[PATCH v7] image-postproc: gate systemd preset-all on masked unit state

[PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Badrikesh Prusty' via isar-users]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
---
 meta/classes-recipe/rootfs.bbclass | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..d250690f 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

 ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
 image_postprocess_populate_systemd_preset() {
-    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
-        --showformat='${db:Status-Status}' \
-        --show systemd || echo "" )
+    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

-    if (test "$SYSTEMD_INSTALLED" = "installed"); then
-        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
-    fi
+        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+            systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+                || systemctl preset-all --preset-mode="enable-only"
+        fi
+EOSH
 }

 do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
--
2.47.3

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260429130240.23780-1-badrikesh.prusty%40siemens.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

[Zhihang Wei]

Applied to next, thanks.

Zhihang

On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> Skip systemd preset-all during image postprocessing if masked unit files
> are detected, to avoid non-fatal failures when presetting units that are
> already masked.
>
> Move execution fully inside a single chroot invocation for consistency
> and reduced overhead.
>
> Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")
>
> Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> ---
>   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
>   1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
> index 8b502a50..d250690f 100644
> --- a/meta/classes-recipe/rootfs.bbclass
> +++ b/meta/classes-recipe/rootfs.bbclass
> @@ -569,13 +569,14 @@ EOSUDO
>
>   ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
>   image_postprocess_populate_systemd_preset() {
> -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> -        --showformat='${db:Status-Status}' \
> -        --show systemd || echo "" )
> +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)
>
> -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
> -    fi
> +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> +            systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
> +                || systemctl preset-all --preset-mode="enable-only"
> +        fi
> +EOSH
>   }
>
>   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> --
> 2.47.3
>

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/a4b691e5-6e24-4883-ab81-dfd3793df250%40ilbers.de.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
> 
> Zhihang
> 
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit
> > files
> > are detected, to avoid non-fatal failures when presetting units
> > that are
> > already masked.
> > 
> > Move execution fully inside a single chroot invocation for
> > consistency
> > and reduced overhead.
> > 
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > based on systemd presets")
Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all --
preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first
boot anyways.

BR Alexander

> > 
> > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > ---
> >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> >   1 file changed, 7 insertions(+), 6 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > recipe/rootfs.bbclass
> > index 8b502a50..d250690f 100644
> > --- a/meta/classes-recipe/rootfs.bbclass
> > +++ b/meta/classes-recipe/rootfs.bbclass
> > @@ -569,13 +569,14 @@ EOSUDO
> > 
> >   ROOTFS_POSTPROCESS_COMMAND +=
> > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset',
> > 'image_postprocess_populate_systemd_preset', '', d)}"
> >   image_postprocess_populate_systemd_preset() {
> > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > -        --showformat='${db:Status-Status}' \
> > -        --show systemd || echo "" )
> > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-
> > Status}' --show systemd 2>/dev/null)
> > 
> > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-
> > mode="enable-only"
> > -    fi
> > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > +            systemctl list-unit-files --state=masked --no-legend |
> > grep -q '^' \
> > +                || systemctl preset-all --preset-mode="enable-
> > only"
> > +        fi
> > +EOSH
> >   }
> > 
> >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > --
> > 2.47.3
> > 

-- 
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/04628b8c74af1c874fd657d4968e117ea4748183.camel%40siemens.com.

RE: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Prusty, Badrikesh' via isar-users]

Hi,

Here are the simple steps to reproduce the issue:

1. Check out Isar without this patch applied.

2. Create a recipe to mask a unit. Here I am using `ctrl-alt-del.target`
```
> cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
inherit dpkg-raw

SRC_URI = "file://postinst"

> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target
```

3. Install it to the rootfs:
```
> git diff
diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
index ea2bce8e..382acd29 100644
--- a/kas/package/pkg_hello.yaml
+++ b/kas/package/pkg_hello.yaml
@@ -6,4 +6,4 @@ header:

 local_conf_header:
   package-hello: |
-    IMAGE_INSTALL:append = " hello"
+    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
```

4. Trigger a build with distro set to debian-bookworm:
```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
```

Error log:
```
| DEBUG: Executing shell function image_postprocess_populate_systemd_preset
| Failed to preset unit, unit /etc/systemd/system/systemd-firstboot.service is masked.
| Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target is masked.
| Failed to preset unit, unit /lib/systemd/system/x11-common.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rc.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks-early.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rcS.service is masked.
| Failed to preset unit, unit /lib/systemd/system/hwclock.service is masked.
| Unit /etc/systemd/system/systemd-firstboot.service is masked, ignoring.
| Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
| Created symlink /etc/systemd/system/multi-user.target.wants/remote-cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
| Created symlink /etc/systemd/system/sysinit.target.wants/systemd-sysext.service → /lib/systemd/system/systemd-sysext.service.
| Unit /lib/systemd/system/x11-common.service is masked, ignoring.
| Unit /lib/systemd/system/rc.service is masked, ignoring.
| Failed to preset unit, file "/etc/systemd/system/ctrl-alt-del.target" already exists and is a symlink to "/dev/null".
```

Many thanks,
Badrikesh

-----Original Message-----
From: Heinisch, Alexander (FT RPD CED SES-AT) <alexander.heinisch@siemens.com> 
Sent: 20 June 2026 02:07
To: Prusty, Badrikesh (FT FDS CES LX PBU 2) <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com; wzh@ilbers.de
Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin, Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
> 
> Zhihang
> 
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit 
> > files are detected, to avoid non-fatal failures when presetting 
> > units that are already masked.
> > 
> > Move execution fully inside a single chroot invocation for 
> > consistency and reduced overhead.
> > 
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based 
> > on systemd presets")
Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all -- preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first boot anyways.

BR Alexander

> > 
> > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > ---
> >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> >   1 file changed, 7 insertions(+), 6 deletions(-)
> > 
> > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes- 
> > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > --- a/meta/classes-recipe/rootfs.bbclass
> > +++ b/meta/classes-recipe/rootfs.bbclass
> > @@ -569,13 +569,14 @@ EOSUDO
> > 
> >   ROOTFS_POSTPROCESS_COMMAND +=
> > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 
> > 'image_postprocess_populate_systemd_preset', '', d)}"
> >   image_postprocess_populate_systemd_preset() {
> > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > -        --showformat='${db:Status-Status}' \
> > -        --show systemd || echo "" )
> > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > +        SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-
> > Status}' --show systemd 2>/dev/null)
> > 
> > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset- 
> > mode="enable-only"
> > -    fi
> > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > +            systemctl list-unit-files --state=masked --no-legend |
> > grep -q '^' \
> > +                || systemctl preset-all --preset-mode="enable-
> > only"
> > +        fi
> > +EOSH
> >   }
> > 
> >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > --
> > 2.47.3
> > 

--
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/SG2PR06MB5107EE98F5B93B8C5829B18B91E12%40SG2PR06MB5107.apcprd06.prod.outlook.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an
existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by
masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly
mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset 

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle
that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your
distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
> 
> Here are the simple steps to reproduce the issue:
> 
> 1. Check out Isar without this patch applied.
> 
> 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> del.target`
> ```
> > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> inherit dpkg-raw
> 
> SRC_URI = "file://postinst"
> 
> > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
> 
> systemctl mask ctrl-alt-del.target
> ```
> 
> 3. Install it to the rootfs:
> ```
> > git diff
> diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
> index ea2bce8e..382acd29 100644
> --- a/kas/package/pkg_hello.yaml
> +++ b/kas/package/pkg_hello.yaml
> @@ -6,4 +6,4 @@ header:
> 
>  local_conf_header:
>    package-hello: |
> -    IMAGE_INSTALL:append = " hello"
> +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> ```
> 
> 4. Trigger a build with distro set to debian-bookworm:
> ```
> > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
> ```
> 
> Error log:
> ```
> > DEBUG: Executing shell function
> > image_postprocess_populate_systemd_preset
> > Failed to preset unit, unit /etc/systemd/system/systemd-
> > firstboot.service is masked.
> > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/x11-common.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > early.service is masked.
> > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/hwclock.service is
> > masked.
> > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > ignoring.
> > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > Created symlink /etc/systemd/system/multi-user.target.wants/remote-
> > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > del.target" already exists and is a symlink to "/dev/null".
> ```
> 
> Many thanks,
> Badrikesh
> 
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com> 
> Sent: 20 June 2026 02:07
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
> 
> On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > Applied to next, thanks.
> > 
> > Zhihang
> > 
> > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > Skip systemd preset-all during image postprocessing if masked
> > > unit 
> > > files are detected, to avoid non-fatal failures when presetting 
> > > units that are already masked.
> > > 
> > > Move execution fully inside a single chroot invocation for 
> > > consistency and reduced overhead.
> > > 
> > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > based 
> > > on systemd presets")
> Sorry for the (too)late reply.
> 
> Can you elaborate what this fix is about?
> 
> At least on my systems (and according to documentation) preset-all --
> preset-mode="enable-only" handles masked services gracefully.
> 
> The command emits:
> "Unit [redacted].service is masked, ignoring." correctly.
> but exits with exit code 0.
> 
> Further, the previous behavior is exactly what systemd does on first
> boot anyways.
> 
> BR Alexander
> 
> > > 
> > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > ---
> > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > > 
> > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes- 
> > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > --- a/meta/classes-recipe/rootfs.bbclass
> > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > @@ -569,13 +569,14 @@ EOSUDO
> > > 
> > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > preset', 
> > > 'image_postprocess_populate_systemd_preset', '', d)}"
> > >   image_postprocess_populate_systemd_preset() {
> > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > > -        --showformat='${db:Status-Status}' \
> > > -        --show systemd || echo "" )
> > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > showformat='${db:Status-
> > > Status}' --show systemd 2>/dev/null)
> > > 
> > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > preset- 
> > > mode="enable-only"
> > > -    fi
> > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > +            systemctl list-unit-files --state=masked --no-legend
> > > |
> > > grep -q '^' \
> > > +                || systemctl preset-all --preset-mode="enable-
> > > only"
> > > +        fi
> > > +EOSH
> > >   }
> > > 
> > >   do_rootfs_postprocess[vardeps] =
> > > "${ROOTFS_POSTPROCESS_COMMAND}"
> > > --
> > > 2.47.3
> > > 
> 
> --
> Alexander Heinisch
> Siemens AG
> www.siemens.com

-- 
Alexander Heinisch
Siemens AG
www.siemens.com

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/3c44e535412fe136737a186781ebb12f446fb9cb.camel%40siemens.com.

RE: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Prusty, Badrikesh' via isar-users]

Hi,

> I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```

Thanks for the suggestion!

Unfortunately, shipping a preset file with a "disable" rule won't work
in this case, because populate_systemd_preset applies presets
with:

    systemctl preset-all --preset-mode="enable-only"

This means "disable" rules in preset files are silently ignored.

To make disable rules effective, the --preset-mode flag would need to
be dropped from populate_systemd_preset.


Many thanks,
Badrikesh

-----Original Message-----
From: Heinisch, Alexander (FT RPD CED SES-AT) <alexander.heinisch@siemens.com>
Sent: 01 July 2026 15:12
To: Prusty, Badrikesh (FT FDS CES LX PBU 2) <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com; wzh@ilbers.de
Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer, Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin, Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>
> Here are the simple steps to reproduce the issue:
>
> 1. Check out Isar without this patch applied.
>
> 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> del.target` ```
> > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> inherit dpkg-raw
>
> SRC_URI = "file://postinst"
>
> > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
>
> systemctl mask ctrl-alt-del.target
> ```
>
> 3. Install it to the rootfs:
> ```
> > git diff
> diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
> index ea2bce8e..382acd29 100644
> --- a/kas/package/pkg_hello.yaml
> +++ b/kas/package/pkg_hello.yaml
> @@ -6,4 +6,4 @@ header:
>
>  local_conf_header:
>    package-hello: |
> -    IMAGE_INSTALL:append = " hello"
> +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> ```
>
> 4. Trigger a build with distro set to debian-bookworm:
> ```
> > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
> ```
>
> Error log:
> ```
> > DEBUG: Executing shell function
> > image_postprocess_populate_systemd_preset
> > Failed to preset unit, unit /etc/systemd/system/systemd-
> > firstboot.service is masked.
> > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/x11-common.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks.service
> > is masked.
> > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > early.service is masked.
> > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > masked.
> > Failed to preset unit, unit /lib/systemd/system/hwclock.service is
> > masked.
> > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > ignoring.
> > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > Created symlink /etc/systemd/system/multi-user.target.wants/remote-
> > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > del.target" already exists and is a symlink to "/dev/null".
> ```
>
> Many thanks,
> Badrikesh
>
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com>
> Sent: 20 June 2026 02:07
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
>
> On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > Applied to next, thanks.
> >
> > Zhihang
> >
> > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > Skip systemd preset-all during image postprocessing if masked unit
> > > files are detected, to avoid non-fatal failures when presetting
> > > units that are already masked.
> > >
> > > Move execution fully inside a single chroot invocation for
> > > consistency and reduced overhead.
> > >
> > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > based on systemd presets")
> Sorry for the (too)late reply.
>
> Can you elaborate what this fix is about?
>
> At least on my systems (and according to documentation) preset-all --
> preset-mode="enable-only" handles masked services gracefully.
>
> The command emits:
> "Unit [redacted].service is masked, ignoring." correctly.
> but exits with exit code 0.
>
> Further, the previous behavior is exactly what systemd does on first
> boot anyways.
>
> BR Alexander
>
> > >
> > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > ---
> > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > --- a/meta/classes-recipe/rootfs.bbclass
> > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > @@ -569,13 +569,14 @@ EOSUDO
> > >
> > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > preset', 'image_postprocess_populate_systemd_preset', '', d)}"
> > >   image_postprocess_populate_systemd_preset() {
> > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
> > > -        --showformat='${db:Status-Status}' \
> > > -        --show systemd || echo "" )
> > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > showformat='${db:Status-
> > > Status}' --show systemd 2>/dev/null)
> > >
> > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > preset-
> > > mode="enable-only"
> > > -    fi
> > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > +            systemctl list-unit-files --state=masked --no-legend
> > > |
> > > grep -q '^' \
> > > +                || systemctl preset-all --preset-mode="enable-
> > > only"
> > > +        fi
> > > +EOSH
> > >   }
> > >
> > >   do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
> > > --
> > > 2.47.3
> > >
>
> --
> Alexander Heinisch
> Siemens AG
> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG
http://www.siemens.com/

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/SG2PR06MB51077C6DF7E9182EE88C71C991F92%40SG2PR06MB5107.apcprd06.prod.outlook.com.

Re: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Heinisch, Alexander' via isar-users]

On Tue, 2026-07-14 at 04:05 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>
> > I'd propose to revert that "fix" and fix the preset shipped with
> > your distribution accordingly:
> >
> > e.g.:
> > ```
> > echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> > reboot-target-mask.preset
> > ```
>
> Thanks for the suggestion!
>
> Unfortunately, shipping a preset file with a "disable" rule won't
> work
> in this case, because populate_systemd_preset applies presets
> with:
>
>     systemctl preset-all --preset-mode="enable-only"
>
> This means "disable" rules in preset files are silently ignored.
>

The preset-all with enable-only won't take care about the disabling nor
about masking, you just have to resolve the conflict between masking
and the preset for said unit by unsetting the units/targets preset
enable policy. (you could also just remove the line that states preset
enable for said unit - but imo the drop in config version is nicer)

The proposed handling below is not a replacement for masking the unit,
but a fix for the error you experienced during preset-all.

Based on the example you gave, that would result in something like:

```
cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target

echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

> To make disable rules effective, the --preset-mode flag would need to
> be dropped from populate_systemd_preset.
>
>
> Many thanks,
> Badrikesh
>
> -----Original Message-----
> From: Heinisch, Alexander (FT RPD CED SES-AT)
> <alexander.heinisch@siemens.com>
> Sent: 01 July 2026 15:12
> To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> wzh@ilbers.de
> Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> masked unit state
>
> Thx for clarifying steps to reproduce.
>
> I followed your steps below with a minor modification to build an
> existing image (isar-image-base)
>
> ```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> pc.yaml:kas/distro/debian-
> bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-
> base.yaml
> ```
>
> I could reproduce described log output in bookworm.
>
> But, the error message is caused by a conflict you introduced by
> masking /usr/lib/systemd/system/ctrl-alt-del.target!

Note: My proposed solution is about resolving described conflict, not
about a replacement for masking the unit.


BR Alexander

>
> ctrl-alt-del.target is a link to reboot.target which is explicitly
> mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset
>
> Therefore, systemd (in bookworm) emits an error.
> Later versions of systemd (e.g. the one shipped with trixie) handle
> that more gracefully [1], as mentioned previously.
>
>
> TL;DR:
>
> I'd propose to revert that "fix" and fix the preset shipped with your
> distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```
>
> BR Alexander
>
>
> [1]:
> https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552
>
> On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX
> PBU
> 2) wrote:
> > Hi,
> >
> > Here are the simple steps to reproduce the issue:
> >
> > 1. Check out Isar without this patch applied.
> >
> > 2. Create a recipe to mask a unit. Here I am using `ctrl-alt-
> > del.target` ```
> > > cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
> > inherit dpkg-raw
> >
> > SRC_URI = "file://postinst"
> >
> > > cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> > #!/bin/sh
> >
> > systemctl mask ctrl-alt-del.target
> > ```
> >
> > 3. Install it to the rootfs:
> > ```
> > > git diff
> > diff --git a/kas/package/pkg_hello.yaml
> > b/kas/package/pkg_hello.yaml
> > index ea2bce8e..382acd29 100644
> > --- a/kas/package/pkg_hello.yaml
> > +++ b/kas/package/pkg_hello.yaml
> > @@ -6,4 +6,4 @@ header:
> >
> >  local_conf_header:
> >    package-hello: |
> > -    IMAGE_INSTALL:append = " hello"
> > +    IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
> > ```
> >
> > 4. Trigger a build with distro set to debian-bookworm:
> > ```
> > > ./kas/kas-container build kas/isar.yaml:kas/machine/x86-
> > > pc.yaml:kas/distro/debian-
> > > bookworm.yaml:kas/package/pkg_hello.yaml
> > ```
> >
> > Error log:
> > ```
> > > DEBUG: Executing shell function
> > > image_postprocess_populate_systemd_preset
> > > Failed to preset unit, unit /etc/systemd/system/systemd-
> > > firstboot.service is masked.
> > > Failed to preset unit, unit /etc/systemd/system/ctrl-alt-
> > > del.target
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/x11-
> > > common.service
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/rc.service is
> > > masked.
> > > Failed to preset unit, unit
> > > /lib/systemd/system/cryptdisks.service
> > > is masked.
> > > Failed to preset unit, unit /lib/systemd/system/cryptdisks-
> > > early.service is masked.
> > > Failed to preset unit, unit /lib/systemd/system/rcS.service is
> > > masked.
> > > Failed to preset unit, unit /lib/systemd/system/hwclock.service
> > > is
> > > masked.
> > > Unit /etc/systemd/system/systemd-firstboot.service is masked,
> > > ignoring.
> > > Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
> > > Created symlink /etc/systemd/system/multi-
> > > user.target.wants/remote-
> > > cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
> > > Created symlink /etc/systemd/system/sysinit.target.wants/systemd-
> > > sysext.service → /lib/systemd/system/systemd-sysext.service.
> > > Unit /lib/systemd/system/x11-common.service is masked, ignoring.
> > > Unit /lib/systemd/system/rc.service is masked, ignoring.
> > > Failed to preset unit, file "/etc/systemd/system/ctrl-alt-
> > > del.target" already exists and is a symlink to "/dev/null".
> > ```
> >
> > Many thanks,
> > Badrikesh
> >
> > -----Original Message-----
> > From: Heinisch, Alexander (FT RPD CED SES-AT)
> > <alexander.heinisch@siemens.com>
> > Sent: 20 June 2026 02:07
> > To: Prusty, Badrikesh (FT FDS CES LX PBU 2)
> > <badrikesh.prusty@siemens.com>; isar-users@googlegroups.com;
> > wzh@ilbers.de
> > Cc: Kiszka, Jan (FT RPD CED) <jan.kiszka@siemens.com>; Moessbauer,
> > Felix (FT RPD CED OES-DE) <felix.moessbauer@siemens.com>; Çetin,
> > Gökhan (FT D EU TR C&E) <gokhan.cetin@siemens.com>
> > Subject: Re: [PATCH v7] image-postproc: gate systemd preset-all on
> > masked unit state
> >
> > On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> > > Applied to next, thanks.
> > >
> > > Zhihang
> > >
> > > On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > > > Skip systemd preset-all during image postprocessing if masked
> > > > unit
> > > > files are detected, to avoid non-fatal failures when presetting
> > > > units that are already masked.
> > > >
> > > > Move execution fully inside a single chroot invocation for
> > > > consistency and reduced overhead.
> > > >
> > > > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > > > based on systemd presets")
> > Sorry for the (too)late reply.
> >
> > Can you elaborate what this fix is about?
> >
> > At least on my systems (and according to documentation) preset-all
> > --
> > preset-mode="enable-only" handles masked services gracefully.
> >
> > The command emits:
> > "Unit [redacted].service is masked, ignoring." correctly.
> > but exits with exit code 0.
> >
> > Further, the previous behavior is exactly what systemd does on
> > first
> > boot anyways.
> >
> > BR Alexander
> >
> > > >
> > > > Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>
> > > > ---
> > > >   meta/classes-recipe/rootfs.bbclass | 13 +++++++------
> > > >   1 file changed, 7 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-
> > > > recipe/rootfs.bbclass index 8b502a50..d250690f 100644
> > > > --- a/meta/classes-recipe/rootfs.bbclass
> > > > +++ b/meta/classes-recipe/rootfs.bbclass
> > > > @@ -569,13 +569,14 @@ EOSUDO
> > > >
> > > >   ROOTFS_POSTPROCESS_COMMAND +=
> > > > "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-
> > > > preset', 'image_postprocess_populate_systemd_preset', '', d)}"
> > > >   image_postprocess_populate_systemd_preset() {
> > > > -    SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query
> > > > \
> > > > -        --showformat='${db:Status-Status}' \
> > > > -        --show systemd || echo "" )
> > > > +    sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
> > > > +        SYSTEMD_INSTALLED=$(dpkg-query --
> > > > showformat='${db:Status-
> > > > Status}' --show systemd 2>/dev/null)
> > > >
> > > > -    if (test "$SYSTEMD_INSTALLED" = "installed"); then
> > > > -        sudo chroot '${ROOTFSDIR}' systemctl preset-all --
> > > > preset-
> > > > mode="enable-only"
> > > > -    fi
> > > > +        if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
> > > > +            systemctl list-unit-files --state=masked --no-
> > > > legend
> > > > >
> > > > grep -q '^' \
> > > > +                || systemctl preset-all --preset-mode="enable-
> > > > only"
> > > > +        fi
> > > > +EOSH
> > > >   }
> > > >
> > > >   do_rootfs_postprocess[vardeps] =
> > > > "${ROOTFS_POSTPROCESS_COMMAND}"
> > > > --
> > > > 2.47.3
> > > >
> >
> > --
> > Alexander Heinisch
> > Siemens AG
> > http://www.siemens.com/
>
> --
> Alexander Heinisch
> Siemens AG
> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG
http://www.siemens.com/

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/523277bfe9f93b4cdfb2a63b4c8f23607a7371f0.camel%40siemens.com.

RE: [PATCH v7] image-postproc: gate systemd preset-all on masked unit state

['Prusty, Badrikesh' via isar-users]

Hi,

Apologies for delayed response.

> The proposed handling below is not a replacement for masking the unit,
> but a fix for the error you experienced during preset-all.
> 
> Based on the example you gave, that would result in something like:
> 
> ```
> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
> 
> systemctl mask ctrl-alt-del.target
> 
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```
>

I tried the suggested solution, and it is working as expected, the build completed
without any issues.

Initially there was concern this might affect systemctl reboot or reboot commands,
but both works as expected. Found out reboot.target is merely an alias for ctrl-alt-del.target,
and the actual reboot is performed by system-reboot.service which remains unaffected.

```
$ cat /usr/lib/systemd/system/reboot.target
[Unit]
Description=System Reboot
Documentation=man:systemd.special(7)
DefaultDependencies=no
Requires=systemd-reboot.service
After=systemd-reboot.service
AllowIsolate=yes
JobTimeoutSec=30min
JobTimeoutAction=reboot-force

[Install]
Alias=ctrl-alt-del.target
```

Many thanks,
Badri

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/TYZPR06MB509755F2EA339D0CEF3138B591D22%40TYZPR06MB5097.apcprd06.prod.outlook.com.