alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Merge pull request #185085 from ElvishJerricco/shutdown-ramfs-protection

Browse source 
shutdown: Protect system from make-initrd-ng
This commit is contained in:
Will Fancher 2022-08-26 13:25:31 -04:00 committed by GitHub
parent facb042974 a454a706b5
commit 037cf37ad2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
nixos/modules/system/boot/systemd/shutdown.nix
View file

@ -33,26 +33,30 @@ in {
systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown"; systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown";
systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"]; systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
systemd.mounts = [{
what = "tmpfs";
where = "/run/initramfs";
type = "tmpfs";
}];
systemd.services.generate-shutdown-ramfs = { systemd.services.generate-shutdown-ramfs = {
description = "Generate shutdown ramfs"; description = "Generate shutdown ramfs";
wantedBy = [ "shutdown.target" ]; wantedBy = [ "shutdown.target" ];
before = [ "shutdown.target" ]; before = [ "shutdown.target" ];
unitConfig = { unitConfig = {
DefaultDependencies = false; DefaultDependencies = false;
RequiresMountsFor = "/run/initramfs";
ConditionFileIsExecutable = [ ConditionFileIsExecutable = [
"!/run/initramfs/shutdown" "!/run/initramfs/shutdown"
]; ];
}; };
path = [pkgs.util-linux pkgs.makeInitrdNGTool]; serviceConfig = {
serviceConfig.Type = "oneshot"; Type = "oneshot";
script = '' ProtectSystem = "strict";
mkdir -p /run/initramfs ReadWritePaths = "/run/initramfs";
if ! mountpoint -q /run/initramfs; then ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
mount -t tmpfs tmpfs /run/initramfs };
fi
make-initrd-ng ${ramfsContents} /run/initramfs
'';
}; };
}; };
} }