From a343ff7e1433130ac293e96bb04ea5dbe363fff1 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 3 Sep 2020 14:11:41 +0200 Subject: [PATCH 1/8] makeInitrd: make uinitrd behaviour optional --- pkgs/build-support/kernel/make-initrd.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix index ed5dbdaee17..3915335b8da 100644 --- a/pkgs/build-support/kernel/make-initrd.nix +++ b/pkgs/build-support/kernel/make-initrd.nix @@ -17,6 +17,7 @@ , compressor ? "gzip -9n" , prepend ? [] , lib +, makeUInitrd ? stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage" }: let # !!! Move this into a public lib function, it is probably useful for others @@ -24,12 +25,10 @@ let lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x)); in stdenvNoCC.mkDerivation rec { - inherit name; + inherit name makeUInitrd; builder = ./make-initrd.sh; - makeUInitrd = stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage"; - nativeBuildInputs = [ perl cpio ] ++ stdenvNoCC.lib.optional makeUInitrd ubootTools; From 85e0ae78276bf7259d75888df89386f4a04214b3 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 3 Sep 2020 14:17:07 +0200 Subject: [PATCH 2/8] makeInitrd: don't assume uImage => arm mips for example might use uImages too --- pkgs/build-support/kernel/make-initrd.nix | 3 ++- pkgs/build-support/kernel/make-initrd.sh | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix index 3915335b8da..f0a61d3476e 100644 --- a/pkgs/build-support/kernel/make-initrd.nix +++ b/pkgs/build-support/kernel/make-initrd.nix @@ -18,6 +18,7 @@ , prepend ? [] , lib , makeUInitrd ? stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage" +, uInitrdArch ? stdenvNoCC.hostPlatform.parsed.cpu.family }: let # !!! Move this into a public lib function, it is probably useful for others @@ -25,7 +26,7 @@ let lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x)); in stdenvNoCC.mkDerivation rec { - inherit name makeUInitrd; + inherit name makeUInitrd uInitrdArch; builder = ./make-initrd.sh; diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh index 0aeaedeb372..822883a681f 100644 --- a/pkgs/build-support/kernel/make-initrd.sh +++ b/pkgs/build-support/kernel/make-initrd.sh @@ -44,5 +44,5 @@ done if [ -n "$makeUInitrd" ]; then mv $out/initrd $out/initrd.gz - mkimage -A arm -O linux -T ramdisk -C gzip -d $out/initrd.gz $out/initrd + mkimage -A $uInitrdArch -O linux -T ramdisk -C gzip -d $out/initrd.gz $out/initrd fi From 3a3c9c95481c5382ab7b7ede24ffd2f38651d2df Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 3 Sep 2020 14:19:43 +0200 Subject: [PATCH 3/8] makeInitrd: include dotfiles at root --- pkgs/build-support/kernel/make-initrd.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh index 822883a681f..8243736ba46 100644 --- a/pkgs/build-support/kernel/make-initrd.sh +++ b/pkgs/build-support/kernel/make-initrd.sh @@ -39,8 +39,8 @@ mkdir -p $out for PREP in $prepend; do cat $PREP >> $out/initrd done -(cd root && find * -print0 | xargs -0r touch -h -d '@1') -(cd root && find * -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | $compressor >> $out/initrd) +(cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +) +(cd root && find * .[^.*] -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | $compressor >> $out/initrd) if [ -n "$makeUInitrd" ]; then mv $out/initrd $out/initrd.gz From 2ee35e1fcecdae598651fd9b1452f451ac221384 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 3 Sep 2020 15:58:10 +0200 Subject: [PATCH 4/8] lib/systems: fix kernelArch for x86_64 IA64 (Itanium) is something completely different and certainly not what we want! x86_64 code lives in arch/x86 just like "classic" x86. --- lib/systems/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/systems/default.nix b/lib/systems/default.nix index f6832945a23..e31a8e65f2a 100644 --- a/lib/systems/default.nix +++ b/lib/systems/default.nix @@ -83,7 +83,7 @@ rec { if final.isAarch32 then "arm" else if final.isAarch64 then "arm64" else if final.isx86_32 then "x86" - else if final.isx86_64 then "ia64" + else if final.isx86_64 then "x86" else if final.isMips then "mips" else final.parsed.cpu.name; From 14fbf575ecd47451dc1b2b3122f56ce8ac670030 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Fri, 4 Sep 2020 18:18:32 +0200 Subject: [PATCH 5/8] make-initrd: various improvements MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Generate a link to the initramfs file with an appropriate file extension, guessed based on the compressor by default - Use correct metadata in u-boot images if generated, up to now this was hardcoded to gzip and would silently generate an erroneous image if another compressor was specified - Document all the parameters - Improve cross-building compatibility, by allowing passing either a string as before, or a function taking a package set and returning the path to a compressor in the "compressor" argument of the function. - Support more compression algorithms - Place compressor executable function and arguments in passthru, for reuse when appending initramfses Co-Authored-By: Dominik Xaver Hörl --- .../kernel/initrd-compressor-meta.nix | 53 +++++++++++ pkgs/build-support/kernel/make-initrd.nix | 91 ++++++++++++++++--- pkgs/build-support/kernel/make-initrd.sh | 9 +- 3 files changed, 135 insertions(+), 18 deletions(-) create mode 100644 pkgs/build-support/kernel/initrd-compressor-meta.nix diff --git a/pkgs/build-support/kernel/initrd-compressor-meta.nix b/pkgs/build-support/kernel/initrd-compressor-meta.nix new file mode 100644 index 00000000000..443e599a239 --- /dev/null +++ b/pkgs/build-support/kernel/initrd-compressor-meta.nix @@ -0,0 +1,53 @@ +rec { + cat = { + executable = pkgs: "cat"; + ubootName = "none"; + extension = ".cpio"; + }; + gzip = { + executable = pkgs: "${pkgs.gzip}/bin/gzip"; + defaultArgs = ["-9n"]; + ubootName = "gzip"; + extension = ".gz"; + }; + bzip2 = { + executable = pkgs: "${pkgs.bzip2}/bin/bzip2"; + ubootName = "bzip2"; + extension = ".bz2"; + }; + xz = { + executable = pkgs: "${pkgs.xz}/bin/xz"; + defaultArgs = ["--check=crc32" "--lzma2=dict=512KiB"]; + extension = ".xz"; + }; + lzma = { + executable = pkgs: "${pkgs.xz}/bin/lzma"; + defaultArgs = ["--check=crc32" "--lzma1=dict=512KiB"]; + ubootName = "lzma"; + extension = ".lzma"; + }; + lz4 = { + executable = pkgs: "${pkgs.lz4}/bin/lz4"; + defaultArgs = ["-l"]; + ubootName = "lz4"; + extension = ".lz4"; + }; + lzop = { + executable = pkgs: "${pkgs.lzop}/bin/lzop"; + ubootName = "lzo"; + extension = ".lzo"; + }; + zstd = { + executable = pkgs: "${pkgs.zstd}/bin/zstd"; + defaultArgs = ["-10"]; + ubootName = "zstd"; + extension = ".zst"; + }; + pigz = gzip // { + executable = pkgs: "${pkgs.pigz}/bin/pigz"; + }; + pixz = xz // { + executable = pkgs: "${pkgs.pixz}/bin/pixz"; + defaultArgs = []; + }; +} diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix index f0a61d3476e..901eb311a88 100644 --- a/pkgs/build-support/kernel/make-initrd.nix +++ b/pkgs/build-support/kernel/make-initrd.nix @@ -1,24 +1,74 @@ -# Create an initial ramdisk containing the closure of the specified -# file system objects. An initial ramdisk is used during the initial +# Create an initramfs containing the closure of the specified +# file system objects. An initramfs is used during the initial # stages of booting a Linux system. It is loaded by the boot loader # along with the kernel image. It's supposed to contain everything # (such as kernel modules) necessary to allow us to mount the root # file system. Once the root file system is mounted, the `real' boot # script can be called. # -# An initrd is really just a gzipped cpio archive. -# -# Symlinks are created for each top-level file system object. E.g., -# `contents = {object = ...; symlink = /init;}' is a typical -# argument. - -{ stdenvNoCC, perl, cpio, contents, ubootTools +# An initramfs is a cpio archive, and may be compressed with a number +# of algorithms. +let + # Some metadata on various compression programs, relevant to naming + # the initramfs file and, if applicable, generating a u-boot image + # from it. + compressors = import ./initrd-compressor-meta.nix; + # Get the basename of the actual compression program from the whole + # compression command, for the purpose of guessing the u-boot + # compression type and filename extension. + compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1; +in +{ stdenvNoCC, perl, cpio, ubootTools, lib, pkgsBuildHost +# Name of the derivation (not of the resulting file!) , name ? "initrd" -, compressor ? "gzip -9n" + +# Program used to compress the cpio archive; use "cat" for no compression. +# This can also be a function which takes a package set and returns the path to the compressor, +# such as `pkgs: "${pkgs.lzop}/bin/lzop"`. +, compressor ? "gzip" +, _compressorFunction ? + if lib.isFunction compressor then compressor + else if ! builtins.hasContext compressor && builtins.hasAttr compressor compressors then compressors.${compressor}.executable + else _: compressor +, _compressorExecutable ? _compressorFunction pkgsBuildHost +, _compressorName ? compressorName _compressorExecutable +, _compressorMeta ? compressors.${_compressorName} or {} + +# List of arguments to pass to the compressor program, or null to use its defaults +, compressorArgs ? null +, _compressorArgsReal ? if compressorArgs == null then _compressorMeta.defaultArgs or [] else compressorArgs + +# Filename extension to use for the compressed initramfs. This is +# included for clarity, but $out/initrd will always be a symlink to +# the final image. +# If this isn't guessed, you may want to complete the metadata above and send a PR :) +, extension ? _compressorMeta.extension or + (throw "Unrecognised compressor ${_compressorName}, please specify filename extension") + +# List of { object = path_or_derivation; symlink = "/path"; } +# The paths are copied into the initramfs in their nix store path +# form, then linked at the root according to `symlink`. +, contents + +# List of uncompressed cpio files to prepend to the initramfs. This +# can be used to add files in specified paths without them becoming +# symlinks to store paths. , prepend ? [] -, lib + +# Whether to wrap the initramfs in a u-boot image. , makeUInitrd ? stdenvNoCC.hostPlatform.platform.kernelTarget == "uImage" -, uInitrdArch ? stdenvNoCC.hostPlatform.parsed.cpu.family + +# If generating a u-boot image, the architecture to use. The default +# guess may not align with u-boot's nomenclature correctly, so it can +# be overridden. +# See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list. +, uInitrdArch ? stdenvNoCC.hostPlatform.kernelArch + +# The name of the compression, as recognised by u-boot. +# See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list. +# If this isn't guessed, you may want to complete the metadata above and send a PR :) +, uInitrdCompression ? _compressorMeta.ubootName or + (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression") }: let # !!! Move this into a public lib function, it is probably useful for others @@ -26,13 +76,26 @@ let lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x)); in stdenvNoCC.mkDerivation rec { - inherit name makeUInitrd uInitrdArch; + inherit name makeUInitrd extension uInitrdArch prepend; + + ${if makeUInitrd then "uinitrdCompression" else null} = uInitrdCompression; builder = ./make-initrd.sh; nativeBuildInputs = [ perl cpio ] ++ stdenvNoCC.lib.optional makeUInitrd ubootTools; + compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}"; + + # Pass the function through, for reuse in append-initrd-secrets. The + # function is used instead of the string, in order to support + # cross-compilation (append-initrd-secrets running on a different + # architecture than what the main initramfs is built on). + passthru = { + compressorExecutableFunction = _compressorFunction; + compressorArgs = _compressorArgsReal; + }; + # !!! should use XML. objects = map (x: x.object) contents; symlinks = map (x: x.symlink) contents; @@ -47,6 +110,4 @@ in stdenvNoCC.mkDerivation rec { contents (lib.range 0 (lib.length contents - 1)); pathsFromGraph = ./paths-from-graph.pl; - - inherit compressor prepend; } diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh index 8243736ba46..c0619ef14ae 100644 --- a/pkgs/build-support/kernel/make-initrd.sh +++ b/pkgs/build-support/kernel/make-initrd.sh @@ -40,9 +40,12 @@ for PREP in $prepend; do cat $PREP >> $out/initrd done (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +) -(cd root && find * .[^.*] -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | $compressor >> $out/initrd) +(cd root && find * .[^.*] -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd") if [ -n "$makeUInitrd" ]; then - mv $out/initrd $out/initrd.gz - mkimage -A $uInitrdArch -O linux -T ramdisk -C gzip -d $out/initrd.gz $out/initrd + mkimage -A $uInitrdArch -O linux -T ramdisk -C "$uInitrdCompression" -d $out/initrd"$extension" $out/initrd.img + # Compatibility symlink + ln -s "initrd.img" "$out/initrd" +else + ln -s "initrd" "$out/initrd$extension" fi From d4ef25db5d794474b2e1a0e5afc55d42d10ac49f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dominik=20Xaver=20H=C3=B6rl?= Date: Sun, 23 Aug 2020 00:12:42 +0200 Subject: [PATCH 6/8] nixos/initrd: add compressorArgs, make compressor option public --- nixos/modules/system/boot/stage-1.nix | 29 ++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index 0f5787a1921..3af80ed20cc 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -308,7 +308,7 @@ let # the initial RAM disk. initialRamdisk = pkgs.makeInitrd { name = "initrd-${kernel-name}"; - inherit (config.boot.initrd) compressor prepend; + inherit (config.boot.initrd) compressor compressorArgs prepend; contents = [ { object = bootStage1; @@ -334,7 +334,9 @@ let # Script to add secret files to the initrd at bootloader update time initialRamdiskSecretAppender = - pkgs.writeScriptBin "append-initrd-secrets" + let + compressorExe = initialRamdisk.compressorExecutableFunction pkgs; + in pkgs.writeScriptBin "append-initrd-secrets" '' #!${pkgs.bash}/bin/bash -e function usage { @@ -376,7 +378,7 @@ let } (cd "$tmp" && find . -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null) | \ - ${config.boot.initrd.compressor} >> "$1" + ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1" ''; in @@ -511,13 +513,26 @@ in }; boot.initrd.compressor = mkOption { - internal = true; - default = "gzip -9n"; - type = types.str; - description = "The compressor to use on the initrd image."; + default = "gzip"; + type = types.unspecified; # We don't have a function type... + description = '' + The compressor to use on the initrd image. May be any of: + + - A string representing a command available in stdenv, e.g. "xz"; + - A function which, given the nixpkgs package set, returns the path to a compressor tool, e.g. pkgs: "''${pkgs.pigz}/bin/pigz" + - (not recommended, because it does not work when cross-compiling) the full path to a compressor tool, e.g. "''${pkgs.pigz}/bin/pigz" + + The given program should read data from stdin and write it to stdout compressed. + ''; example = "xz"; }; + boot.initrd.compressorArgs = mkOption { + default = null; + type = types.nullOr (types.listOf types.str); + description = "Arguments to pass to the compressor for the initrd image, or null to use the compressor's defaults."; + }; + boot.initrd.secrets = mkOption { default = {}; type = types.attrsOf (types.nullOr types.path); From 3136e49b8ef0c40f33f618ee56f1c8959e6cbf88 Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Sat, 12 Dec 2020 14:39:58 +0100 Subject: [PATCH 7/8] nixos/tests: Add test for initrd secrets lz4 compression is excluded because it doesn't work for a reason which remains unclear to me. --- nixos/tests/all-tests.nix | 1 + nixos/tests/initrd-secrets.nix | 35 ++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 nixos/tests/initrd-secrets.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 0c06e3f4424..8cbac702308 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -168,6 +168,7 @@ in initrd-network-openvpn = handleTest ./initrd-network-openvpn {}; initrd-network-ssh = handleTest ./initrd-network-ssh {}; initrdNetwork = handleTest ./initrd-network.nix {}; + initrd-secrets = handleTest ./initrd-secrets.nix {}; installer = handleTest ./installer.nix {}; iodine = handleTest ./iodine.nix {}; ipfs = handleTest ./ipfs.nix {}; diff --git a/nixos/tests/initrd-secrets.nix b/nixos/tests/initrd-secrets.nix new file mode 100644 index 00000000000..10dd908502d --- /dev/null +++ b/nixos/tests/initrd-secrets.nix @@ -0,0 +1,35 @@ +{ system ? builtins.currentSystem +, config ? {} +, pkgs ? import ../.. { inherit system config; } +, lib ? pkgs.lib +, testing ? import ../lib/testing-python.nix { inherit system pkgs; } +}: +let + secretInStore = pkgs.writeText "topsecret" "iamasecret"; + testWithCompressor = compressor: testing.makeTest { + name = "initrd-secrets-${compressor}"; + + meta.maintainers = [ lib.maintainers.lheckemann ]; + + machine = { ... }: { + virtualisation.useBootLoader = true; + boot.initrd.secrets."/test" = secretInStore; + boot.initrd.postMountCommands = '' + cp /test /mnt-root/secret-from-initramfs + ''; + boot.initrd.compressor = compressor; + # zstd compression is only supported from 5.9 onwards. Remove when 5.10 becomes default. + boot.kernelPackages = pkgs.linuxPackages_latest; + }; + + testScript = '' + start_all() + machine.wait_for_unit("multi-user.target") + machine.succeed( + "cmp ${secretInStore} /secret-from-initramfs" + ) + ''; + }; +in lib.flip lib.genAttrs testWithCompressor [ + "cat" "gzip" "bzip2" "xz" "lzma" "lzop" "pigz" "pixz" "zstd" +] From 834cc5d5fa42cc6fd2825696370b9cb5572a134c Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Thu, 17 Dec 2020 22:59:49 +0100 Subject: [PATCH 8/8] nixos/initrd: docbookise "compressor" description --- nixos/modules/system/boot/stage-1.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index 3af80ed20cc..86bfde6349c 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -518,9 +518,11 @@ in description = '' The compressor to use on the initrd image. May be any of: - - A string representing a command available in stdenv, e.g. "xz"; - - A function which, given the nixpkgs package set, returns the path to a compressor tool, e.g. pkgs: "''${pkgs.pigz}/bin/pigz" - - (not recommended, because it does not work when cross-compiling) the full path to a compressor tool, e.g. "''${pkgs.pigz}/bin/pigz" + + The name of one of the predefined compressors, see pkgs/build-support/kernel/initrd-compressor-meta.nix for the definitions. + A function which, given the nixpkgs package set, returns the path to a compressor tool, e.g. pkgs: "''${pkgs.pigz}/bin/pigz" + (not recommended, because it does not work when cross-compiling) the full path to a compressor tool, e.g. "''${pkgs.pigz}/bin/pigz" + The given program should read data from stdin and write it to stdout compressed. '';