From d73dec3dd0d9b4b95e8957e504bda596d1e843c2 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 1 Jul 2026 01:02:41 +0000 Subject: [PATCH 1/3] Try to lock the crypt device around FS creation --- .../guestos/init/setup-encryption/setup-var-encryption.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh index b40274766c5a..c4413d110463 100755 --- a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh +++ b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh @@ -39,7 +39,7 @@ else /opt/ic/bin/guest_disk crypt-format var "$VAR_PARTITION" /opt/ic/bin/guest_disk crypt-open var "$VAR_PARTITION" echo "Populating /var filesystem in ${VAR_PARTITION} on first boot." - mkfs.ext4 -F /dev/mapper/var_crypt -d /var + udevadm lock --device=/dev/mapper/var_crypt mkfs.ext4 -F /dev/mapper/var_crypt -d /var # Fix root inode (mkfs fails to set correct security context). echo "ea_set / security.selinux system_u:object_r:var_t:s0\\000" | debugfs -w /dev/mapper/var_crypt From ae66e9b934b82af8566bcc16f2af1f3b3dad86bb Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 1 Jul 2026 22:30:44 +0000 Subject: [PATCH 2/3] Add an explicit settle, and fixup ordering --- .../guestos/init/setup-encryption/setup-var-encryption.sh | 2 ++ ic-os/components/upgrade/systemd-generators/mount-generator | 1 + 2 files changed, 3 insertions(+) diff --git a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh index c4413d110463..afb905c2ceea 100755 --- a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh +++ b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh @@ -80,4 +80,6 @@ else # and continue operating. cryptsetup luksClose old_var_crypt || echo "Failed to close old /var crypto partition" fi + + udevadm trigger --settle --action=change /dev/mapper/var_crypt fi diff --git a/ic-os/components/upgrade/systemd-generators/mount-generator b/ic-os/components/upgrade/systemd-generators/mount-generator index 0b3cd0822faa..463a5b68fe9c 100644 --- a/ic-os/components/upgrade/systemd-generators/mount-generator +++ b/ic-os/components/upgrade/systemd-generators/mount-generator @@ -134,6 +134,7 @@ function make_var_cryptsetup() { echo "Before=blockdev@dev-mapper-var_crypt.target" echo "Wants=blockdev@dev-mapper-var_crypt.target" echo "Before=var.mount" + echo "Before=systemd-fsck@dev-mapper-var_crypt.service" echo "Conflicts=umount.target" echo "Before=cryptsetup.target" echo "Requires=init-config.service" From 97708b205b0ea981f31440c358b8aa65d6196575 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 3 Jul 2026 18:16:52 +0000 Subject: [PATCH 3/3] PR comments --- .../guestos/init/setup-encryption/setup-var-encryption.sh | 2 ++ ic-os/components/upgrade/systemd-generators/mount-generator | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh index afb905c2ceea..c097deba79d4 100755 --- a/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh +++ b/ic-os/components/guestos/init/setup-encryption/setup-var-encryption.sh @@ -39,6 +39,7 @@ else /opt/ic/bin/guest_disk crypt-format var "$VAR_PARTITION" /opt/ic/bin/guest_disk crypt-open var "$VAR_PARTITION" echo "Populating /var filesystem in ${VAR_PARTITION} on first boot." + # Prevent udev from processing the device while we format it. udevadm lock --device=/dev/mapper/var_crypt mkfs.ext4 -F /dev/mapper/var_crypt -d /var # Fix root inode (mkfs fails to set correct security context). echo "ea_set / security.selinux system_u:object_r:var_t:s0\\000" | debugfs -w /dev/mapper/var_crypt @@ -81,5 +82,6 @@ else cryptsetup luksClose old_var_crypt || echo "Failed to close old /var crypto partition" fi + # Explicitly trigger udev now that the device should be ready. udevadm trigger --settle --action=change /dev/mapper/var_crypt fi diff --git a/ic-os/components/upgrade/systemd-generators/mount-generator b/ic-os/components/upgrade/systemd-generators/mount-generator index 463a5b68fe9c..0b3cd0822faa 100644 --- a/ic-os/components/upgrade/systemd-generators/mount-generator +++ b/ic-os/components/upgrade/systemd-generators/mount-generator @@ -134,7 +134,6 @@ function make_var_cryptsetup() { echo "Before=blockdev@dev-mapper-var_crypt.target" echo "Wants=blockdev@dev-mapper-var_crypt.target" echo "Before=var.mount" - echo "Before=systemd-fsck@dev-mapper-var_crypt.service" echo "Conflicts=umount.target" echo "Before=cryptsetup.target" echo "Requires=init-config.service"