Instead of passing namespace and defaults everywhere, have every
nested function operate on the function global object and simply reset
the objects to the copy we took after we finish parsing a single image
definition.
Daan De Meyer [Sun, 31 Mar 2024 17:54:22 +0000 (19:54 +0200)]
Add ForwardJournal= to enable log forwarding of VMs and containers
In systemd v256, journald will support forwarding to systemd-journal-remote
via the new journal.forward_to_socket credential. Let's expose this
functionality via a new ForwardJournal= setting, which specifies a path to
which logs should be forwarded.
Daan De Meyer [Wed, 27 Mar 2024 22:48:36 +0000 (23:48 +0100)]
Support mkosi ssh for multiple running instances of the same image
Let's add a stopgap solution until systemd-machined supports everything
we need. We maintain a super basic JSON state file in the runtime directory
that is used to map a machine name to the corresponding SSH proxy command.
We also store the path to the ssh key in there so that mkosi ssh can be
run from every directory.
The new Machine= option allows selecting the machine name to use. Unless
set explicitly, we also use the machine name as the hostname for the machine.
Daan De Meyer [Wed, 27 Mar 2024 13:43:58 +0000 (14:43 +0100)]
Add CleanScripts=
Clean scripts can be used to remove any outputs that mkosi doesn't
know about, e.g. packages built in mkosi build scripts and copied
to the output directory.
Daan De Meyer [Wed, 27 Mar 2024 10:25:08 +0000 (11:25 +0100)]
Extension image fixes
- Insist on /usr/lib/os-release existing and read only from it instead
of /etc/os-release
- Don't fail if /usr/lib/os-release doesn't exist when building a sysext
or confext.
- Skip more operations when building sysext/confext images
Daan De Meyer [Tue, 26 Mar 2024 11:17:51 +0000 (12:17 +0100)]
Switch back to debian testing
unstable breaks too much to be useful for CI. To keep CI green, we
stop installing pacman-package-manager in the default images and disable
debian tools tree in CI.
Daan De Meyer [Mon, 25 Mar 2024 11:22:12 +0000 (12:22 +0100)]
kernel-install: Don't copy pacman gpg sockets
These should be created in /run but gpg's logic for that is broken
for the root user (it checks for /run/user/0 which will never exist)
so the sockets are created in the gpg home dir (/etc/pacman.d/gnupg)
instead. Let's make sure we don't try to copy those as they cause issues
with cp -R.
Daan De Meyer [Mon, 25 Mar 2024 10:24:04 +0000 (11:24 +0100)]
Only do CAP_NET_ADMIN capability check when running as root
If we're not running as root, bubblewrap will unshare a user namespace
in which it gets a full set of capabilities, even if the user on the
host doesn't have them, so let's only do the CAP_NET_ADMIN check if
we're running as root.
Daan De Meyer [Mon, 25 Mar 2024 10:20:58 +0000 (11:20 +0100)]
Improve home directory detection
If we're invoked as root from a home directory, always use that as
the user's home directory instead of trying to detect it ourselves, this
makes sure we use the right home directory even when we're invoked in a
user namespace.
Daan De Meyer [Thu, 21 Mar 2024 18:59:24 +0000 (19:59 +0100)]
Remove setuid/setgid bits from build and workspace directory
Both of these can be inherited so remove them from both the workspace
and the build directory where inheriting these bits could end up
leaking stuff from the host into the image.
Also remove INVOKING_USER.mkdir() while we're at it as only one user
was remaining which we can do much more easily by doing the logic
before we go into the user namespace.
Daan De Meyer [Thu, 21 Mar 2024 12:35:01 +0000 (13:35 +0100)]
Only set extra_groups for mkdir() if we were invoked as root
The extra groups of the user are not mapped into the user namespace
we create and as such can't be set when invoking a subprocess if
we weren't invoked as root.
Daan De Meyer [Thu, 21 Mar 2024 11:13:05 +0000 (12:13 +0100)]
Explicitly set mode of workspace to 700
If the sticky bit is set on the parent directory of the workspace,
it's inherited by the workspace directory and then inherited by the
image root directory and infects the entire image. Let's make sure
it is not set on the workspace directory to avoid leaking host specific
details into the image.
Daan De Meyer [Thu, 21 Mar 2024 10:32:27 +0000 (11:32 +0100)]
Add proxy settings
These allow using mkosi behind a proxy that requires proxy authentication.
Only dnf seems to allow specifying these certificates as individual settings
so other package managers are not fully supported for now.
We mount the proxy certificates and keys to /proxy.xxx in the sandbox because
otherwise they might end up being mounted at the same location as the certificates
from the tools tree, which means those wouldn't be used.
Daan De Meyer [Wed, 20 Mar 2024 08:57:26 +0000 (09:57 +0100)]
Mount pkgmngr/etc as a whole instead of individual files in it.
We stopped doing this because bubblewrap would create the /etc/mtab
in the package manager tree /etc and leave it there after exiting,
which would cause bubblewrap to fail the next time we executed it as
the symlink already existed.
To avoid reintroducing this issue, we only have bubblewrap create the
symlink if nothing's going to be mounted to /etc and create the symlink
ourselves in the pkgmngr/etc.
These changes also make sure that the mounts from finalize_passwd_mounts()
take precedence over the passwd and group files from pkgmngr/etc.
Daan De Meyer [Wed, 20 Mar 2024 08:13:16 +0000 (09:13 +0100)]
Only set some environment variables when invoking package managers
We really only want to set KERNEL_INSTALL_BYPASS and
SYSTEMD_HWDB_UPDATE_BYPASS when we're invoking package managers so
let's make sure those are only set when invoking package managers.
Let's also allow users to override both all of these and let's not
set them when Bootable=no so distros can do whatever they want if
mkosi's bootable image logic is not being used.
Richard Maw [Tue, 19 Mar 2024 18:02:33 +0000 (18:02 +0000)]
Relax mkdir/rchown subpath of home check to owns a parent dir
"the user owns a parent directory" is a lot less strict than
being under the home directory, but allows using shared directories
that are not mounted under home, and at least requires some explicit config
to create the directory before it can be used
rather than just being any directory the user is able to create.
Richard Maw [Tue, 19 Mar 2024 17:57:05 +0000 (17:57 +0000)]
Set extra groups in INVOKING_USER.mkdir
If a parent directory of the path to create isn't traversable
then mkdir will fail to create the directory even if the immediate parent
exists and has the correct permissions.
This can happen in shared development hardware where storage is allocated
using a directory with a common unix group e.g.
$ ls -ld /data
drwxrws--- 4 root devgroup 4096 Mar 12 17:11 /data
projects / thirdparty / mkosi.git / log
