From ab0ffca1308240455d6d423490300ea53b873f59 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 24 Aug 2025 20:51:23 +0100 Subject: [PATCH] repart: do not fail when CopyBlocks= is used in the initrd When running in the initrd --root= is automatically set to /sysroot or /sysusr but then using CopyBlocks fails due to a security measure: root@particle-caba-1e47:~# systemd-repart --dry-run=no /dev/vda No machine ID set, using randomized partition UUIDs. Automatic discovery of backing block devices not permitted in --root= mode, refusing. Follow-up for 5c08da586fc8fe7cda4010e0057cb79ba1d74335 --- src/repart/repart.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/repart/repart.c b/src/repart/repart.c index a1c49b3b02f..0dae3f8610a 100644 --- a/src/repart/repart.c +++ b/src/repart/repart.c @@ -202,6 +202,7 @@ static AppendMode arg_append_fstab = APPEND_NO; static char *arg_generate_fstab = NULL; static char *arg_generate_crypttab = NULL; static Set *arg_verity_settings = NULL; +static bool arg_relax_copy_block_security = false; STATIC_DESTRUCTOR_REGISTER(arg_node, freep); STATIC_DESTRUCTOR_REGISTER(arg_root, freep); @@ -8737,6 +8738,9 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY * r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_image); if (r < 0) return r; + + arg_relax_copy_block_security = false; + break; case ARG_IMAGE_POLICY: @@ -9157,6 +9161,8 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY * arg_root = strdup("/sysusr"); if (!arg_root) return log_oom(); + + arg_relax_copy_block_security = true; } if (argc > optind) { @@ -9831,7 +9837,9 @@ static int run(int argc, char *argv[]) { r = context_open_copy_block_paths( context, loop_device ? loop_device->devno : /* if --image= is specified, only allow partitions on the loopback device */ - arg_root && !arg_image ? 0 : /* if --root= is specified, don't accept any block device */ + /* if --root= is specified, don't accept any block device, unless it + * was set automatically because we are in the initrd */ + arg_root && !arg_image && !arg_relax_copy_block_security ? 0 : (dev_t) -1); /* if neither is specified, make no restrictions */ if (r < 0) return r; -- 2.47.3