From 2181f67a2af8b1d34629151fe8b09ae834ebf7c4 Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Oct 15 2024 11:30:13 +0000 Subject: [PATCH 1/2] bootupd: Trigger a bootloader update on boot See: https://gitlab.com/fedora/ostree/sig/-/issues/1 See: https://github.com/coreos/bootupd/pull/716 --- diff --git a/bootupd.yaml b/bootupd.yaml index 85e740b..f1692b2 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -8,5 +8,25 @@ postprocess: - | #!/bin/bash set -xeuo pipefail + # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload /usr/bin/bootupctl backend generate-update-metadata + + # Trigger a bootloader update on boot + cat > /usr/lib/systemd/system/bootloader-update.service << 'EOF' + [Unit] + Description=Update bootloader on boot + Documentation=https://github.com/coreos/bootupd + ConditionFirmware=uefi + + [Service] + Type=oneshot + ExecStart=/usr/bin/bootupctl update + RemainAfterExit=yes + MountFlags=slave + + [Install] + WantedBy=multi-user.target + EOF + chmod 644 /usr/lib/systemd/system/bootloader-update.service + echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-atomic-desktop.preset From c4e12e11a61044262280ad8991735113a5686fbc Mon Sep 17 00:00:00 2001 From: Timothée Ravier Date: Oct 15 2024 11:30:13 +0000 Subject: [PATCH 2/2] bootupd: Put in permissive until SELinux issues are fixed See: https://github.com/coreos/bootupd/issues/694 See: https://github.com/fedora-selinux/selinux-policy/issues/2334 See: https://github.com/fedora-selinux/selinux-policy/issues/2341 See: https://github.com/fedora-selinux/selinux-policy/issues/2362 --- diff --git a/bootupd.yaml b/bootupd.yaml index f1692b2..9e6b6fa 100644 --- a/bootupd.yaml +++ b/bootupd.yaml @@ -30,3 +30,6 @@ postprocess: EOF chmod 644 /usr/lib/systemd/system/bootloader-update.service echo "enable bootloader-update.service" > /usr/lib/systemd/system-preset/81-atomic-desktop.preset + + # Turn permissive mode on for bootupd until all SELinux issues are fixed + semanage permissive --noreload --add bootupd_t