This adds a "secret-service" that can be added to a Childhurd VM to receive
out-of-band secrets (keys) sent from the host.
Co-authored-by: Ludovic Courtès <ludo@gnu.org>
* gnu/services/virtualization.scm (secret-service-activation): New procedure.
(secret-service-type): New variable.
* gnu/build/secret-service.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
This commit adds support for GZIP compression for linux-libre kernel
modules. The initrd modules are kept uncompressed as the initrd is already
compressed as a whole.
The linux-libre kernel also supports XZ compression, but as Guix does not have
any available bindings for now, and the compression time is far more
significant, GZIP seems to be a better option.
* gnu/build/linux-modules.scm (modinfo-section-contents): Use
'call-with-gzip-input-port' to read from a module file using '.gz' extension,
(strip-extension): new procedure,
(dot-ko): adapt to support compression,
(ensure-dot-ko): ditto,
(file-name->module-name): ditto,
(find-module-file): ditto,
(load-linux-module*): ditto,
(module-name->file-name/guess): ditto,
(module-name-lookup): ditto,
(write-module-name-database): ditto,
(write-module-alias-database): ditto,
(write-module-device-database): ditto.
* gnu/installer.scm (installer-program): Add "guile-zlib" to the extensions.
* gnu/machine/ssh.scm (machine-check-initrd-modules): Ditto.
* gnu/services.scm (activation-script): Ditto.
* gnu/services/base.scm (default-serial-port): Ditto,
(agetty-shepherd-service): ditto,
(udev-service-type): ditto.
* gnu/system/image.scm (gcrypt-sqlite3&co): Ditto.
* gnu/system/linux-initrd.scm (flat-linux-module-directory): Add "guile-zlib"
to the extensions and make sure that the initrd only contains
uncompressed module files.
* gnu/system/shadow.scm (account-shepherd-service): Add "guile-zlib" to the
extensions.
* guix/profiles.scm (linux-module-database): Ditto.
* gnu/system/file-systems.scm (<file-system>): Add a mount-may-fail? field.
(file-system->spec): adapt accordingly,
(spec->file-system): ditto.
* gnu/build/file-systems.scm (mount-file-system): If 'system-error is raised
and mount-may-fail? is true, ignore it. Otherwise, re-raise the exception.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
This fixes <https://bugs.gnu.org/42151>.
* gnu/system/images/hurd.scm (hurd-initialize-root-partition): Use #:wal-mode #f
in call to ...
* gnu/build/image.scm (initialize-root-partition): ... this, add #:wal-mode?
parameter, pass it to ...
(register-closure): ... this, add #:wal-mode? parameter, pass it to ...
* guix/store/database.scm (with-database): ... this, add #:wal-mode?
parameter, pass it to ...
(call-with-database): ... this, add #:wal-mode? parameter; when
set to #f, do not set journal_model=WAL.
The "image-root" derivation output is used as a temporary directory that is
passed to mke2fs and mkdosfs later on. By merging the creation of this
directory and the production of partition images, we can get rid of the
derivation.
As mke2fs and mkdosfs are not able to override file permissions, call those
commands with fakeroot. This way, all the image files will be owned by root,
even if image generation is done in an unprivilegded context.
* gnu/system/image.scm (system-disk-image): Merge "image-root" and
"iso9660-image" derivations so that we spare an extra derivation. Also add
"fakeroot" and its runtime dependencies to the inputs.
* gnu/build/image.scm (make-ext-image, make-vfat-image): Make sure that mke2fs
and mkdosfs are respectively called by fakeroot.
Note: Using `getxattr' on the Hurd instead of running showtrans does not
work (yet?).
* gnu/build/hurd-boot.scm (setup-translator): Use 'setxattr' instead of
invoking settrans.
* gnu/system.scm (hurd-multiboot-modules): Add --x-xattr-translator-records to
enable xattr-embedding of translators.
* gnu/build/hurd-boot.scm (make-hurd-device-nodes): Do not create
dev/{null,zero,full,random,urandom} mount points.
(passive-translator-xattr?, passive-translator-installed?, translated?,
set-translator, set-hurd-device-translators): New procedures.
(false-if-EEXIST): New macro.
(boot-hurd-system): Use them instead of running MAKEDEV.
This mirrors a change made in the Shepherd 0.8.0. Previously, upon
startup failure, we could have left processes behind.
* gnu/build/shepherd.scm (read-pid-file/container): Kill (- PID) instead
of PID.
Fixes <https://bugs.gnu.org/41791>.
Reported by Tobias Geerinckx-Rice <me@tobias.gr>.
This change mirrors changes made in the Shepherd 0.8.1, where signals
are blocked in the shepherd process in support of 'signalfd'. The
regression was introduced with the switch to 0.8.1 in
3f9c62d1a8: child processes would not
receive SIGTERM upon 'herd stop SERVICE'.
* gnu/build/shepherd.scm <top level>: Autoload (shepherd system).
(make-forkexec-constructor/container): Call call to 'sigaction' and
'unblock-signals'.
* gnu/build/activation.scm (boot-time-system):
Evaluate the linux-command-line thunk for linux systems to boot
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Calling "mknod" without root permissions fails. Plus those device nodes do not
appear to be needed to boot.
* gnu/build/image.scm (initialize-root-partition): Do not use
make-essential-device-nodes as default make-device-nodes procedure.
This decouples startup of the Hurd from the "hurd" package, moving the RC
script into SYSTEM.
* gnu/packages/hurd.scm (hurd)[inputs]: Remove hurd-rc-script.
[arguments]: Do not substitute it. Update "runsystem.sh" to parse kernel
arguments and exec into --system=SYSTEM/rc.
(hurd-rc-script): Move to...
* gnu/services.scm (%hurd-rc-file): ...this new variable.
(hurd-rc-entry): New procedure.
(%hurd-startup-service): Use it in new variable.
* gnu/system.scm (hurd-default-essential-services): Use it.
* gnu/build/activation.scm (boot-time-system): Use "command-line" for the
Hurd.
* gnu/system.scm (hurd-default-essential-services): Add %boot-service and
%activation-service.
* gnu/system/vm.scm (expression->derivation-in-linux-vm): Remove #:target.
[builder]: Use #+. Don't pass #:target-arm32? and #:target-aarch64? to
'load-in-linux-vm'.
Pass #:target #f to 'gexp->derivation'.
(qemu-image): Adjust accordingly.
* gnu/build/vm.scm (load-in-linux-vm): Remove #:target-aarch64?
and #:target-arm32?. Define them as local variables.
* gnu/build/image.scm (initialize-root-partition): Add bootloader-package and
bootloader-installer arguments. Run the bootloader-installer if defined.
* gnu/system/image.scm (system-disk-image): Adapt the partition initializer
call accordingly.
* gnu/build/image.scm (make-ext4-image): Rename to ...
(make-ext-image): ... it, and pass the file-system type to mke2fs,
(make-partition-image): Adapt to call "make-ext-image" if the partition
file-system is prefixed by "ext".
The --root option can now be omitted, and inferred from the root file system
declaration instead.
* gnu/build/file-systems.scm (canonicalize-device-spec): Extend to support NFS
directly, and...
* gnu/build/linux-boot.scm (boot-system): ...remove NFS special casing from
here. Remove nested definitions for root-fs-type, root-fs-flags and
root-fs-options, and bind those inside the let* instead. Make "--root" take
precedence over the device field string representation of the root file
system.
* doc/guix.texi (Initial RAM Disk): Document that "--root" can be left
unspecified.
* gnu/build/vm.scm (install-efi, make-iso9660-image): Remove those procedures
that are now implemented in (gnu build image) module,
(initialize-hard-disk): remove efi support.
* gnu/system/vm.scm (iso9660-image): Remove it,
(qemu-image): adapt it to remove ISO9660 support.
Raw disk-images and ISO9660 images are created in a Qemu virtual machine. This
is quite fragile, very slow, and almost unusable without KVM.
For all these reasons, add support for host image generation. This implies the
use new image generation mechanisms.
- Raw disk images: images of partitions are created using tools such as mke2fs
and mkdosfs depending on the partition file-system type. The partition
images are then assembled into a final image using genimage.
- ISO9660 images: the ISO root directory is populated within the store. GNU
xorriso is then called on that directory, in the exact same way as this is
done in (gnu build vm) module.
Those mechanisms are built upon the new (gnu image) module.
* gnu/image.scm: New file.
* gnu/system/image.scm: New file.
* gnu/build/image: New file.
* gnu/local.mk: Add them.
* gnu/system/vm.scm (system-disk-image): Rename to system-disk-image-in-vm.
* gnu/ci.scm (qemu-jobs): Adapt to new API.
* gnu/tests/install.scm (run-install): Ditto.
* guix/scripts/system.scm (system-derivation-for-action): Ditto.
* gnu/build/bootloader.scm (install-efi): New procedure copied from (gnu build vm).
(install-efi-loader): New exported procedure, wrapping install-efi.
* gnu/build/vm.scm (initialize-hard-disk): Adapt to use install-efi-loader.
There's no need to set the store GID as is will be done by the guix-daemon,
with the following snippet:
if (chown(chrootStoreDir.c_str(), 0, buildUser.getGID()) == -1)
throw SysError(format("cannot change ownership of ‘%1%’") % chrootStoreDir);
* gnu/build/install.scm (directives): Do not set store GID.
Changing ownership may require root permissions. As image can now be generated
without root permissions (no VM involved), ignore those exceptions.
* gnu/build/install.scm (evaluate-populate-directive): Ignore chown
exceptions.
Follow-up to 23b37c3d40.
* gnu/build/file-systems.scm (bytevector-utf16-length): New procedure.
(null-terminated-utf16->string): New procedure.
(f2fs-superblock-volume-name): Use it.
* gnu/build/linux-boot.scm (boot-system) Treat a root option with ":/" as an nfs source
and avoid to call 'canonicalize-device-spec' for it.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/build/vm.scm (root-partition-initializer): Add #:make-device-nodes
parameter and use it.
* gnu/system/vm.scm (qemu-image): Add #:device-node parameter. Pass
#:make-device-nodes to 'root-partition-initializer'.
Previously, when REGISTER-CLOSURES? was false, we'd set all the files
under /dev to #o644, including /dev/null, /dev/zero, etc.
* gnu/build/vm.scm (root-partition-initializer): Call 'reset-timestamps'
separately for /dev, with #:preserve-permissions? #t.
* gnu/build/vm.scm (<partition>)[file-system-options]: New field.
(create-ext-file-system, create-fat-file-system)
(format-partition): Add #:options and honor it.
(initialize-partition): Pass #:options to 'format-partition'.
* gnu/system/vm.scm (qemu-image): Add #:file-system-options and use it
for the root partition.
* gnu/build/vm.scm (root-partition-initializer): Add #:extra-directives
parameter and pass it to 'populate-root-file-system'.
* gnu/system/vm.scm (qemu-image): Add #:extra-directives parameter and
pass it to 'root-partition-initializer'.
Fixes <https://bugs.gnu.org/34276>.
Reported by Tobias Geerinckx-Rice <me@tobias.gr>.
* gnu/system/vm.scm (expression->derivation-in-linux-vm)[loader]:
Produce '/xchg/.exit-status' file upon success.
* gnu/build/vm.scm (load-in-linux-vm): Check for 'xchg/.exit-status'
once QEMU has completed and respond accordingly.
