Skip to content

Commit f1ad806

Browse files
Nowa-AmmerlaanNowa-Ammerlaan
committed
05-check-chroot.install: add sanity check for cmdline from chroot
We usually don't want to use /proc/cmdline from a chroot Closes; https://bugs.gentoo.org/965211 Signed-off-by: Nowa Ammerlaan <nowa@gentoo.org>
1 parent 31e3678 commit f1ad806

File tree

3 files changed

+211
-0
lines changed

3 files changed

+211
-0
lines changed

‎hooks/05-check-chroot.install‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
#!/usr/bin/env sh
2+
3+
# Copyright 2025 Gentoo Authors
4+
# This script is installed by sys-kernel/installkernel, it is executed by the
5+
# traditional installkernel, NOT by systemd's kernel-install. I.e. this plugin
6+
# is run when the systemd USE flag is disabled or SYSTEMD_KERNEL_INSTALL=0 is
7+
# set in the environment.
8+
9+
_test_dracut_cmdline() {
10+
[ -e "/etc/cmdline" ] && return 1
11+
12+
local _i
13+
for _i in /etc/cmdline.d/*.conf; do
14+
[ -e "${_i}" ] && return 1
15+
done
16+
17+
if [ -e /etc/dracut.conf ]; then
18+
if grep -q '^kernel_cmdline=' /etc/dracut.conf; then
19+
return 1
20+
elif grep -q '^hostonly_cmdline=.*no' /etc/dracut.conf; then
21+
return 1
22+
fi
23+
fi
24+
25+
if [ -d /etc/dracut.conf.d ]; then
26+
if grep -qr '^kernel_cmdline=' /etc/dracut.conf.d; then
27+
return 1
28+
elif grep -qr '^hostonly_cmdline=.*no' /etc/dracut.conf.d; then
29+
return 1
30+
fi
31+
fi
32+
33+
return 0
34+
}
35+
36+
_test_kernel_cmdline() {
37+
[ -f "${INSTALLKERNEL_CONF_ROOT}/cmdline" ] && return 1
38+
[ -f "/etc/kernel/cmdline" ] && return 1
39+
[ -f "/run/kernel/cmdline" ] && return 1
40+
[ -f "/usr/local/lib/kernel/cmdline" ] && return 1
41+
[ -f "/usr/lib/kernel/cmdline" ] && return 1
42+
return 0
43+
}
44+
45+
_test_uki_cmdline() {
46+
local _i
47+
for _i in "${INSTALLKERNEL_CONF_ROOT}/uki.conf" \
48+
"/etc/kernel/uki.conf" \
49+
"/run/kernel/uki.conf" \
50+
"/usr/local/lib/kernel/uki.conf" \
51+
"/usr/lib/kernel/uki.conf"; do
52+
if [ -f "${_i}" ]; then
53+
grep -q '^Cmdline=' "${_i}" && return 1
54+
fi
55+
done
56+
return 0
57+
}
58+
59+
if [ "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" ]; then
60+
[ "${INSTALLKERNEL_VERBOSE}" -gt 0 ] && \
61+
echo "Chroot detected"
62+
63+
if [ "${INSTALLKERNEL_INITRD_GENERATOR}" == "dracut" ]; then
64+
if _test_dracut_cmdline; then
65+
echo ""
66+
echo "WARNING: Dracut will be run from inside a chroot but no"
67+
echo "cmdline for dracut was configured. Dracut would fallback"
68+
echo "to using /proc/cmdline, which is generally not what you"
69+
echo "want. Exiting..."
70+
echo ""
71+
echo "Override this check with:"
72+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
73+
echo ""
74+
exit 1
75+
fi
76+
fi
77+
78+
if [ "${INSTALLKERNEL_LAYOUT}" == "bls" ]; then
79+
if _test_kernel_cmdline; then
80+
echo "WARNING: kernel-install is run from inside a chroot but"
81+
echo "no cmdline was configured. This would cause the bootloader"
82+
echo "configuration to fallback to using /proc/cmdline, which is"
83+
echo "generally not what you want. Exiting..."
84+
echo ""
85+
echo "Override this check with:"
86+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
87+
echo ""
88+
exit 1
89+
fi
90+
elif [ "${INSTALLKERNEL_LAYOUT}" == "uki" ] && \
91+
[ "${INSTALLKERNEL_UKI_GENERATOR}" == "ukify" ]; then
92+
if _test_kernel_cmdline && _test_uki_cmdline; then
93+
echo "WARNING: Ukify will be run from inside a chroot but no"
94+
echo "cmdline for ukify was configured. Ukify would fallback"
95+
echo "to using /proc/cmdline, which is generally not what you"
96+
echo "want. Exiting..."
97+
echo ""
98+
echo "Override this check with:"
99+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
100+
echo ""
101+
exit 1
102+
fi
103+
fi
104+
fi

‎hooks/systemd/05-check-chroot.install‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
#!/usr/bin/env sh
2+
3+
# Copyright 2025 Gentoo Authors
4+
# This script is installed by sys-kernel/installkernel, it is executed by
5+
# systemd's kernel-install, NOT by the traditional installkernel. I.e. this
6+
# plugin is run when the systemd USE flag is enabled or
7+
# SYSTEMD_KERNEL_INSTALL=1 is set in the environment.
8+
9+
[ "${1:?}" == "add" ] || exit 0
10+
11+
_test_dracut_cmdline() {
12+
[ -e "/etc/cmdline" ] && return 1
13+
14+
local _i
15+
for _i in /etc/cmdline.d/*.conf; do
16+
[ -e "${_i}" ] && return 1
17+
done
18+
19+
if [ -e /etc/dracut.conf ]; then
20+
if grep -q '^kernel_cmdline=' /etc/dracut.conf; then
21+
return 1
22+
elif grep -q '^hostonly_cmdline=.*no' /etc/dracut.conf; then
23+
return 1
24+
fi
25+
fi
26+
27+
if [ -d /etc/dracut.conf.d ]; then
28+
if grep -qr '^kernel_cmdline=' /etc/dracut.conf.d; then
29+
return 1
30+
elif grep -qr '^hostonly_cmdline=.*no' /etc/dracut.conf.d; then
31+
return 1
32+
fi
33+
fi
34+
35+
return 0
36+
}
37+
38+
_test_kernel_cmdline() {
39+
[ -f "${KERNEL_INSTALL_CONF_ROOT}/cmdline" ] && return 1
40+
[ -f "/etc/kernel/cmdline" ] && return 1
41+
[ -f "/run/kernel/cmdline" ] && return 1
42+
[ -f "/usr/local/lib/kernel/cmdline" ] && return 1
43+
[ -f "/usr/lib/kernel/cmdline" ] && return 1
44+
return 0
45+
}
46+
47+
_test_uki_cmdline() {
48+
local _i
49+
for _i in "${KERNEL_INSTALL_CONF_ROOT}/uki.conf" \
50+
"/etc/kernel/uki.conf" \
51+
"/run/kernel/uki.conf" \
52+
"/usr/local/lib/kernel/uki.conf" \
53+
"/usr/lib/kernel/uki.conf"; do
54+
if [ -f "${_i}" ]; then
55+
grep -q '^Cmdline=' "${_i}" && return 1
56+
fi
57+
done
58+
return 0
59+
60+
if [ "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" ]; then
61+
[ "${KERNEL_INSTALL_VERBOSE}" -gt 0 ] && \
62+
echo "Chroot detected"
63+
64+
if [ "${KERNEL_INSTALL_INITRD_GENERATOR}" == "dracut" ] && [ "${#}" -lt 5 ]; then
65+
if [ "${KERNEL_INSTALL_IMAGE_TYPE}" != "uki" ] && _test_dracut_cmdline; then
66+
echo ""
67+
echo "WARNING: Dracut will be run from inside a chroot but no"
68+
echo "cmdline for dracut was configured. Dracut would fallback"
69+
echo "to using /proc/cmdline, which is generally not what you"
70+
echo "want. Exiting..."
71+
echo ""
72+
echo "Override this check with:"
73+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
74+
echo ""
75+
exit 1
76+
fi
77+
fi
78+
79+
if [ "${KERNEL_INSTALL_LAYOUT}" == "bls" ]; then
80+
if _test_kernel_cmdline; then
81+
echo "WARNING: kernel-install is run from inside a chroot but"
82+
echo "no cmdline was configured. This would cause the bootloader"
83+
echo "configuration to fallback to using /proc/cmdline, which is"
84+
echo "generally not what you want. Exiting..."
85+
echo ""
86+
echo "Override this check with:"
87+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
88+
echo ""
89+
exit 1
90+
fi
91+
elif [ "${KERNEL_INSTALL_LAYOUT}" == "uki" ] && \
92+
[ "${KERNEL_INSTALL_UKI_GENERATOR}" == "ukify" ]; then
93+
if _test_kernel_cmdline && _test_uki_cmdline; then
94+
echo "WARNING: Ukify will be run from inside a chroot but no"
95+
echo "cmdline for ukify was configured. Ukify would fallback"
96+
echo "to using /proc/cmdline, which is generally not what you"
97+
echo "want. Exiting..."
98+
echo ""
99+
echo "Override this check with:"
100+
echo " touch /etc/kernel/install.d/05-check-chroot.install"
101+
echo ""
102+
exit 1
103+
fi
104+
fi
105+
fi

‎installkernel-9999.ebuild‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ src_install() {
9797
keepdir /usr/lib/kernel/postinst.d
9898

9999
exeinto /usr/lib/kernel/preinst.d
100+
doexe hooks/05-check-config.install
100101
doexe hooks/99-check-diskspace.install
101102
use dracut && doexe hooks/52-dracut.install
102103
use ukify && doexe hooks/60-ukify.install
@@ -109,6 +110,7 @@ src_install() {
109110

110111
exeinto /usr/lib/kernel/install.d
111112
doexe hooks/systemd/00-00machineid-directory.install
113+
doexe hooks/systemd/05-check-chroot.install
112114
doexe hooks/systemd/05-check-config.install
113115
doexe hooks/systemd/10-copy-prebuilt.install
114116
doexe hooks/systemd/85-check-diskspace.install

0 commit comments

Comments
 (0)