From: Vitaly Kuznetsov Date: Mon, 7 Jul 2025 12:25:29 +0000 (+0200) Subject: stub: Support global sysext/confext X-Git-Tag: v258-rc1~78^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9f7e3820e9b3959fca31fb4f00fae9e3b2543b76;p=thirdparty%2Fsystemd.git stub: Support global sysext/confext Systemd-stub support loading addons, credentials, system and configuration extensions from ESP and while addons and credentials can be both global and per-UKI, sysext/confext are only per-UKI. Add support for loading ESP/loader/credentials/*.{sysext,confext}.raw to systemd-stub. Note: for backwards compatibility reasons, per-UKI sysexts can also be *.raw (not only *.sysext.raw) but as global extensions are new, there's no need to bring this legacy there. --- diff --git a/man/systemd-stub.xml b/man/systemd-stub.xml index abba8834fba..dd709c2949e 100644 --- a/man/systemd-stub.xml +++ b/man/systemd-stub.xml @@ -36,6 +36,8 @@ ESP/.../foo.efi.extra.d/*.confext.raw ESP/loader/addons/*.addon.efi ESP/loader/credentials/*.cred + ESP/loader/extensions/*.sysext.raw + ESP/loader/extensions/*.confext.raw @@ -202,8 +204,8 @@ Similarly, files foo.efi.extra.d/*.sysext.raw are packed up in a cpio archive and placed in the /.extra/sysext/ directory in the - initrd file hierarchy. This is supposed to be used to pass additional system extension images to the - initrd. See + initrd file hierarchy. This is supposed to be used to pass additional UKI-specific system extension + images to the initrd. See systemd-sysext8 for details on system extension images. The generated cpio archive containing these system extension images is measured into TPM PCR 13 (if a TPM is present). @@ -212,11 +214,27 @@ compatibility reasons with old versions. But we want people to name their system extensions properly, hence we document the *.sysext.raw suffix only. --> + Similarly, files /loader/extensions/*.sysext.raw + are packed up in a cpio archive and placed in the /.extra/global_sysext/ + directory in the initrd file hierarchy. This is supposed to be used to pass additional global system + extension images to the initrd. See + systemd-sysext8 for + details on system extension images. The generated cpio archive containing these + system extension images is measured into TPM PCR 13 (if a TPM is present). + Similarly, files foo.efi.extra.d/*.confext.raw are packed up in a cpio archive and placed in the /.extra/confext/ directory in - the initrd file hierarchy. This is supposed to be used to pass additional configuration extension - images to the initrd. See + the initrd file hierarchy. This is supposed to be used to pass additional UKI-specific configuration + extension images to the initrd. See + systemd-confext8 for + details on configuration extension images. The generated cpio archive containing + these configuration extension images is measured into TPM PCR 12 (if a TPM is present). + + Similarly, files /loader/extensions/*.confext.raw + are packed up in a cpio archive and placed in the /.extra/global_confext/ + directory in the initrd file hierarchy. This is supposed to be used to pass additional global configuration + extension images to the initrd. See systemd-confext8 for details on configuration extension images. The generated cpio archive containing these configuration extension images is measured into TPM PCR 12 (if a TPM is present). @@ -676,6 +694,16 @@ + + /.extra/global_sysext/*.sysext.raw + Similarly, system extension image files (suffix .sysext.raw) that + are placed in the /loader/extensions/ directory in the file system the unified + kernel image is placed in are copied into the /.extra/global_sysext/ + directory in the initrd execution environment. + + + + /.extra/confext/*.confext.raw Configuration extension image files (suffix .confext.raw) that are @@ -685,6 +713,16 @@ + + /.extra/global_confext/*.confext.raw + Similarly, configuration extension image files (suffix .confext.raw) + that are placed in the /loader/extensions/ directory in the file system the unified + kernel image is placed in are copied into the /.extra/global_confext/ + directory in the initrd execution environment. + + + + /.extra/tpm2-pcr-signature.json The TPM2 PCR signature JSON object included in the .pcrsig PE diff --git a/src/boot/stub.c b/src/boot/stub.c index 301d7a1cc9f..8354be3583f 100644 --- a/src/boot/stub.c +++ b/src/boot/stub.c @@ -38,7 +38,9 @@ enum { INITRD_CREDENTIAL = _INITRD_DYNAMIC_FIRST, INITRD_GLOBAL_CREDENTIAL, INITRD_SYSEXT, + INITRD_GLOBAL_SYSEXT, INITRD_CONFEXT, + INITRD_GLOBAL_CONFEXT, INITRD_PCRSIG, INITRD_PCRPKEY, INITRD_OSREL, @@ -869,6 +871,19 @@ static void generate_sidecar_initrds( &m) == EFI_SUCCESS) combine_measured_flag(sysext_measured, m); + if (pack_cpio(loaded_image, + u"\\loader\\extensions", + u".sysext.raw", + /* exclude_suffix= */ NULL, + ".extra/global_sysext", + /* dir_mode= */ 0555, + /* access_mode= */ 0444, + /* tpm_pcr= */ TPM2_PCR_SYSEXTS, + u"Global system extension initrd", + initrds + INITRD_GLOBAL_SYSEXT, + &m) == EFI_SUCCESS) + combine_measured_flag(sysext_measured, m); + if (pack_cpio(loaded_image, /* dropin_dir= */ NULL, u".confext.raw", @@ -881,6 +896,19 @@ static void generate_sidecar_initrds( initrds + INITRD_CONFEXT, &m) == EFI_SUCCESS) combine_measured_flag(confext_measured, m); + + if (pack_cpio(loaded_image, + u"\\loader\\extensions", + u".confext.raw", + /* exclude_suffix= */ NULL, + ".extra/global_confext", + /* dir_mode= */ 0555, + /* access_mode= */ 0444, + /* tpm_pcr= */ TPM2_PCR_KERNEL_CONFIG, + u"Global configuration extension initrd", + initrds + INITRD_GLOBAL_CONFEXT, + &m) == EFI_SUCCESS) + combine_measured_flag(confext_measured, m); } static void generate_embedded_initrds(