> >
> > e.g.:
> > ```
> > echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> > reboot-target-mask.preset
> > ```
>
> Thanks for the suggestion!
>
> Unfortunately, shipping a preset file with a "disable" rule won't
> work
> in this case, because populate_systemd_preset applies presets
> with:
>
>     systemctl preset-all --preset-mode="enable-only"
>
> This means "disable" rules in preset files are silently ignored.
>

The preset-all with enable-only won't take care about the disabling nor
about masking, you just have to resolve the conflict between masking
and the preset for said unit by unsetting the units/targets preset
enable policy. (you could also just remove the line that states preset
enable for said unit - but imo the drop in config version is nicer)

The proposed handling below is not a replacement for masking the unit,
but a fix for the error you experienced during preset-all.

Based on the example you gave, that would result in something like:

```
cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target

echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

> To make disable rules effective, the --preset-mode flag would need to
> be dropped from populate_systemd_preset.
>
>
> Many thanks,
> Badrikesh
>
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com>
> Sent: 01 July 2026 15:12
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
>
> Thx for clarifying steps to reproduce.
>
> I followed your steps below with a minor modification to build an
> existing image (isar-image-base)
>
> ```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> pc.yaml:kas/distro/debian-
> bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-
> base.yaml
> ```
>
> I could reproduce described log output in bookworm.
>
> But, the error message is caused by a conflict you introduced by
> masking /usr/lib/systemd/system/ctrl-alt-del.target!

Note: My proposed solution is about resolving described conflict, not
about a replacement for masking the unit.


BR Alexander

>
> ctrl-alt-del.target is a link to reboot.target which is explicitly
> mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset
>
> Therefore, systemd (in bookworm) emits an error.
> Later versions of systemd (e.g. the one shipped with trixie) handle
> that more gracefully [1], as mentioned previously.
>
>
> TL;DR:
>
> I'd propose to revert that "fix" and fix the preset shipped with your
> distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```
>
> BR Alexander
>
>
> [1]:
> https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552
>
> On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX
> PBU
> 2) wrote:
> > Hi,
> >
> > Here are the simple steps to reproduce the issue:
> >
> > 1. Check out Isar without this patch applied.
> >
> > 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> > del.target` ```
> > > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> > inherit dpkg-raw
> >
> > SRC_URI = "file://postinst"
> >
> > > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> > #!/bin/sh
> >
> > systemctl mask ctrl-alt-del.target
> > ```
> >
> > 3. Install it to the rootfs:
> > ```
> > > git diff
> > diff --git a/kas/package/pkg_hello.yaml
> > b/kas/package/pkg_hello.yaml
> > index ea2bce8e..382acd29 100644
> > --- a/kas/package/pkg_hello.yaml
> > +++ b/kas/package/pkg_hello.yaml
> > @@ -6,4 +6,4 @@ header:
> >
> >  local_conf_header:
> >    package-hello: |
> > -    IMAGE_INSTALL:append = " hello"
> > +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> > ```
> >
> > 4. Trigger a build with distro set to debian-bookworm:
> > ```
> > > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > > pc.yaml:kas/distro/debian-
> > > bookworm.yaml:kas/package/pkg_hello.yaml
> > ```
> >
> > Error log:
> > ```
> > > DEBUG: Executing shell function
> > > image_postprocess_populate_systemd_preset
> > > Failed to preset unit, unit /etc/systemd/system/systemd-
> > > firstboot.service is masked.
> > > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-
> > > del.target
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/x11-
> > > common.service
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > > masked.
> > > Failed to preset unit, unit
> > > /lib/systemd/system/cryptdisks.service
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > > early.service is masked.
> > > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > > masked.
> > > Failed to preset unit, unit /lib/systemd/system/hwclock.service
> > > is
> > > masked.
> > > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > > ignoring.
> > > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > > Created symlink /etc/systemd/system/multi-
> > > user.target.wants/remote-
> > > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > > del.target" already exists and is a symlink to "/dev/null".
> > ```
> >
> > Many thanks,
> > Badrikesh
> >
> > -----Original Message-----
> > From: Heinisch, Alexander (FT RPD CED SES-AT)
> > <alexander.heinisch@siemens.com>
> > Sent: 20 June 2026 02:07
> > To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> > <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> > wzh@ilbers.de
> > Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> > Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> > Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> > Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> > masked unit state
> >
> > On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > > Applied to next, thanks.
> > >
> > > Zhihang
> > >
> > > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > > Skip systemd preset-all during image postprocessing if masked
> > > > unit
> > > > files are detected, to avoid non-fatal failures when presetting
> > > > units that are already masked.
> > > >
> > > > Move execution fully inside a single chroot invocation for
> > > > consistency and reduced overhead.
> > > >
> > > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > > based on systemd presets")
> > Sorry for the (too)late reply.
> >
> > Can you elaborate what this fix is about?
> >
> > At least on my systems (and according to documentation) preset-all
> > --
> > preset-mode="enable-only" handles masked services gracefully.
> >
> > The command emits:
> > "Unit [redacted].service is masked, ignoring." correctly.
> > but exits with exit code 0.
> >
> > Further, the previous behavior is exactly what systemd does on
> > first
> > boot anyways.
> >
> > BR Alexander
> >
> > > >
> > > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > > ---
> > > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > > --- a/meta/classes-recipe/rootfs.bbclass
> > > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > > @@ -569,13 +569,14 @@ EOSUDO
> > > >
> > > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > > preset', 'image_postprocess_populate_systemd_preset', '', d)}"
> > > >   image_postprocess_populate_systemd_preset() {
> > > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query
> > > > \
> > > > -        --showformat='${db:Status-Status}' \
> > > > -        --show systemd || echo "" )
> > > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > > showformat='${db:Status-
> > > > Status}' --show systemd 2>/dev/null)
> > > >
> > > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > > preset-
> > > > mode="enable-only"
> > > > -    fi
> > > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > > +            systemctl list-unit-files --state=masked --no-
> > > > legend
> > > > >
> > > > grep -q '^' \
> > > > +                || systemctl preset-all --preset-mode="enable-
> > > > only"
> > > > +        fi
> > > > +EOSH
> > > >   }
> > > >
> > > >   do_rootfs_postprocess[vardeps] =
> > > > "${ROOTFS_POSTPROCESS_COMMAND}"
> > > > --
> > > > 2.47.3
> > > >
> >
> > --
> > Alexander Heinisch
> > Siemens AG
> > http://www.siemens.com/
>
> --
> Alexander Heinisch
> Siemens AG
> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG
http://www.siemens.com/

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/523277bfe9f93b4cdfb2a63b4c8f23607a7371f0.camel%40siemens.com.