[All] Changes to the overlay system to get rootless podman to work

buildroot-external/board/ovos/ova/genimage-ova.cfg

@@ -16,6 +16,14 @@ image overlayfs.ext4 {
   ext4 {
     use-mke2fs = "true"
   }
+  size = 256M
+}
+
+image homefs.ext4 {
+  name = "homefs"
+  ext4 {
+    use-mke2fs = "true"
+  }
   size = 64M
 }
 
@@ -52,4 +60,10 @@ image disk.img {
     partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
     image = "overlayfs.ext4"
   }
+
+  partition homefs {
+    partition-uuid = ba3c2691-cce9-4963-b773-42c440c235ec
+    partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
+    image = "homefs.ext4"
+  }
 }

buildroot-external/board/ovos/ova/grub-efi.cfg

@@ -12,7 +12,7 @@ set menu_color_highlight=white/red
 
 load_env
 
-default_cmdline="rootfstype=squashfs init=/sbin/pre-init systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=tty1 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait"
+default_cmdline="rootfstype=squashfs systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=console consoleblank=0 loglevel=0 vt.global_cursor_default=0 logo.nologo systemd.show_status=0 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait quiet splash"
 file_env -f ($root)/cmdline.txt cmdline
 
 regexp --set 1:boothd (.+),.+ ${root}

buildroot-external/board/ovos/raspberrypi/grub-efi.cfg

@@ -12,7 +12,7 @@ set menu_color_highlight=white/red
 
 load_env
 
-default_cmdline="rootfstype=squashfs init=/sbin/pre-init systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=tty1 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait"
+default_cmdline="rootfstype=squashfs systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=console consoleblank=0 loglevel=0 vt.global_cursor_default=0 logo.nologo systemd.show_status=0 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait quiet splash"
 file_env -f ($root)/cmdline.txt cmdline
 
 regexp --set 1:boothd (.+),.+ ${root}

buildroot-external/board/ovos/raspberrypi/rpi4/genimage-rpi4.cfg

@@ -23,6 +23,14 @@ image overlayfs.ext4 {
   ext4 {
     use-mke2fs = "true"
   }
+  size = 256M
+}
+
+image homefs.ext4 {
+  name = "homefs"
+  ext4 {
+    use-mke2fs = "true"
+  }
   size = 64M
 }
 
@@ -58,4 +66,10 @@ image disk.img {
     partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
     image = "overlayfs.ext4"
   }
+
+  partition homefs {
+    partition-uuid = ba3c2691-cce9-4963-b773-42c440c235ec
+    partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
+    image = "homefs.ext4"
+  }
 }

buildroot-external/configs/ova_64_defconfig

@@ -13,9 +13,7 @@ BR2_TARGET_GENERIC_HOSTNAME="OpenVoiceOS"
 BR2_TARGET_GENERIC_ISSUE="Welcome to OpenVoiceOS"
 BR2_TARGET_GENERIC_PASSWD_SHA512=y
 BR2_INIT_SYSTEMD=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
-# BR2_TARGET_GENERIC_GETTY is not set
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
 BR2_SYSTEM_DHCP="eth0"
 # BR2_ENABLE_LOCALE_PURGE is not set
@@ -366,21 +364,15 @@ BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
 BR2_PACKAGE_WPA_SUPPLICANT_DBUS=y
 BR2_PACKAGE_CATATONIT=y
 BR2_PACKAGE_FILE=y
+BR2_PACKAGE_GNUPG=y
 BR2_PACKAGE_SCREEN=y
 BR2_PACKAGE_TIME=y
 BR2_PACKAGE_TINI=y
 BR2_PACKAGE_WHICH=y
 BR2_PACKAGE_ACL=y
 BR2_PACKAGE_AUDIT=y
-BR2_PACKAGE_BUILDAH=y
 BR2_PACKAGE_COREUTILS=y
-BR2_PACKAGE_DOCKER_CLI_BUILDX=y
-BR2_PACKAGE_DOCKER_COMPOSE=y
-BR2_PACKAGE_DOCKER_ENGINE=y
-BR2_PACKAGE_DOCKER_ENGINE_EXPERIMENTAL=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_BTRFS=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_DEVICEMAPPER=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_VFS=y
+BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_EFIBOOTMGR=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_OPENVMTOOLS=y
@@ -403,13 +395,16 @@ BR2_PACKAGE_SYSTEMD_FIRSTBOOT=y
 BR2_PACKAGE_SYSTEMD_HIBERNATE=y
 # BR2_PACKAGE_SYSTEMD_HWDB is not set
 BR2_PACKAGE_SYSTEMD_LOGIND=y
+BR2_PACKAGE_SYSTEMD_MACHINED=y
 BR2_PACKAGE_SYSTEMD_OOMD=y
+BR2_PACKAGE_SYSTEMD_POLKIT=y
 BR2_PACKAGE_SYSTEMD_RANDOMSEED=y
 BR2_PACKAGE_SYSTEMD_REPART=y
 BR2_PACKAGE_SYSTEMD_RFKILL=y
 # BR2_PACKAGE_SYSTEMD_VCONSOLE is not set
 BR2_PACKAGE_SYSTEMD_BOOTCHART=y
 BR2_PACKAGE_TAR=y
+BR2_PACKAGE_UTIL_LINUX_BINARIES=y
 BR2_PACKAGE_UTIL_LINUX_HWCLOCK=y
 BR2_PACKAGE_UTIL_LINUX_KILL=y
 BR2_PACKAGE_UTIL_LINUX_LOGGER=y
@@ -417,8 +412,9 @@ BR2_PACKAGE_UTIL_LINUX_LOGIN=y
 BR2_PACKAGE_UTIL_LINUX_LSMEM=y
 BR2_PACKAGE_UTIL_LINUX_MESG=y
 BR2_PACKAGE_UTIL_LINUX_MORE=y
-BR2_PACKAGE_UTIL_LINUX_NOLOGIN=y
+BR2_PACKAGE_UTIL_LINUX_MOUNTPOINT=y
 BR2_PACKAGE_UTIL_LINUX_PARTX=y
+BR2_PACKAGE_UTIL_LINUX_PIVOT_ROOT=y
 BR2_PACKAGE_UTIL_LINUX_SU=y
 BR2_PACKAGE_UTIL_LINUX_SULOGIN=y
 BR2_PACKAGE_UTIL_LINUX_SWITCH_ROOT=y
@@ -439,6 +435,6 @@ BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_MKPASSWD=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_PKGCONF=y
-BR2_PACKAGE_GROWDISK_SERVICE=y
 BR2_PACKAGE_HOSTNAME_SERVICE=y
 BR2_PACKAGE_NCPAMIXER=y
+BR2_PACKAGE_OVOS_SPLASH=y

buildroot-external/configs/rpi4_64_defconfig

@@ -14,9 +14,7 @@ BR2_TARGET_GENERIC_HOSTNAME="OpenVoiceOS"
 BR2_TARGET_GENERIC_ISSUE="Welcome to OpenVoiceOS"
 BR2_TARGET_GENERIC_PASSWD_SHA512=y
 BR2_INIT_SYSTEMD=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
-# BR2_TARGET_GENERIC_GETTY is not set
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
 BR2_SYSTEM_DHCP="eth0"
 # BR2_ENABLE_LOCALE_PURGE is not set
@@ -349,21 +347,15 @@ BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
 BR2_PACKAGE_WPA_SUPPLICANT_DBUS=y
 BR2_PACKAGE_CATATONIT=y
 BR2_PACKAGE_FILE=y
+BR2_PACKAGE_GNUPG=y
 BR2_PACKAGE_SCREEN=y
 BR2_PACKAGE_TIME=y
 BR2_PACKAGE_TINI=y
 BR2_PACKAGE_WHICH=y
 BR2_PACKAGE_ACL=y
 BR2_PACKAGE_AUDIT=y
-BR2_PACKAGE_BUILDAH=y
 BR2_PACKAGE_COREUTILS=y
-BR2_PACKAGE_DOCKER_CLI_BUILDX=y
-BR2_PACKAGE_DOCKER_COMPOSE=y
-BR2_PACKAGE_DOCKER_ENGINE=y
-BR2_PACKAGE_DOCKER_ENGINE_EXPERIMENTAL=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_BTRFS=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_DEVICEMAPPER=y
-BR2_PACKAGE_DOCKER_ENGINE_DRIVER_VFS=y
+BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_EFIBOOTMGR=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_OPENVMTOOLS=y
@@ -386,13 +378,16 @@ BR2_PACKAGE_SYSTEMD_FIRSTBOOT=y
 BR2_PACKAGE_SYSTEMD_HIBERNATE=y
 # BR2_PACKAGE_SYSTEMD_HWDB is not set
 BR2_PACKAGE_SYSTEMD_LOGIND=y
+BR2_PACKAGE_SYSTEMD_MACHINED=y
 BR2_PACKAGE_SYSTEMD_OOMD=y
+BR2_PACKAGE_SYSTEMD_POLKIT=y
 BR2_PACKAGE_SYSTEMD_RANDOMSEED=y
 BR2_PACKAGE_SYSTEMD_REPART=y
 BR2_PACKAGE_SYSTEMD_RFKILL=y
 # BR2_PACKAGE_SYSTEMD_VCONSOLE is not set
 BR2_PACKAGE_SYSTEMD_BOOTCHART=y
 BR2_PACKAGE_TAR=y
+BR2_PACKAGE_UTIL_LINUX_BINARIES=y
 BR2_PACKAGE_UTIL_LINUX_HWCLOCK=y
 BR2_PACKAGE_UTIL_LINUX_KILL=y
 BR2_PACKAGE_UTIL_LINUX_LOGGER=y
@@ -400,8 +395,9 @@ BR2_PACKAGE_UTIL_LINUX_LOGIN=y
 BR2_PACKAGE_UTIL_LINUX_LSMEM=y
 BR2_PACKAGE_UTIL_LINUX_MESG=y
 BR2_PACKAGE_UTIL_LINUX_MORE=y
-BR2_PACKAGE_UTIL_LINUX_NOLOGIN=y
+BR2_PACKAGE_UTIL_LINUX_MOUNTPOINT=y
 BR2_PACKAGE_UTIL_LINUX_PARTX=y
+BR2_PACKAGE_UTIL_LINUX_PIVOT_ROOT=y
 BR2_PACKAGE_UTIL_LINUX_SU=y
 BR2_PACKAGE_UTIL_LINUX_SULOGIN=y
 BR2_PACKAGE_UTIL_LINUX_SWITCH_ROOT=y
@@ -421,9 +417,9 @@ BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_MKPASSWD=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_PKGCONF=y
-BR2_PACKAGE_GROWDISK_SERVICE=y
 BR2_PACKAGE_HOSTNAME_SERVICE=y
 BR2_PACKAGE_NCPAMIXER=y
+BR2_PACKAGE_OVOS_SPLASH=y
 BR2_PACKAGE_RESPEAKER=y
 BR2_PACKAGE_USERLAND_TOOLS=y
 BR2_PACKAGE_VOCALFUSION=y

buildroot-external/rootfs-overlay/etc/pam.d/login

@@ -1,13 +0,0 @@
-auth		required	pam_unix.so nullok
-
-account		required	pam_unix.so
-
-password	required	pam_unix.so nullok
-
-# session	required	pam_selinux.so close
-session		required	pam_limits.so
-session		required	pam_env.so
-session		required	pam_unix.so
-session		optional	pam_lastlog.so
--session	optional	pam_systemd.so
-# session	required	pam_selinux.so open

buildroot-external/rootfs-overlay/etc/pam.d/other

@@ -0,0 +1,6 @@
+# This file is part of systemd.
+
+auth     include system-auth
+account  include system-auth
+password include system-auth
+session  include system-auth

buildroot-external/rootfs-overlay/etc/pam.d/system-auth

@@ -0,0 +1,23 @@
+# This file is part of systemd.
+
+# You really want to adjust this to your local distribution. If you use this
+# unmodified you are not building systems safely and securely.
+
+auth      sufficient pam_unix.so
+-auth     sufficient pam_systemd_home.so
+auth      required   pam_deny.so
+
+account   required   pam_nologin.so
+-account  sufficient pam_systemd_home.so
+account   sufficient pam_unix.so
+account   required   pam_permit.so
+
+-password sufficient pam_systemd_home.so
+password  sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
+password  required   pam_deny.so
+
+-session  optional   pam_keyinit.so revoke
+-session  optional   pam_loginuid.so
+-session  optional   pam_systemd_home.so
+-session  optional   pam_systemd.so
+session   required   pam_unix.so

buildroot-external/rootfs-overlay/usr/lib/systemd/system-preset/10-ovos.preset

@@ -1,4 +1,3 @@
-enable growdisk.service
 enable hostname.service
 enable sshd.service
 enable bluetooth.service

buildroot-external/rootfs-overlay/usr/lib/systemd/system/etc.mount

@@ -0,0 +1,15 @@
+[Unit]
+Description=etc persistent partition overlay
+Requires=mnt-overlay.mount
+After=mnt-overlay.mount
+Requires=ovos-overlay.service
+After=ovos-overlay.service
+
+[Mount]
+What=/mnt/overlay/etc
+Where=/etc
+Type=none
+Options=bind
+
+[Install]
+WantedBy=ovos-bind.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/home.mount

@@ -0,0 +1,15 @@
+[Unit]
+Description=home persistent partition overlay
+Requires=mnt-home.mount
+After=mnt-home.mount
+Requires=ovos-home.service
+After=ovos-home.service
+
+[Mount]
+What=/mnt/home
+Where=/home
+Type=none
+Options=bind
+
+[Install]
+WantedBy=ovos-bind.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/mnt-home.mount

@@ -0,0 +1,17 @@
+[Unit]
+Description=OpenVoiceOS home partition
+Wants=ovos-expand.service
+DefaultDependencies=no
+After=ovos-expand.service
+Before=umount.target local-fs.target
+Conflicts=umount.target
+After=systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service
+Wants=systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service systemd-growfs@mnt-home.service
+
+[Mount]
+What=/dev/disk/by-partlabel/homefs
+Where=/mnt/home
+Type=ext4
+
+[Install]
+WantedBy=local-fs.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/mnt-overlay.mount

@@ -0,0 +1,15 @@
+[Unit]
+Description=OpenVoiceOS overlay partition
+DefaultDependencies=no
+Before=umount.target local-fs.target
+Conflicts=umount.target
+After=systemd-fsck@dev-disk-by\x2dpartlabel-overlayfs.service
+Wants=systemd-fsck@dev-disk-by\x2dpartlabel-overlayfs.service
+
+[Mount]
+What=/dev/disk/by-partlabel/overlayfs
+Where=/mnt/overlay
+Type=ext4
+
+[Install]
+WantedBy=local-fs.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/ovos-bind.target

@@ -0,0 +1,7 @@
+[Unit]
+Description=OpenVoiceOS overlay targets
+Documentation=man:systemd.target(5)
+Before=sysinit.target
+
+[Install]
+WantedBy=multi-user.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/ovos-expand.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=OpenVoiceOS home partition resizing
+DefaultDependencies=no
+Before=mnt-home.mount
+RefuseManualStart=true
+RefuseManualStop=true
+Requires=dev-disk-by\x2dpartlabel-homefs.device
+After=dev-disk-by\x2dpartlabel-homefs.device systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/ovos-expand
+
+[Install]
+WantedBy=local-fs.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/ovos-home.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=OpenVoiceOS overlay setup 
+DefaultDependencies=no
+RefuseManualStart=true
+RefuseManualStop=true
+Before=ovos-bind.target
+After=mnt-home.mount
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/home-setup
+RemainAfterExit=true
+
+[Install]
+WantedBy=local-fs.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/ovos-overlay.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=OpenVoiceOS overlay setup 
+DefaultDependencies=no
+RefuseManualStart=true
+RefuseManualStop=true
+Before=ovos-bind.target
+After=mnt-overlay.mount
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/overlay-setup
+RemainAfterExit=true
+
+[Install]
+WantedBy=local-fs.target

buildroot-external/rootfs-overlay/usr/lib/systemd/system/systemd-growfs@.service

@@ -0,0 +1,18 @@
+#
+# Extracted from fstab-generator
+#
+
+[Unit]
+Description=Grow File System on %f
+Documentation=man:systemd-growfs@.service(8)
+DefaultDependencies=no
+BindsTo=%i.mount
+Conflicts=shutdown.target
+After=%i.mount
+Before=shutdown.target local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/lib/systemd/systemd-growfs %f
+TimeoutSec=0

buildroot-external/rootfs-overlay/usr/libexec/home-setup

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+# home persistent overlay
+if [ ! -d /mnt/home/mycroft ]; then
+  cp -a /home/mycroft /mnt/home/
+fi

buildroot-external/rootfs-overlay/usr/libexec/overlay-setup

@@ -1,17 +1,12 @@
 #!/bin/sh
 
+# etc persistent overlay
 if [ ! -d /mnt/overlay/etc ]; then
   mkdir -p /mnt/overlay/etc
-  cp -a /etc /mnt/overlay/etc
+  cp -a /etc/* /mnt/overlay/etc/
 fi
 
+# root home directory
 if [ ! -d /mnt/overlay/root ]; then
   mkdir -p /mnt/overlay/root
-  cp -a /root /mnt/overlay/root
 fi
-
-if [ ! -d /mnt/overlay/home ]; then
-  mkdir -p /mnt/overlay/home
-  cp -a /home /mnt/overlay/home
-fi
-

buildroot-external/rootfs-overlay/usr/libexec/ovos-expand

@@ -0,0 +1,42 @@
+#!/bin/bash
+#
+# Credits to hassos-expand original script
+# https://github.com/home-assistant/operating-system/
+
+DEVICE_HOMEFS="$(findfs PARTUUID=ba3c2691-cce9-4963-b773-42c440c235ec)"
+DEVICE_HOMEFS_NAME="$(basename "${DEVICE_HOMEFS}")"
+DEVICE="/dev/$(lsblk -no pkname "${DEVICE_HOMEFS}")"
+PART_NUM="$(cat "/sys/class/block/${DEVICE_HOMEFS_NAME}/partition")"
+PART_TABLE="$(sfdisk -lqJ "${DEVICE}")"
+
+if sfdisk --verify "${DEVICE}" 2>&1 | grep "The backup GPT table is not on the end of the device."; then
+        echo "[INFO] Moving GPT backup header to the end"
+        sfdisk --relocate gpt-bak-std "${DEVICE}"
+
+        # Reload partition label to get correct .partitiontable.lastlba
+        PART_TABLE="$(sfdisk -lqJ "${DEVICE}")"
+fi
+LAST_USABLE_LBA="$(echo "${PART_TABLE}" | jq -r '.partitiontable.lastlba')"
+
+echo "[INFO] Last usable logical block ${LAST_USABLE_LBA}"
+
+JQ_FILTER=".partitiontable.partitions[] | select ( .node == \"${DEVICE_OVERLAYFS}\" ) | .start + .size"
+HOMEFS_PARTITION_END="$(echo "${PART_TABLE}" | jq "${JQ_FILTER}")"
+echo "[INFO] homefs partition end block ${HOMEFS_PARTITION_END}"
+
+UNUSED_BLOCKS=$(( LAST_USABLE_LBA - DATA_PARTITION_END ))
+if [ "${UNUSED_BLOCKS}" -le "16384" ]; then
+    echo "[INFO] No resize of homefs partition needed"
+    exit 0
+fi
+
+echo "[INFO] Update homefs partition ${PART_NUM}"
+echo ", +" | sfdisk --no-reread --no-tell-kernel -N "${PART_NUM}" "${DEVICE}"
+sfdisk -V "${DEVICE}"
+partx -u "${DEVICE}"
+udevadm settle
+partprobe "${DEVICE}"
+
+echo "[INFO] Resizing the homefs partition"
+resize2fs "${DEVICE_HOMEFS}"
+echo "[OK]"