core: make `/run/systemd/first-boot` available earlier

For the new systemd.credentials_boot_policy= setting we need
to be able to differenciate if its a firstboot or not early.

But `manager_set_first_boot` is run after `initialize_runtime()`
which imports the credentials. So we need to touch the file
so that the credentials_boot_policy setting can work.

Unfortunately we cannot just move manager_set_first_boot() earlier
because there is no manager yet at this point.

diff --git a/src/core/main.c b/src/core/main.c
index 5c02e30880068e054b5af591d1e67a6355571502..11c7f6fad88e76ea5644eaf51a775ec84ddb1699 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2614,6 +2614,11 @@ static void log_execution_mode(bool *ret_first_boot) {
                         }
                 }
 
+                /* Make the first-boot file visible now: the credential import
+                 * consults in_first_boot() for systemd.credentials_boot_policy= which runs
+                 * before the manager object is created. */
+                (void) update_first_boot_file(first_boot);
+
                 assert_se(uname(&uts) >= 0);
 
                 if (strverscmp_improved(uts.release, KERNEL_BASELINE_VERSION) < 0)

diff --git a/src/core/manager.c b/src/core/manager.c
index 27ca84c4e9e75ab0740e7a16f0dc56771cc69675..f5daa59e1abf440dbe8d15f2e9b98e960675b141 100644 (file)
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -4842,21 +4842,32 @@ fail:
 }
 
 void manager_set_first_boot(Manager *m, bool b) {
+        int r;
+
         assert(m);
 
         if (!MANAGER_IS_SYSTEM(m))
                 return;
 
         if (m->first_boot != (int) b) {
-                if (b)
-                        (void) touch("/run/systemd/first-boot");
-                else
-                        (void) unlink("/run/systemd/first-boot");
+                r = update_first_boot_file(b);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to update the first-boot file, ignoring: %m");
         }
 
         m->first_boot = b;
 }
 
+int update_first_boot_file(bool b) {
+        if (b)
+                return touch("/run/systemd/first-boot");
+
+        if (unlink("/run/systemd/first-boot") < 0 && errno != ENOENT)
+                return -errno;
+
+        return 0;
+}
+
 void manager_disable_confirm_spawn(void) {
         (void) touch("/run/systemd/confirm_spawn_disabled");
 }

diff --git a/src/core/manager.h b/src/core/manager.h
index 8262bfbec85975167f02928cb0c4196b3af38008..12d6cf44709d5a4fc99856d055768b61e20c3ce1 100644 (file)
--- a/src/core/manager.h
+++ b/src/core/manager.h
@@ -719,6 +719,8 @@ void manager_log_caller(Manager *manager, PidRef *caller, const char *method);
 
 int manager_allocate_idle_pipe(Manager *m);
 
+int update_first_boot_file(bool b);
+
 void unit_defaults_init(UnitDefaults *defaults, RuntimeScope scope);
 void unit_defaults_done(UnitDefaults *defaults);