diff options
Diffstat (limited to 'nixos/modules/system/boot/systemd/initrd.nix')
-rw-r--r-- | nixos/modules/system/boot/systemd/initrd.nix | 44 |
1 files changed, 30 insertions, 14 deletions
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix index 6107a2594baf8..2ccc964820fe0 100644 --- a/nixos/modules/system/boot/systemd/initrd.nix +++ b/nixos/modules/system/boot/systemd/initrd.nix @@ -67,9 +67,8 @@ let "systemd-poweroff.service" "systemd-reboot.service" "systemd-sysctl.service" - "systemd-tmpfiles-setup-dev.service" - "systemd-tmpfiles-setup.service" "timers.target" + "tpm2.target" "umount.target" "systemd-bsod.service" ] ++ cfg.additionalUpstreamUnits; @@ -103,7 +102,16 @@ let name = "initrd-bin-env"; paths = map getBin cfg.initrdBin; pathsToLink = ["/bin" "/sbin"]; - postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -sf '${v}' $out/bin/'${n}'") cfg.extraBin); + + # Make sure sbin and bin have the same contents, and add extraBin + postBuild = '' + find $out/bin -maxdepth 1 -type l -print0 | xargs --null cp --no-dereference --no-clobber -t $out/sbin/ + find $out/sbin -maxdepth 1 -type l -print0 | xargs --null cp --no-dereference --no-clobber -t $out/bin/ + ${concatStringsSep "\n" (mapAttrsToList (n: v: '' + ln -sf '${v}' $out/bin/'${n}' + ln -sf '${v}' $out/sbin/'${n}' + '') cfg.extraBin)} + ''; }; initialRamdisk = pkgs.makeInitrdNG { @@ -111,8 +119,7 @@ let inherit (config.boot.initrd) compressor compressorArgs prepend; inherit (cfg) strip; - contents = map (path: { object = path; symlink = ""; }) (subtractLists cfg.suppressedStorePaths cfg.storePaths) - ++ mapAttrsToList (_: v: { object = v.source; symlink = v.target; }) (filterAttrs (_: v: v.enable) cfg.contents); + contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths; }; in { @@ -160,7 +167,7 @@ in { description = "Set of files that have to be linked into the initrd"; example = literalExpression '' { - "/etc/hostname".text = "mymachine"; + "/etc/machine-id".source = /etc/machine-id; } ''; default = {}; @@ -171,7 +178,7 @@ in { description = '' Store paths to copy into the initrd as well. ''; - type = with types; listOf (oneOf [ singleLineStr package ]); + type = utils.systemdUtils.types.initrdStorePath; default = []; }; @@ -226,8 +233,8 @@ in { emergencyAccess = mkOption { type = with types; oneOf [ bool (nullOr (passwdEntry str)) ]; description = '' - Set to true for unauthenticated emergency access, and false for - no emergency access. + Set to true for unauthenticated emergency access, and false or + null for no emergency access. Can also be set to a hashed super user password to allow authenticated access to the emergency mode. @@ -344,7 +351,8 @@ in { }; enableTpm2 = mkOption { - default = true; + default = cfg.package.withTpm2Tss; + defaultText = "boot.initrd.systemd.package.withTpm2Tss"; type = types.bool; description = '' Whether to enable TPM2 support in the initrd. @@ -428,7 +436,12 @@ in { # We can use either ! or * to lock the root account in the # console, but some software like OpenSSH won't even allow you # to log in with an SSH key if you use ! so we use * instead - "/etc/shadow".text = "root:${if isBool cfg.emergencyAccess then optionalString (!cfg.emergencyAccess) "*" else cfg.emergencyAccess}:::::::"; + "/etc/shadow".text = let + ea = cfg.emergencyAccess; + access = ea != null && !(isBool ea && !ea); + passwd = if isString ea then ea else ""; + in + "root:${if access then passwd else "*"}:::::::"; "/bin".source = "${initrdBinEnv}/bin"; "/sbin".source = "${initrdBinEnv}/sbin"; @@ -443,6 +456,9 @@ in { "/etc/os-release".source = config.boot.initrd.osRelease; "/etc/initrd-release".source = config.boot.initrd.osRelease; + # For systemd-journald's _HOSTNAME field; needs to be set early, cannot be backfilled. + "/etc/hostname".text = config.networking.hostName; + } // optionalAttrs (config.environment.etc ? "modprobe.d/nixos.conf") { "/etc/modprobe.d/nixos.conf".source = config.environment.etc."modprobe.d/nixos.conf".source; }; @@ -460,6 +476,7 @@ in { "${cfg.package}/lib/systemd/systemd-sulogin-shell" "${cfg.package}/lib/systemd/systemd-sysctl" "${cfg.package}/lib/systemd/systemd-bsod" + "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check" # generators "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator" @@ -486,7 +503,8 @@ in { # fido2 support "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so" "${pkgs.libfido2}/lib/libfido2.so.1" - ] ++ jobScripts; + ] ++ jobScripts + ++ map (c: builtins.removeAttrs c ["text"]) (builtins.attrValues cfg.contents); targets.initrd.aliases = ["default.target"]; units = @@ -503,8 +521,6 @@ in { (v: let n = escapeSystemdPath v.where; in nameValuePair "${n}.automount" (automountToUnit v)) cfg.automounts); - # make sure all the /dev nodes are set up - services.systemd-tmpfiles-setup-dev.wantedBy = ["sysinit.target"]; services.initrd-nixos-activation = { after = [ "initrd-fs.target" ]; |