Merge pull request #185085 from ElvishJerricco/shutdown-ramfs-protection
shutdown: Protect system from make-initrd-ng
This commit is contained in:
commit
037cf37ad2
|
@ -33,26 +33,30 @@ in {
|
|||
systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown";
|
||||
systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
|
||||
|
||||
systemd.mounts = [{
|
||||
what = "tmpfs";
|
||||
where = "/run/initramfs";
|
||||
type = "tmpfs";
|
||||
}];
|
||||
|
||||
systemd.services.generate-shutdown-ramfs = {
|
||||
description = "Generate shutdown ramfs";
|
||||
wantedBy = [ "shutdown.target" ];
|
||||
before = [ "shutdown.target" ];
|
||||
unitConfig = {
|
||||
DefaultDependencies = false;
|
||||
RequiresMountsFor = "/run/initramfs";
|
||||
ConditionFileIsExecutable = [
|
||||
"!/run/initramfs/shutdown"
|
||||
];
|
||||
};
|
||||
|
||||
path = [pkgs.util-linux pkgs.makeInitrdNGTool];
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
mkdir -p /run/initramfs
|
||||
if ! mountpoint -q /run/initramfs; then
|
||||
mount -t tmpfs tmpfs /run/initramfs
|
||||
fi
|
||||
make-initrd-ng ${ramfsContents} /run/initramfs
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ProtectSystem = "strict";
|
||||
ReadWritePaths = "/run/initramfs";
|
||||
ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue