mkosi.postinst

   1 #!/bin/sh
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3
   4 if [ "$1" = "build" ]; then
   5     exit 0
   6 fi
   7
   8 if [ -n "$SANITIZERS" ]; then
   9     LD_PRELOAD=$(ldd /usr/lib/systemd/systemd | grep libasan.so | awk '{print $3}')
  10
  11     mkdir -p /etc/systemd/system.conf.d
  12
  13     cat >/etc/systemd/system.conf.d/10-asan.conf <<EOF
  14 [Manager]
  15 ManagerEnvironment=ASAN_OPTIONS=$MKOSI_ASAN_OPTIONS\\
  16                    UBSAN_OPTIONS=$MKOSI_UBSAN_OPTIONS\\
  17                    LD_PRELOAD=$LD_PRELOAD
  18 DefaultEnvironment=ASAN_OPTIONS=$MKOSI_ASAN_OPTIONS\\
  19                    UBSAN_OPTIONS=$MKOSI_UBSAN_OPTIONS\\
  20                    LD_PRELOAD=$LD_PRELOAD
  21 EOF
  22
  23     # ASAN logs to stderr by default. However, journald's stderr is connected to /dev/null, so we lose
  24     # all the ASAN logs. To rectify that, let's connect journald's stdout to the console so that any
  25     # sanitizer failures appear directly on the user's console.
  26     mkdir -p /etc/systemd/system/systemd-journald.service.d
  27     cat >/etc/systemd/system/systemd-journald.service.d/10-stdout-tty.conf <<EOF
  28 [Service]
  29 StandardOutput=tty
  30 EOF
  31
  32     # Both systemd and util-linux's login call vhangup() on /dev/console which disconnects all users.
  33     # This means systemd-journald can't log to /dev/console even if we configure `StandardOutput=tty`. As
  34     # a workaround, we modify console-getty.service to disable systemd's vhangup() and disallow login
  35     # from calling vhangup() so that journald's ASAN logs correctly end up in the console.
  36
  37     mkdir -p /etc/systemd/system/console-getty.service.d
  38     cat >/etc/systemd/system/console-getty.service.d/10-no-vhangup.conf <<EOF
  39 [Service]
  40 TTYVHangup=no
  41 CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
  42 EOF
  43     # ASAN and syscall filters aren't compatible with each other.
  44     find / -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
  45
  46     # `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default.
  47     systemctl mask systemd-hwdb-update.service
  48 fi
  49
  50 if [ -n "$IMAGE_ID" ] ; then
  51     sed -n \
  52         -i \
  53         -e '/^IMAGE_ID=/!p' \
  54         -e "\$aIMAGE_ID=$IMAGE_ID" \
  55         /usr/lib/os-release
  56 fi
  57
  58 if [ -n "$IMAGE_VERSION" ] ; then
  59     sed -n \
  60         -i \
  61         -e '/^IMAGE_VERSION=/!p' \
  62         -e "\$aIMAGE_VERSION=$IMAGE_VERSION" \
  63         /usr/lib/os-release
  64 fi
  65
  66 if command -v authselect >/dev/null; then
  67     authselect select minimal
  68
  69     if authselect list-features minimal | grep -q "with-homed"; then
  70         authselect enable-feature with-homed
  71     fi
  72 fi
  73
  74 # Let tmpfiles.d/systemd-resolve.conf handle the symlink
  75 rm -f /etc/resolv.conf