diff --git a/ic-os/components/early-boot/fstab/fstab-guestos b/ic-os/components/early-boot/fstab/fstab-guestos index 1c3d2a5210e4..b780b33424d7 100644 --- a/ic-os/components/early-boot/fstab/fstab-guestos +++ b/ic-os/components/early-boot/fstab/fstab-guestos @@ -3,8 +3,7 @@ tmpfs /tmp tmpfs defaults 0 2 /dev/disk/by-partuuid/b78084e2-3363-1346-8c25-d426f26b8928 /boot/efi vfat defaults 0 2 /dev/disk/by-partuuid/6788e4cf-f456-104e-9a34-a2c58cfb0ee6 /boot/grub vfat defaults 0 2 /dev/disk/by-partuuid/a5ba3816-beaa-d74d-993e-cfa5aa6ba1f6 /boot/config ext4 defaults,sync 0 2 -# Remove the BindsTo on the underlying crypt device. We suspect the device flapping in udev can lead to the mount locking up. -/dev/mapper/var_crypt /var ext4 defaults,x-systemd.device-bound=false 0 2 +/dev/mapper/var_crypt /var ext4 defaults 0 2 # If you add a new mount that depends on /dev/mapper/store, don't forget to add it to maybe-disable-store-mounts.service /dev/mapper/store-shared--backup /var/lib/ic/backup ext4 defaults,context=system_u:object_r:ic_data_t:s0 0 2 /dev/mapper/store-shared--crypto /var/lib/ic/crypto ext4 defaults 0 2 diff --git a/ic-os/components/guestos.bzl b/ic-os/components/guestos.bzl index 84e05d0e233b..ca907f5bb95b 100644 --- a/ic-os/components/guestos.bzl +++ b/ic-os/components/guestos.bzl @@ -64,7 +64,6 @@ def component_files(mode): Label("guestos/init/setup-encryption/setup-data-encryption.sh"): "/opt/ic/bin/setup-data-encryption.sh", Label("guestos/init/setup-encryption/setup-data-encryption.service"): "/etc/systemd/system/setup-data-encryption.service", Label("guestos/init/setup-encryption/setup-var-encryption.sh"): "/opt/ic/bin/setup-var-encryption.sh", - Label("guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service"): "/etc/systemd/system/systemd-fsck@dev-mapper-var_crypt.service", Label("guestos/init/setup-lvs/setup-lvs.service"): "/etc/systemd/system/setup-lvs.service", Label("guestos/init/setup-lvs/setup-lvs.sh"): "/opt/ic/bin/setup-lvs.sh", Label("guestos/init/cleanup-config-bootstrap/cleanup-config-bootstrap.service"): "/etc/systemd/system/cleanup-config-bootstrap.service", diff --git a/ic-os/components/guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service b/ic-os/components/guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service deleted file mode 100644 index db2a4757091f..000000000000 --- a/ic-os/components/guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service +++ /dev/null @@ -1,19 +0,0 @@ -# This unit is overridden to replace the BindsTo on the underlying crypt device -# with Requires. Otherwise, it is the same as the systemd generated default. We -# suspect the device flapping in udev can lead to the mount locking up. - -[Unit] -Description=File System Check on /dev/mapper/var_crypt -Documentation=man:systemd-fsck@.service(8) -DefaultDependencies=no -Requires=dev-mapper-var_crypt.device -Conflicts=shutdown.target -Wants=systemd-fsckd.socket -After=dev-mapper-var_crypt.device systemd-fsck-root.service local-fs-pre.target systemd-fsckd.socket -Before=systemd-quotacheck.service shutdown.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/lib/systemd/systemd-fsck /dev/mapper/var_crypt -TimeoutSec=infinity diff --git a/ic-os/components/upgrade/systemd-generators/mount-generator b/ic-os/components/upgrade/systemd-generators/mount-generator index 0b3cd0822faa..c6eb6523cacf 100644 --- a/ic-os/components/upgrade/systemd-generators/mount-generator +++ b/ic-os/components/upgrade/systemd-generators/mount-generator @@ -130,10 +130,12 @@ function make_var_cryptsetup() { echo "Description=Cryptography Setup for var_crypt" echo "DefaultDependencies=no" echo "IgnoreOnIsolate=true" - echo "After=cryptsetup-pre.target" + echo "After=cryptsetup-pre.target systemd-udevd-kernel.socket" echo "Before=blockdev@dev-mapper-var_crypt.target" echo "Wants=blockdev@dev-mapper-var_crypt.target" echo "Before=var.mount" + # Run fsck after we are done, since we also create the FS in this generated unit + echo "Before=systemd-fsck@dev-mapper-var_crypt.service" echo "Conflicts=umount.target" echo "Before=cryptsetup.target" echo "Requires=init-config.service" @@ -141,7 +143,7 @@ function make_var_cryptsetup() { echo "Wants=ic-node-tmpfiles.service" echo "After=ic-node-tmpfiles.service" # needed for metrics # We need /boot/config for the decryption key (unless SEV is enabled) - echo "RequiresMountsFor=/boot/config" + echo "RequiresMountsFor=/boot/config/store.keyfile" echo "BindsTo=${SYSTEMD_DEVICE}" echo "After=${SYSTEMD_DEVICE}" echo "Before=umount.target" @@ -149,18 +151,17 @@ function make_var_cryptsetup() { echo "[Service]" echo "Type=oneshot" echo "RemainAfterExit=yes" - echo "TimeoutSec=0" + echo "TimeoutSec=infinity" echo "KeyringMode=shared" + echo "OOMScoreAdjust=500" echo "ExecStart=/opt/ic/bin/setup-var-encryption.sh /dev/disk/by-partuuid/${PARTUUID} /dev/disk/by-partuuid/${ALT_PARTUUID}" echo "ExecStop=/lib/systemd/systemd-cryptsetup detach var_crypt" - echo "StandardOutput=journal+console" - echo "StandardError=journal+console" } CURRENT_SYSTEM=$(get_boot_arg_value dfinity.system) make_boot_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/boot.mount -make_requires localfs.target boot.mount +make_requires local-fs.target boot.mount make_requires boot-efi.mount boot.mount make_requires boot-grub.mount boot.mount @@ -170,4 +171,5 @@ if [ "$OS_TYPE" == "hostos" ]; then else make_var_cryptsetup "$CURRENT_SYSTEM" >"$UNIT_DIR"/systemd-cryptsetup@var_crypt.service make_requires dev-mapper-var_crypt.device systemd-cryptsetup@var_crypt.service + make_requires cryptsetup.target systemd-cryptsetup@var_crypt.service fi