diskimage-builder/diskimage_builder/block_device
Julia Kreger 4633da7750 Correct boot path to cover FIPS usage cases
When your booting a Linux system using dracut, i.e. with any
redhat style distribution, dracut's internal code looks to validate
the kernel hmac signature in before proceeding to userspace.

It does this by looking at the /boot/ folder file for the kernel
hmac file.

And it normally does this with the root filesystem. Except if the
kernel is not on the root filesystem and is instead on a /boot
filesystem, this breaks horribly. This is compounded because
DIB enables the operator to restructure the OS image/layout
to fit their needs. In order for this to be navigated, as dracut
is written, we need to pass a "boot=" argument to the kernel.

So now we attempt to purge any prior boot entry in the disk image
content, which is good because any filesystem operations invalidate
it, and then we attempt to identify the boot filesystem, and save a
boot kernel command line parameter so the resulting image can
boot properly if FIPS was enabled in the prior image.

Regex developed with https://sed.js.org utilizing stdin:

VAR="quiet boot=UUID=173c759f-1302-48a3-9d51-a17784c21e03 text"
VAR="quiet boot=PARTUUID=173c759f-1302-48a3-9d51-a17784c21e03"
VAR="quiet boot=PARTUUID=173c759f-1302-48a3-9d51-a17784c21e03 reboot=meow"
VAR="quiet boot=UUID=/dev/sda1 text"
VAR="quiet boot=/dev/sda1"
VAR="quiet boot=/dev/sda1 reboot=meow"
VAR="quiet after_boot=1 reboot=meow boot=/dev/sda1"
VAR="quiet after_boot=1 reboot=meow"

Which resulted in stdout:

VAR="quiet text"
VAR="quiet"
VAR="quiet reboot=meow"
VAR="quiet text"
VAR="quiet"
VAR="quiet reboot=meow"
VAR="quiet after_boot=1 reboot=meow"
VAR="quiet after_boot=1 reboot=meow"

Change-Id: I9034c21e84deda2ba2c0ec0d1d6d6595ed10bed4
2023-03-15 11:25:21 -07:00
..
level0 Move localloop to exec_sudo 2018-06-29 11:22:24 +10:00
level1 Support LVM thin provisioning 2022-08-24 10:34:42 +12:00
level2 Convert labels to upper case 2018-06-19 11:12:54 +02:00
level3 Don't fstrim vfat partitions 2018-01-23 13:24:09 +11:00
level4 Move rollback into NodeBase object 2017-06-08 17:14:20 +10:00
tests Start running dib-lint again 2022-09-21 07:56:05 +10:00
__init__.py Clear __init__.py from cmd move 2017-05-11 18:52:14 +10:00
blockdevice.py Correct boot path to cover FIPS usage cases 2023-03-15 11:25:21 -07:00
cmd.py Uncap hacking 2020-02-24 10:34:46 +11:00
config.py Uncap hacking 2020-02-24 10:34:46 +11:00
exception.py Move exception to it's own file (again) 2017-05-20 06:44:39 +00:00
plugin.py Drop six usage 2020-06-05 12:04:37 +02:00
utils.py Do dmsetup remove device in rollback 2022-08-18 10:23:41 +12:00