From de592ab9a8cc375f66a8b200be5963a0896e0a3e Mon Sep 17 00:00:00 2001 From: Pawel Winogrodzki Date: Thu, 27 Aug 2026 16:16:02 -0700 Subject: [PATCH] fix(systemd): serialize initrd root fsck probes Prevent udev from probing root filesystem metadata while fsck updates it. Ship a root-only systemd drop-in and helper in the initramfs. The helper derives the generated root device from its BindsTo dependency, acquires the whole-disk lock, and then runs systemd-fsck against that exact device. Keep this as a temporary workaround until native e2fsprogs whole-disk locking is integrated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bb0e6716-4886-4e95-9efe-71dcde8687d6 --- .../systemd-boot-signed.spec | 5 +- SPECS/systemd/split-files.py | 1 + SPECS/systemd/systemd-fsck-root-device-lock | 51 +++++++++++++++++++ .../systemd-fsck-root-device-lock-dracut.conf | 4 ++ .../systemd-fsck-root-device-lock.conf | 3 ++ SPECS/systemd/systemd.signatures.json | 5 +- SPECS/systemd/systemd.spec | 23 ++++++++- 7 files changed, 89 insertions(+), 3 deletions(-) create mode 100644 SPECS/systemd/systemd-fsck-root-device-lock create mode 100644 SPECS/systemd/systemd-fsck-root-device-lock-dracut.conf create mode 100644 SPECS/systemd/systemd-fsck-root-device-lock.conf diff --git a/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec b/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec index 1f6df92d76d..bb541a34d02 100644 --- a/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec +++ b/SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec @@ -20,7 +20,7 @@ Version: 255 # determine the build information from local checkout Version: %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/') %endif -Release: 33%{?dist} +Release: 34%{?dist} License: LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later Vendor: Microsoft Corporation Distribution: Azure Linux @@ -98,6 +98,9 @@ popd /boot/efi/EFI/BOOT/%{grubefiname} %changelog +* Thu Aug 27 2026 Pawel Winogrodzki - 255-34 +- Bump release to match systemd spec. + * Mon Jun 29 2026 Kshitiz Godara - 255-33 - Bump release to match systemd spec. diff --git a/SPECS/systemd/split-files.py b/SPECS/systemd/split-files.py index 23402d38f9f..3b299692d75 100644 --- a/SPECS/systemd/split-files.py +++ b/SPECS/systemd/split-files.py @@ -89,6 +89,7 @@ def files(root): /usr/lib.*/(security|pkgconfig)$| /usr/lib/rpm(/macros.d|)$| /usr/lib/firewalld(/services|)$| + /usr/lib/dracut(/dracut\.conf\.d|)$| /usr/share/(locale|licenses|doc)| # no $ /etc(/pam\.d|/xdg|/X11|/X11/xinit|/X11.*\.d|)$| /etc/(dnf|dnf/protected.d)$| diff --git a/SPECS/systemd/systemd-fsck-root-device-lock b/SPECS/systemd/systemd-fsck-root-device-lock new file mode 100644 index 00000000000..def8cb42469 --- /dev/null +++ b/SPECS/systemd/systemd-fsck-root-device-lock @@ -0,0 +1,51 @@ +#!/bin/sh +set -eu + +unit_name=systemd-fsck-root.service +device_unit=$( + /usr/bin/systemctl show \ + --property=BindsTo \ + --value \ + "$unit_name" +) + +if [ -z "$device_unit" ]; then + exec /usr/bin/udevadm lock \ + --backing=/ \ + --timeout=180 \ + -- \ + /usr/lib/systemd/systemd-fsck +fi + +case "$device_unit" in + *[[:space:]]*) + echo "Expected one block-device dependency for $unit_name: $device_unit" >&2 + exit 1 + ;; + dev-*.device) + device_path=$( + /usr/bin/systemd-escape \ + --unescape \ + --path \ + "${device_unit%.device}" + ) + ;; + *) + echo "Expected one block-device dependency for $unit_name: $device_unit" >&2 + exit 1 + ;; +esac + +case "$device_path" in + /dev/*) + exec /usr/bin/udevadm lock \ + --device="$device_path" \ + --timeout=180 \ + -- \ + /usr/lib/systemd/systemd-fsck "$device_path" + ;; + *) + echo "Invalid root block-device path: $device_path" >&2 + exit 1 + ;; +esac diff --git a/SPECS/systemd/systemd-fsck-root-device-lock-dracut.conf b/SPECS/systemd/systemd-fsck-root-device-lock-dracut.conf new file mode 100644 index 00000000000..86dea297f73 --- /dev/null +++ b/SPECS/systemd/systemd-fsck-root-device-lock-dracut.conf @@ -0,0 +1,4 @@ +install_items+=" \ + /usr/lib/systemd/systemd-fsck-root-device-lock \ + /usr/lib/systemd/system/systemd-fsck-root.service.d/systemd-fsck-root-device-lock.conf \ +" diff --git a/SPECS/systemd/systemd-fsck-root-device-lock.conf b/SPECS/systemd/systemd-fsck-root-device-lock.conf new file mode 100644 index 00000000000..6616f3f10b0 --- /dev/null +++ b/SPECS/systemd/systemd-fsck-root-device-lock.conf @@ -0,0 +1,3 @@ +[Service] +ExecStart= +ExecStart=/usr/lib/systemd/systemd-fsck-root-device-lock diff --git a/SPECS/systemd/systemd.signatures.json b/SPECS/systemd/systemd.signatures.json index 27e5c35758d..3847f0e8233 100644 --- a/SPECS/systemd/systemd.signatures.json +++ b/SPECS/systemd/systemd.signatures.json @@ -8,9 +8,12 @@ "20-yama-ptrace.conf": "f7881466bff200865ec2c6b5f989ed35855ac45420a55ae5ace805f9e5111828", "98-default-mac-none.link": "11efa1aee1d52e74b3ca5d1db903e9e1f3ca5e07498c25ea13e40452e2430e1a", "macros.sysusers": "b7c3941912208657b68a5890b8e320d626a6bc17290a223b46071e251b240160", - "split-files.py": "ff2ace09f116028299f75ab1f81ca467a6dc4e7ad38c27c22d2e8dd1229ad0dd", + "split-files.py": "68667777122cff91220eaeaea0755f55ac39a997d2b9c18c0b0d1269267188d5", "sysctl.conf.README": "51d16ee2e7eef12dd42e924af6b835861e8b79d11921ba0418d7d0aec7a2a93b", "systemd-255.tar.gz": "a3eb766ee96eb9f4cc25c2a6c933f3299e1b7ae22e72507dade0a5c86d92534f", + "systemd-fsck-root-device-lock": "a93f2a47d0dab68a75911f65f4fb5abb6622aacdceabcde741f62c85da90e08e", + "systemd-fsck-root-device-lock-dracut.conf": "813a63863b44a332443797ed21d87268a13f1519c4a6ca2f617b746373a5f7ff", + "systemd-fsck-root-device-lock.conf": "48e793e7cc442637ecf31e6ad7e14d2c8c7d2e1e092ad99ba76390a7a10f98e3", "systemd-journal-gatewayd.xml": "c2559b1244fb04f7fe214628daf09e12d431560b069b5ef346ace1ceddbe1bc9", "systemd-journal-remote.xml": "29a7ce0c161a99c0bb48ee6fd5def97d88c7d1c1dd776d4b4d93b6be0b6fdd9b", "systemd-udev-trigger-no-reload.conf": "e22c23fb4618a2021322c5b68fc16b872a27fe8a3edb42e8abec83896eba835a", diff --git a/SPECS/systemd/systemd.spec b/SPECS/systemd/systemd.spec index eb981d0bbe7..a841f44c006 100644 --- a/SPECS/systemd/systemd.spec +++ b/SPECS/systemd/systemd.spec @@ -50,7 +50,7 @@ Version: 255 # determine the build information from local checkout Version: %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/') %endif -Release: 33%{?dist} +Release: 34%{?dist} # FIXME - hardcode to 'stable' for now as that's what we have in our blobstore %global stable 1 @@ -105,6 +105,17 @@ Source24: sysusers.generate-pre.sh Source25: 98-default-mac-none.link +# Temporary workaround. Remove Sources 26-28 and their install, signature, +# and split-file changes when the native e2fsprogs whole-disk lock is +# integrated into Azure Linux: +# https://lore.kernel.org/linux-ext4/20260824161512.1332649-1-naraghavan@linux.microsoft.com/ +# Do not ship both implementations. The outer udevadm process retains its +# exclusive lock while waiting for e2fsck; native e2fsck locking would then +# block on a second independently-opened lock and deadlock boot. +Source26: systemd-fsck-root-device-lock.conf +Source27: systemd-fsck-root-device-lock +Source28: systemd-fsck-root-device-lock-dracut.conf + %if 0 GIT_DIR=../../src/systemd/.git git format-patch-ab --no-signature -M -N v235..v235-stable i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done|xclip @@ -882,6 +893,9 @@ install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE9} # https://bugzilla.redhat.com/show_bug.cgi?id=1378974 install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-udev-trigger.service.d/ %{SOURCE10} +install -Dm0644 -t %{buildroot}%{system_unit_dir}/systemd-fsck-root.service.d/ %{SOURCE26} +install -Dm0755 %{SOURCE27} %{buildroot}%{_prefix}/lib/systemd/systemd-fsck-root-device-lock +install -Dm0644 %{SOURCE28} %{buildroot}%{_prefix}/lib/dracut/dracut.conf.d/50-systemd-fsck-root-device-lock.conf # systemd-oomd default configuration install -Dm0644 -t %{buildroot}%{_prefix}/lib/systemd/oomd.conf.d/ %{SOURCE14} @@ -1257,6 +1271,13 @@ rm -f %{name}.lang # %autochangelog. So we need to continue manually maintaining the # changelog here. %changelog +* Wed Aug 26 2026 Pawel Winogrodzki - 255-34 +- Route the generated initrd root filesystem check through `udevadm lock` + with a 180-second timeout. +- Resolve the generated root device from the unit's BindsTo= dependency. +- Add dracut configuration that copies the root drop-in and resolver into + rebuilt initramfs images. + * Mon Jun 29 2026 Kshitiz Godara - 255-33 - Skip tests in %%check that require capabilities not available in the build chroot (mount-namespace privileges, systemd-detect-virt on PATH, etc.):