[All] Changes to the overlay system to get rootless podman to work

This commit is contained in:
j1nx 2023-08-25 14:59:36 +00:00
parent 815384911d
commit 4c8fd8fab0
23 changed files with 258 additions and 48 deletions

View File

@ -16,6 +16,14 @@ image overlayfs.ext4 {
ext4 {
use-mke2fs = "true"
}
size = 256M
}
image homefs.ext4 {
name = "homefs"
ext4 {
use-mke2fs = "true"
}
size = 64M
}
@ -52,4 +60,10 @@ image disk.img {
partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
image = "overlayfs.ext4"
}
partition homefs {
partition-uuid = ba3c2691-cce9-4963-b773-42c440c235ec
partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
image = "homefs.ext4"
}
}

View File

@ -12,7 +12,7 @@ set menu_color_highlight=white/red
load_env
default_cmdline="rootfstype=squashfs init=/sbin/pre-init systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=tty1 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait"
default_cmdline="rootfstype=squashfs systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=console consoleblank=0 loglevel=0 vt.global_cursor_default=0 logo.nologo systemd.show_status=0 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait quiet splash"
file_env -f ($root)/cmdline.txt cmdline
regexp --set 1:boothd (.+),.+ ${root}

View File

@ -12,7 +12,7 @@ set menu_color_highlight=white/red
load_env
default_cmdline="rootfstype=squashfs init=/sbin/pre-init systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=tty1 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait"
default_cmdline="rootfstype=squashfs systemd.machine_id=$MACHINE_ID fsck.repair=yes zram.enabled=1 zram.num_devices=3 console=console consoleblank=0 loglevel=0 vt.global_cursor_default=0 logo.nologo systemd.show_status=0 systemd.unified_cgroup_hierarchy=1 cgroup_enable=cpuset cgroup_memory=1 $boot_condition rootwait quiet splash"
file_env -f ($root)/cmdline.txt cmdline
regexp --set 1:boothd (.+),.+ ${root}

View File

@ -23,6 +23,14 @@ image overlayfs.ext4 {
ext4 {
use-mke2fs = "true"
}
size = 256M
}
image homefs.ext4 {
name = "homefs"
ext4 {
use-mke2fs = "true"
}
size = 64M
}
@ -58,4 +66,10 @@ image disk.img {
partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
image = "overlayfs.ext4"
}
partition homefs {
partition-uuid = ba3c2691-cce9-4963-b773-42c440c235ec
partition-type-uuid = 0fc63daf-8483-4772-8e79-3d69d8477de4
image = "homefs.ext4"
}
}

View File

@ -13,9 +13,7 @@ BR2_TARGET_GENERIC_HOSTNAME="OpenVoiceOS"
BR2_TARGET_GENERIC_ISSUE="Welcome to OpenVoiceOS"
BR2_TARGET_GENERIC_PASSWD_SHA512=y
BR2_INIT_SYSTEMD=y
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
BR2_SYSTEM_BIN_SH_BASH=y
# BR2_TARGET_GENERIC_GETTY is not set
# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
BR2_SYSTEM_DHCP="eth0"
# BR2_ENABLE_LOCALE_PURGE is not set
@ -366,21 +364,15 @@ BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
BR2_PACKAGE_WPA_SUPPLICANT_DBUS=y
BR2_PACKAGE_CATATONIT=y
BR2_PACKAGE_FILE=y
BR2_PACKAGE_GNUPG=y
BR2_PACKAGE_SCREEN=y
BR2_PACKAGE_TIME=y
BR2_PACKAGE_TINI=y
BR2_PACKAGE_WHICH=y
BR2_PACKAGE_ACL=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_BUILDAH=y
BR2_PACKAGE_COREUTILS=y
BR2_PACKAGE_DOCKER_CLI_BUILDX=y
BR2_PACKAGE_DOCKER_COMPOSE=y
BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_DOCKER_ENGINE_EXPERIMENTAL=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_BTRFS=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_DEVICEMAPPER=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_VFS=y
BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
BR2_PACKAGE_EFIBOOTMGR=y
BR2_PACKAGE_HTOP=y
BR2_PACKAGE_OPENVMTOOLS=y
@ -403,13 +395,16 @@ BR2_PACKAGE_SYSTEMD_FIRSTBOOT=y
BR2_PACKAGE_SYSTEMD_HIBERNATE=y
# BR2_PACKAGE_SYSTEMD_HWDB is not set
BR2_PACKAGE_SYSTEMD_LOGIND=y
BR2_PACKAGE_SYSTEMD_MACHINED=y
BR2_PACKAGE_SYSTEMD_OOMD=y
BR2_PACKAGE_SYSTEMD_POLKIT=y
BR2_PACKAGE_SYSTEMD_RANDOMSEED=y
BR2_PACKAGE_SYSTEMD_REPART=y
BR2_PACKAGE_SYSTEMD_RFKILL=y
# BR2_PACKAGE_SYSTEMD_VCONSOLE is not set
BR2_PACKAGE_SYSTEMD_BOOTCHART=y
BR2_PACKAGE_TAR=y
BR2_PACKAGE_UTIL_LINUX_BINARIES=y
BR2_PACKAGE_UTIL_LINUX_HWCLOCK=y
BR2_PACKAGE_UTIL_LINUX_KILL=y
BR2_PACKAGE_UTIL_LINUX_LOGGER=y
@ -417,8 +412,9 @@ BR2_PACKAGE_UTIL_LINUX_LOGIN=y
BR2_PACKAGE_UTIL_LINUX_LSMEM=y
BR2_PACKAGE_UTIL_LINUX_MESG=y
BR2_PACKAGE_UTIL_LINUX_MORE=y
BR2_PACKAGE_UTIL_LINUX_NOLOGIN=y
BR2_PACKAGE_UTIL_LINUX_MOUNTPOINT=y
BR2_PACKAGE_UTIL_LINUX_PARTX=y
BR2_PACKAGE_UTIL_LINUX_PIVOT_ROOT=y
BR2_PACKAGE_UTIL_LINUX_SU=y
BR2_PACKAGE_UTIL_LINUX_SULOGIN=y
BR2_PACKAGE_UTIL_LINUX_SWITCH_ROOT=y
@ -439,6 +435,6 @@ BR2_PACKAGE_HOST_GENIMAGE=y
BR2_PACKAGE_HOST_MKPASSWD=y
BR2_PACKAGE_HOST_MTOOLS=y
BR2_PACKAGE_HOST_PKGCONF=y
BR2_PACKAGE_GROWDISK_SERVICE=y
BR2_PACKAGE_HOSTNAME_SERVICE=y
BR2_PACKAGE_NCPAMIXER=y
BR2_PACKAGE_OVOS_SPLASH=y

View File

@ -14,9 +14,7 @@ BR2_TARGET_GENERIC_HOSTNAME="OpenVoiceOS"
BR2_TARGET_GENERIC_ISSUE="Welcome to OpenVoiceOS"
BR2_TARGET_GENERIC_PASSWD_SHA512=y
BR2_INIT_SYSTEMD=y
# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
BR2_SYSTEM_BIN_SH_BASH=y
# BR2_TARGET_GENERIC_GETTY is not set
# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
BR2_SYSTEM_DHCP="eth0"
# BR2_ENABLE_LOCALE_PURGE is not set
@ -349,21 +347,15 @@ BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
BR2_PACKAGE_WPA_SUPPLICANT_DBUS=y
BR2_PACKAGE_CATATONIT=y
BR2_PACKAGE_FILE=y
BR2_PACKAGE_GNUPG=y
BR2_PACKAGE_SCREEN=y
BR2_PACKAGE_TIME=y
BR2_PACKAGE_TINI=y
BR2_PACKAGE_WHICH=y
BR2_PACKAGE_ACL=y
BR2_PACKAGE_AUDIT=y
BR2_PACKAGE_BUILDAH=y
BR2_PACKAGE_COREUTILS=y
BR2_PACKAGE_DOCKER_CLI_BUILDX=y
BR2_PACKAGE_DOCKER_COMPOSE=y
BR2_PACKAGE_DOCKER_ENGINE=y
BR2_PACKAGE_DOCKER_ENGINE_EXPERIMENTAL=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_BTRFS=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_DEVICEMAPPER=y
BR2_PACKAGE_DOCKER_ENGINE_DRIVER_VFS=y
BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
BR2_PACKAGE_EFIBOOTMGR=y
BR2_PACKAGE_HTOP=y
BR2_PACKAGE_OPENVMTOOLS=y
@ -386,13 +378,16 @@ BR2_PACKAGE_SYSTEMD_FIRSTBOOT=y
BR2_PACKAGE_SYSTEMD_HIBERNATE=y
# BR2_PACKAGE_SYSTEMD_HWDB is not set
BR2_PACKAGE_SYSTEMD_LOGIND=y
BR2_PACKAGE_SYSTEMD_MACHINED=y
BR2_PACKAGE_SYSTEMD_OOMD=y
BR2_PACKAGE_SYSTEMD_POLKIT=y
BR2_PACKAGE_SYSTEMD_RANDOMSEED=y
BR2_PACKAGE_SYSTEMD_REPART=y
BR2_PACKAGE_SYSTEMD_RFKILL=y
# BR2_PACKAGE_SYSTEMD_VCONSOLE is not set
BR2_PACKAGE_SYSTEMD_BOOTCHART=y
BR2_PACKAGE_TAR=y
BR2_PACKAGE_UTIL_LINUX_BINARIES=y
BR2_PACKAGE_UTIL_LINUX_HWCLOCK=y
BR2_PACKAGE_UTIL_LINUX_KILL=y
BR2_PACKAGE_UTIL_LINUX_LOGGER=y
@ -400,8 +395,9 @@ BR2_PACKAGE_UTIL_LINUX_LOGIN=y
BR2_PACKAGE_UTIL_LINUX_LSMEM=y
BR2_PACKAGE_UTIL_LINUX_MESG=y
BR2_PACKAGE_UTIL_LINUX_MORE=y
BR2_PACKAGE_UTIL_LINUX_NOLOGIN=y
BR2_PACKAGE_UTIL_LINUX_MOUNTPOINT=y
BR2_PACKAGE_UTIL_LINUX_PARTX=y
BR2_PACKAGE_UTIL_LINUX_PIVOT_ROOT=y
BR2_PACKAGE_UTIL_LINUX_SU=y
BR2_PACKAGE_UTIL_LINUX_SULOGIN=y
BR2_PACKAGE_UTIL_LINUX_SWITCH_ROOT=y
@ -421,9 +417,9 @@ BR2_PACKAGE_HOST_GENIMAGE=y
BR2_PACKAGE_HOST_MKPASSWD=y
BR2_PACKAGE_HOST_MTOOLS=y
BR2_PACKAGE_HOST_PKGCONF=y
BR2_PACKAGE_GROWDISK_SERVICE=y
BR2_PACKAGE_HOSTNAME_SERVICE=y
BR2_PACKAGE_NCPAMIXER=y
BR2_PACKAGE_OVOS_SPLASH=y
BR2_PACKAGE_RESPEAKER=y
BR2_PACKAGE_USERLAND_TOOLS=y
BR2_PACKAGE_VOCALFUSION=y

View File

@ -1,13 +0,0 @@
auth required pam_unix.so nullok
account required pam_unix.so
password required pam_unix.so nullok
# session required pam_selinux.so close
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
session optional pam_lastlog.so
-session optional pam_systemd.so
# session required pam_selinux.so open

View File

@ -0,0 +1,6 @@
# This file is part of systemd.
auth include system-auth
account include system-auth
password include system-auth
session include system-auth

View File

@ -0,0 +1,23 @@
# This file is part of systemd.
# You really want to adjust this to your local distribution. If you use this
# unmodified you are not building systems safely and securely.
auth sufficient pam_unix.so
-auth sufficient pam_systemd_home.so
auth required pam_deny.so
account required pam_nologin.so
-account sufficient pam_systemd_home.so
account sufficient pam_unix.so
account required pam_permit.so
-password sufficient pam_systemd_home.so
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password required pam_deny.so
-session optional pam_keyinit.so revoke
-session optional pam_loginuid.so
-session optional pam_systemd_home.so
-session optional pam_systemd.so
session required pam_unix.so

View File

@ -1,4 +1,3 @@
enable growdisk.service
enable hostname.service
enable sshd.service
enable bluetooth.service

View File

@ -0,0 +1,15 @@
[Unit]
Description=etc persistent partition overlay
Requires=mnt-overlay.mount
After=mnt-overlay.mount
Requires=ovos-overlay.service
After=ovos-overlay.service
[Mount]
What=/mnt/overlay/etc
Where=/etc
Type=none
Options=bind
[Install]
WantedBy=ovos-bind.target

View File

@ -0,0 +1,15 @@
[Unit]
Description=home persistent partition overlay
Requires=mnt-home.mount
After=mnt-home.mount
Requires=ovos-home.service
After=ovos-home.service
[Mount]
What=/mnt/home
Where=/home
Type=none
Options=bind
[Install]
WantedBy=ovos-bind.target

View File

@ -0,0 +1,17 @@
[Unit]
Description=OpenVoiceOS home partition
Wants=ovos-expand.service
DefaultDependencies=no
After=ovos-expand.service
Before=umount.target local-fs.target
Conflicts=umount.target
After=systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service
Wants=systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service systemd-growfs@mnt-home.service
[Mount]
What=/dev/disk/by-partlabel/homefs
Where=/mnt/home
Type=ext4
[Install]
WantedBy=local-fs.target

View File

@ -0,0 +1,15 @@
[Unit]
Description=OpenVoiceOS overlay partition
DefaultDependencies=no
Before=umount.target local-fs.target
Conflicts=umount.target
After=systemd-fsck@dev-disk-by\x2dpartlabel-overlayfs.service
Wants=systemd-fsck@dev-disk-by\x2dpartlabel-overlayfs.service
[Mount]
What=/dev/disk/by-partlabel/overlayfs
Where=/mnt/overlay
Type=ext4
[Install]
WantedBy=local-fs.target

View File

@ -0,0 +1,7 @@
[Unit]
Description=OpenVoiceOS overlay targets
Documentation=man:systemd.target(5)
Before=sysinit.target
[Install]
WantedBy=multi-user.target

View File

@ -0,0 +1,15 @@
[Unit]
Description=OpenVoiceOS home partition resizing
DefaultDependencies=no
Before=mnt-home.mount
RefuseManualStart=true
RefuseManualStop=true
Requires=dev-disk-by\x2dpartlabel-homefs.device
After=dev-disk-by\x2dpartlabel-homefs.device systemd-fsck@dev-disk-by\x2dpartlabel-homefs.service
[Service]
Type=oneshot
ExecStart=/usr/libexec/ovos-expand
[Install]
WantedBy=local-fs.target

View File

@ -0,0 +1,15 @@
[Unit]
Description=OpenVoiceOS overlay setup
DefaultDependencies=no
RefuseManualStart=true
RefuseManualStop=true
Before=ovos-bind.target
After=mnt-home.mount
[Service]
Type=oneshot
ExecStart=/usr/libexec/home-setup
RemainAfterExit=true
[Install]
WantedBy=local-fs.target

View File

@ -0,0 +1,15 @@
[Unit]
Description=OpenVoiceOS overlay setup
DefaultDependencies=no
RefuseManualStart=true
RefuseManualStop=true
Before=ovos-bind.target
After=mnt-overlay.mount
[Service]
Type=oneshot
ExecStart=/usr/libexec/overlay-setup
RemainAfterExit=true
[Install]
WantedBy=local-fs.target

View File

@ -0,0 +1,18 @@
#
# Extracted from fstab-generator
#
[Unit]
Description=Grow File System on %f
Documentation=man:systemd-growfs@.service(8)
DefaultDependencies=no
BindsTo=%i.mount
Conflicts=shutdown.target
After=%i.mount
Before=shutdown.target local-fs.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/lib/systemd/systemd-growfs %f
TimeoutSec=0

View File

@ -0,0 +1,6 @@
#!/bin/sh
# home persistent overlay
if [ ! -d /mnt/home/mycroft ]; then
cp -a /home/mycroft /mnt/home/
fi

View File

@ -1,17 +1,12 @@
#!/bin/sh
# etc persistent overlay
if [ ! -d /mnt/overlay/etc ]; then
mkdir -p /mnt/overlay/etc
cp -a /etc /mnt/overlay/etc
cp -a /etc/* /mnt/overlay/etc/
fi
# root home directory
if [ ! -d /mnt/overlay/root ]; then
mkdir -p /mnt/overlay/root
cp -a /root /mnt/overlay/root
fi
if [ ! -d /mnt/overlay/home ]; then
mkdir -p /mnt/overlay/home
cp -a /home /mnt/overlay/home
fi

View File

@ -0,0 +1,42 @@
#!/bin/bash
#
# Credits to hassos-expand original script
# https://github.com/home-assistant/operating-system/
DEVICE_HOMEFS="$(findfs PARTUUID=ba3c2691-cce9-4963-b773-42c440c235ec)"
DEVICE_HOMEFS_NAME="$(basename "${DEVICE_HOMEFS}")"
DEVICE="/dev/$(lsblk -no pkname "${DEVICE_HOMEFS}")"
PART_NUM="$(cat "/sys/class/block/${DEVICE_HOMEFS_NAME}/partition")"
PART_TABLE="$(sfdisk -lqJ "${DEVICE}")"
if sfdisk --verify "${DEVICE}" 2>&1 | grep "The backup GPT table is not on the end of the device."; then
echo "[INFO] Moving GPT backup header to the end"
sfdisk --relocate gpt-bak-std "${DEVICE}"
# Reload partition label to get correct .partitiontable.lastlba
PART_TABLE="$(sfdisk -lqJ "${DEVICE}")"
fi
LAST_USABLE_LBA="$(echo "${PART_TABLE}" | jq -r '.partitiontable.lastlba')"
echo "[INFO] Last usable logical block ${LAST_USABLE_LBA}"
JQ_FILTER=".partitiontable.partitions[] | select ( .node == \"${DEVICE_OVERLAYFS}\" ) | .start + .size"
HOMEFS_PARTITION_END="$(echo "${PART_TABLE}" | jq "${JQ_FILTER}")"
echo "[INFO] homefs partition end block ${HOMEFS_PARTITION_END}"
UNUSED_BLOCKS=$(( LAST_USABLE_LBA - DATA_PARTITION_END ))
if [ "${UNUSED_BLOCKS}" -le "16384" ]; then
echo "[INFO] No resize of homefs partition needed"
exit 0
fi
echo "[INFO] Update homefs partition ${PART_NUM}"
echo ", +" | sfdisk --no-reread --no-tell-kernel -N "${PART_NUM}" "${DEVICE}"
sfdisk -V "${DEVICE}"
partx -u "${DEVICE}"
udevadm settle
partprobe "${DEVICE}"
echo "[INFO] Resizing the homefs partition"
resize2fs "${DEVICE_HOMEFS}"
echo "[OK]"