overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid #659

cgwalters · 2020-10-02T17:08:50Z

ostree has had support for leaving /boot mounted read-only
for a long time: ostreedev/ostree#1767
(And then later extended to /sysroot)

Particularly for CoreOS, only a few things should be touching
/boot, and we control all of them. Those projects should
create a new mount namespace and remount these partitions
writable just while they need it.

The main thing we're accomplishing here is making the system
more resilient against accidental damage from a sysadmin
root shell as well as configuration management tools like
Puppet/Ansible. None of those should be directly manipulating
files on these partitions, they should go through the API
of one of our projects (e.g. rpm-ostree kargs, bootupctl) etc.

While we're here, also andd nodev,nosuid because some
OS hardening scanners like to see this. IMO it's of minimal
value, but hey, might as well.

cgwalters · 2020-10-02T17:20:01Z

Heh I forgot about #356 and just saw it - incorporated that too.

cgwalters · 2020-10-02T17:21:01Z

This needs to resolve
#356 (comment)
and at least bootupd needs to learn to do the remounting dance.

cgwalters · 2020-10-02T17:24:13Z

One thing this does break is that I think it would be nice if sysadmins could just vi /boot/loader/entries - having a standardized text format is part of the idea. But...eh. We want fcct sugar for kargs which would use rpm-ostree kargs probably anyways, and for OpenShift the MCO already uses rpm-ostree kargs today too.

cgwalters · 2020-10-02T17:43:29Z

Also after this let's revisit #407

I was debugging a failure to write the statefile which turned out to be me having coreos/fedora-coreos-config#659 locally. Anyways let's add some error context to aid future debugging.

coreos/fedora-coreos-config#659 attempts to mount `/boot` read-only. Currently, the firstboot network dir in `/boot` is cleaned up by a tmpfiles.d conf file. This may not be possible once `/boot` is read-only, so we do the clean up here.

coreos#659 attempts to mount `/boot` read-only. `15-coreos-firstboot-network.conf`'s job should be handled by `ignition-firstboot-complete.service` which remounts writable (privately/temporarily) `/boot` from the real root.

We would like to mount `/boot` read-only in the real root, so add a new unit in 15coreos-network to temporarily mount /boot rw and clean up firstboot networking configuration files late in the initramfs. Remove the current 15-coreos-firstboot-network.conf since it would not work once `/boot` is mounted ro. xref coreos#659

We would like to mount `/boot` read-only in the real root, so remove the current 15-coreos-firstboot-network.conf since it would not work once `/boot` is mounted ro. Drop a stamp file instead so that `coreos-boot-edit.service` would notice and perform the clean up later in the initramfs. xref coreos#659

We would like to mount `/boot` read-only in the real root, so remove the current 15-coreos-firstboot-network.conf since it would not work once `/boot` is mounted ro. Drop a stamp file instead so that `coreos-boot-edit.service` would notice and perform the clean up later in the initramfs. xref #659

kelvinfan001 · 2020-12-04T20:45:32Z

@cgwalters With the updates to how copy-firstboot-network is done and also the patch in bootupd to ensure /boot and /boot/efi writable, is this ready to be merged once the next release of bootupd is out?

We would like to mount `/boot` read-only in the real root, so remove the current 15-coreos-firstboot-network.conf since it would not work once `/boot` is mounted ro. Drop a stamp file instead so that `coreos-boot-edit.service` would notice and perform the clean up later in the initramfs. xref coreos#659

jlebon · 2021-01-06T19:17:52Z

This is remounting /boot/efi, which we stopped mounting in #794 as per coreos/fedora-coreos-tracker#694.

jlebon · 2021-01-06T19:24:13Z

Ahh OK, is this related to openshift/os#480 (comment) ? I.e. are we backtracking for the time being and going back to mounting /boot/efi by default until bootupd learns to mount it itself?

kelvinfan001 · 2021-01-06T19:27:13Z

@jlebon Actually that was my bad, the latest release of bootupd should be able to handle a not-mounted EFI and a read-only /boot. I simply rebased this PR on the latest testing-devel. We should indeed remove the EFI mount section from this PR.
All this PR should be doing now is mounting /boot as RO and adding nodev,nosuid.

are we backtracking for the time being and going back to mounting /boot/efi by default until bootupd learns to mount it itself?

I think https://github.com/coreos/bootupd/releases/tag/v0.2.5 should mean we don't need to backtrack.

jlebon

Commit title still references efi and also andd -> add in the commit message.

LGTM otherwise!

jlebon · 2021-01-06T22:08:53Z

overlay.d/05core/usr/lib/systemd/system-generators/coreos-boot-mount-generator

+    boot_mount_options=ro,nodev,nosuid
+    mk_mount /boot boot "${boot_mount_options}"


Minor/optional: meh, I'd just inline these. It made sense before because we were re-using it for the EFI mount as well.

ostree has had support for leaving `/boot` mounted read-only for a long time: ostreedev/ostree#1767 (And then later extended to `/sysroot`) Particularly for CoreOS, only a few things should be touching `/boot`, and we control all of them. Those projects should create a new mount namespace and remount these partitions writable just while they need it. The main thing we're accomplishing here is making the system more resilient against accidental damage from a sysadmin root shell as well as configuration management tools like Puppet/Ansible. None of those should be directly manipulating files on these partitions, they should go through the API of one of our projects (e.g. `rpm-ostree kargs`, `bootupctl`) etc. While we're here, also add `nodev,nosuid` because some OS hardening scanners like to see this. IMO it's of minimal value, but hey, might as well.

The recent change in coreos/fedora-coreos-config#659 broke some of our tests that do `mount -o remount,rw /sysroot` but leave `/boot` read-only. We had code for having `/boot` read-only before `/sysroot` but in practice we had a file descriptor for `/sysroot` that we opened before the remount that would happen later on. Clean things up here so that in the library, we also remount `/boot` at the same time we remount `/sysroot` if either are readonly. Second, adapt the client side code to check for either being readonly to enable the mount namespace. Now honestly we could almost certainly just set this unconditionally - the original client code here is just being excessively conservative. But I'd like to make that cleanup independently of this fix.

The recent change in coreos/fedora-coreos-config#659 broke some of our tests that do `mount -o remount,rw /sysroot` but leave `/boot` read-only. We had code for having `/boot` read-only before `/sysroot` but in practice we had a file descriptor for `/sysroot` that we opened before the remount that would happen later on. Clean things up here so that in the library, we also remount `/boot` at the same time we remount `/sysroot` if either are readonly. Delete the legacy code for remounting `/boot` rw if we're not in a mount namespace. I am fairly confident most users are either using the `ostree` CLI, or they're using the mount namespace.

cgwalters force-pushed the boot-ro branch from 4eab505 to bcc12ce Compare October 2, 2020 17:19

cgwalters mentioned this pull request Oct 2, 2020

overlay/mounts: Mount /boot and /boot/efi ro,nodev,nosuid #356

Closed

cgwalters changed the title ~~overlay/boot-mount-generator: Mount /boot and /boot/efi read-only~~ overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid Oct 2, 2020

cgwalters mentioned this pull request Oct 6, 2020

main: Add more error context coreos/bootupd#60

Merged

travier mentioned this pull request Oct 22, 2020

Mount /boot as RO by default coreos/fedora-coreos-tracker#652

Closed

kelvinfan001 mentioned this pull request Nov 13, 2020

ignition-firstboot-complete.service: Remove firstboot network dir coreos/ignition#1124

Closed

kelvinfan001 mentioned this pull request Nov 13, 2020

15coreos-network: Remove 15-coreos-firstboot-network.conf #736

Closed

kelvinfan001 mentioned this pull request Nov 19, 2020

30ignition-coreos: Add coreos-boot-edit.{service,sh} #743

Merged

kelvinfan001 mentioned this pull request Dec 1, 2020

Handle ro /boot coreos/bootupd#118

Merged

kelvinfan001 force-pushed the boot-ro branch from bcc12ce to b17ada6 Compare December 4, 2020 19:45

kelvinfan001 force-pushed the boot-ro branch 2 times, most recently from 09e5e48 to 7b576a3 Compare January 6, 2021 16:23

kelvinfan001 marked this pull request as ready for review January 6, 2021 16:23

kelvinfan001 requested a review from jlebon January 6, 2021 16:24

kelvinfan001 force-pushed the boot-ro branch from 7b576a3 to 1dce1aa Compare January 6, 2021 19:30

jlebon approved these changes Jan 6, 2021

View reviewed changes

kelvinfan001 force-pushed the boot-ro branch from 1dce1aa to 920f57a Compare January 7, 2021 00:05

kelvinfan001 merged commit 1de21ff into coreos:testing-devel Jan 7, 2021

cgwalters mentioned this pull request Jan 9, 2021

sysroot: Handle ro /boot but rw /sysroot ostreedev/ostree#2261

Merged

jlebon mentioned this pull request Jan 15, 2021

storage: document boot_device sugar coreos/fedora-coreos-docs#236

Merged

bgilbert mentioned this pull request Jan 15, 2021

storage: /boot is now mounted ro coreos/fedora-coreos-docs#237

Merged

jlebon mentioned this pull request May 7, 2021

/boot is full and system is boot looping coreos/fedora-coreos-tracker#819

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid #659

overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid #659

cgwalters commented Oct 2, 2020 •

edited

Loading

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

kelvinfan001 commented Dec 4, 2020

jlebon commented Jan 6, 2021

jlebon commented Jan 6, 2021

kelvinfan001 commented Jan 6, 2021 •

edited

Loading

jlebon left a comment

jlebon Jan 6, 2021

		boot_mount_options=ro,nodev,nosuid
		mk_mount /boot boot "${boot_mount_options}"

overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid #659

overlay/boot-mount-generator: Mount /boot{,efi} read-only,nodev,nosuid #659

Conversation

cgwalters commented Oct 2, 2020 • edited Loading

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

cgwalters commented Oct 2, 2020

kelvinfan001 commented Dec 4, 2020

jlebon commented Jan 6, 2021

jlebon commented Jan 6, 2021

kelvinfan001 commented Jan 6, 2021 • edited Loading

jlebon left a comment

Choose a reason for hiding this comment

jlebon Jan 6, 2021

Choose a reason for hiding this comment

cgwalters commented Oct 2, 2020 •

edited

Loading

kelvinfan001 commented Jan 6, 2021 •

edited

Loading