diff --git a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch new file mode 100644 index 00000000000..b7f942f6940 --- /dev/null +++ b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch @@ -0,0 +1,25 @@ +From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001 +From: Mayank Singh +Date: Thu, 13 Aug 2026 00:00:00 +0000 +Subject: [PATCH] decrypt-root: order unlock before root-device wait + +Keep Ignition's disks stage ahead of root decryption because it can provision +LUKS volumes, then decrypt ROOT before initramfs waits for the root device. +--- + dracut/31decrypt-root/decrypt-root.service | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service +index 54f941a..226d3d3 100644 +--- a/dracut/31decrypt-root/decrypt-root.service ++++ b/dracut/31decrypt-root/decrypt-root.service +@@ -4,5 +4,7 @@ Description=Generate and execute a systemd-cryptsetup service to decrypt the ROOT partition + DefaultDependencies=no ++# Decrypt ROOT before initramfs waits for it. ++Before=initrd-root-device.target + # If systemd-networkd.service is used in the initramfs, then we should run after it, since the ROOT partition + # might use network-bound encryption. + After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service + Wants=dev-disk-by\x2dpartlabel-ROOT.device +-- +2.43.0 diff --git a/acl/SPECS/bootengine/bootengine.spec b/acl/SPECS/bootengine/bootengine.spec index 96b36ce0395..90a943f7006 100644 --- a/acl/SPECS/bootengine/bootengine.spec +++ b/acl/SPECS/bootengine/bootengine.spec @@ -2,7 +2,7 @@ Name: bootengine Version: 0.0.38 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Flatcar bootengine dracut modules and helper utilities License: BSD-2-Clause @@ -12,6 +12,7 @@ URL: https://github.com/flatcar/bootengine Source0: https://github.com/flatcar/bootengine/archive/%{commit_hash}.tar.gz#/%{name}-%{version}.tar.gz Patch0: 0001-modify-tests.patch Patch1: 0002-delete-UKI-firstboot-addon-after-Ignition.patch +Patch2: 0003-decrypt-root-fix-firstboot-ordering.patch BuildArch: noarch BuildRequires: dracut Requires: util-linux @@ -72,6 +73,10 @@ chmod +x \ %{_sbindir}/update-bootengine %changelog +* Thu Aug 13 2026 Mayank Singh - 0.0.38-3 +- decrypt-root: run after Ignition disk provisioning and before initramfs waits + for the encrypted root device. + * Tue May 06 2026 Lanze Liu - 0.0.38-2 - Update firstboot addon removal to use glob pattern for UAPI UKI naming diff --git a/build_library/rpm/additional_files/99-acl.conf b/build_library/rpm/additional_files/99-acl.conf index 8720ba0f174..b40b74dedd5 100644 --- a/build_library/rpm/additional_files/99-acl.conf +++ b/build_library/rpm/additional_files/99-acl.conf @@ -34,6 +34,11 @@ install_items+=" /usr/sbin/dmsetup " # Cryptsetup libraries (required for veritysetup and crypt module) install_items+=" /usr/lib/libcryptsetup.so.12 /usr/lib64/libcryptsetup.so.12 " install_items+=" /usr/sbin/cryptsetup " +# TPM2 libs for LUKS root auto-unlock. systemd-cryptsetup dlopen()s these at +# runtime, so dracut's ldd scan misses them and so we are adding them. +install_items+=" /usr/lib64/libtss2-esys.so.0 /usr/lib64/libtss2-sys.so.1 " +install_items+=" /usr/lib64/libtss2-mu.so.0 /usr/lib64/libtss2-rc.so.0 " +install_items+=" /usr/lib64/libtss2-tctildr.so.0 /usr/lib64/libtss2-tcti-device.so.0 " # dm-verity tool install_items+=" /usr/sbin/veritysetup " # systemd-veritysetup binary (dracut should include it via module, but be explicit) diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp new file mode 100755 index 00000000000..8a72a102f4a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp @@ -0,0 +1,16 @@ +#!/bin/bash + +set -euo pipefail + +config_dir="/run/chrony-azure/conf.d" +config_file="${config_dir}/azure-ptp.conf" + +install -d -m 0755 "${config_dir}" + +if [[ -e /dev/ptp_hyperv ]]; then + printf '%s\n' \ + 'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer' \ + > "${config_file}" +else + rm -f "${config_file}" +fi diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf index 9e2fd604a58..8b9dbee05a3 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf @@ -1,4 +1,6 @@ -# This should only be used when chronyd is configured to use the /dev/ptp_hyperv device [Unit] -Wants=dev-ptp_hyperv.device +# Order after the PTP device if present without waiting for it when unavailable. After=dev-ptp_hyperv.device + +[Service] +ExecStartPre=-/usr/libexec/chrony-azure-ptp diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf index b5714071aff..c0aa93f1ca7 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf @@ -5,19 +5,8 @@ # Include configuration files found in /etc/chrony/conf.d. confdir /etc/chrony/conf.d -# This will use (up to): -# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well -# - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm) -# This means by default, up to 2 dual-stack and up to 3 additional IPv4-only -# sources will be used. -# At the same time it retains some protection against one of the entries being -# down (compare to just using one of the lines). -# -# See http://www.pool.ntp.org/join.html for more information. -#pool 0.flatcar.pool.ntp.org iburst maxsources 1 -#pool 1.flatcar.pool.ntp.org iburst maxsources 1 -#pool 2.flatcar.pool.ntp.org iburst maxsources 2 -#pool 3.flatcar.pool.ntp.org iburst maxsources 1 +# Include runtime configuration generated for Azure platform devices. +confdir /run/chrony-azure/conf.d # Use time sources from DHCP. sourcedir /run/chrony-dhcp @@ -25,6 +14,9 @@ sourcedir /run/chrony-dhcp # Use NTP sources found in /etc/chrony/sources.d. sourcedir /etc/chrony/sources.d +# Retain the Azure Linux 3.0 public fallback. +server time.windows.com iburst + # This directive specify the location of the file containing ID/key pairs for # NTP authentication. #keyfile /etc/chrony/chrony.keys @@ -58,8 +50,5 @@ makestep 1.0 -1 # leap-smeared time. leapsectz right/UTC -# Azure hosts are synchronized to internal Microsoft time servers -# that take their time from Microsoft-owned Stratum 1 devices. -# The Hyper-V drivers surface this time source as a PTP-based -# time source in the guest. This configures chrony to use it. -refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 +# /run/chrony-azure/conf.d/azure-ptp.conf is generated before chronyd starts when +# the Hyper-V PTP device is available. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh index c8c243fa20e..529a6d071eb 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh @@ -55,23 +55,44 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then sed -i \ 's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \ "${rootfs}/usr/lib/systemd/system/chronyd.service" + + # Azure Linux adds this command, but its chrony-helper does not implement it, + # leaving chronyd failed after a clean stop. + if ! grep -qE '^ExecStopPost=.*/chrony-helper remove-daemon-state$' \ + "${rootfs}/usr/lib/systemd/system/chronyd.service"; then + echo "ERROR: expected chrony-helper remove-daemon-state line not found" >&2 + exit 1 + fi + sed -i \ + '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \ + "${rootfs}/usr/lib/systemd/system/chronyd.service" fi # Copy Azure-optimized chrony.conf from this directory. # Overwrites the RPM default that manglefs already moved from /etc. -# Key differences: makestep 1.0 -1 (always-step), PTP refclock for Hyper-V clock. +# Key differences: always-step, network fallback, and optional Hyper-V PTP. # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf if [[ -f "${script_dir}/chrony.conf" ]]; then cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf" fi -# chronyd.service drop-in (Wants/After dev-ptp_hyperv.device) -if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then - mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d" - cp "${script_dir}/chrony-hyperv.conf" \ - "${rootfs}/usr/lib/systemd/system/chronyd.service.d/" +# Generate the optional Hyper-V PTP source before chronyd starts. +if [[ ! -f "${script_dir}/chrony-azure-ptp" ]]; then + echo "ERROR: missing ${script_dir}/chrony-azure-ptp" >&2 + exit 1 +fi +install -D -m 0755 "${script_dir}/chrony-azure-ptp" \ + "${rootfs}/usr/libexec/chrony-azure-ptp" + +# chronyd.service drop-in for optional Hyper-V PTP configuration. +if [[ ! -f "${script_dir}/chrony-hyperv.conf" ]]; then + echo "ERROR: missing ${script_dir}/chrony-hyperv.conf" >&2 + exit 1 fi +mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d" +cp "${script_dir}/chrony-hyperv.conf" \ + "${rootfs}/usr/lib/systemd/system/chronyd.service.d/" # Chrony tmpfiles: /var/lib/chrony dir + /etc/chrony.keys copy-on-boot if [[ -f "${script_dir}/var-chrony.conf" ]]; then