s390x: add Ignition protection for SE

overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/01-secex.ign

@@ -66,5 +66,17 @@
         "wipeFilesystem": true
       }
     ]
+  },
+  "systemd": {
+    "units": [
+      {
+        "mask": true,
+        "name": "serial-getty@.service"
+      },
+      {
+        "mask": true,
+        "name": "autovt@.service"
+      }
+    ]
   }
 }

overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator

@@ -74,5 +74,17 @@ EOF
         mkdir -p /run/coreos/
         touch /run/coreos/secure-execution
         cp /usr/lib/coreos/01-secex.ign /usr/lib/ignition/base.d/01-secex.ign
+        # Add dropins to disable Ignition logging for all stages
+        stages=("fetch-offline" "fetch" "kargs" "disks" "mount" "files")
+        for s in "${stages[@]}"; do
+            dropin="${UNIT_DIR}/ignition-${s}.service.d"
+            mkdir -p "${dropin}"
+            cat > "${dropin}/10-secex.conf" <<EOF
+[Service]
+Environment=IGNITION_ARGS=-log-to-stdout
+StandardOutput=null
+StandardError=null
+EOF
+        done
     fi
 fi

overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=CoreOS Secex Ignition Config Decryptor
+ConditionPathExists=/etc/initrd-release
+ConditionPathExists=/run/coreos/secure-execution
+DefaultDependencies=false
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# Run after virtio_blk and before Ignition
+After=coreos-gpt-setup.service
+Before=ignition-fetch-offline.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/coreos-secex-ignition-decrypt

overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-secex-ignition-decrypt.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -euo pipefail
+
+disk=/dev/disk/by-id/virtio-ignition_crypted
+conf=/usr/lib/ignition/user.ign
+pkey=/usr/lib/coreos/ignition.asc
+tmpd=
+
+cleanup() {
+    rm -f "${pkey}"
+    if [[ -n "${tmpd}" ]]; then
+        rm -rf "${tmpd}"
+    fi
+}
+
+trap cleanup EXIT
+
+tmpd=$(mktemp -d)
+
+if [ ! -e "${disk}" ]; then
+    echo "Ignition config must be encrypted"
+    exit 1
+fi
+
+gpg --homedir "${tmpd}" --import "${pkey}" && rm "${pkey}"
+gpg --homedir "${tmpd}" --skip-verify --output "${conf}" --decrypt "${disk}"

overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh

@@ -26,6 +26,13 @@ install() {
         sgdisk \
         uname
 
+    # For IBM SecureExecution
+    if [[ $(uname -m) = s390x ]]; then
+        inst_multiple \
+            gpg \
+            gpg-agent
+    fi
+
     inst_simple "$moddir/coreos-diskful-generator" \
         "$systemdutildir/system-generators/coreos-diskful-generator"
 
@@ -76,4 +83,8 @@ install() {
 
     # IBM Secure Execution. Ignition config for reencryption of / and /boot
     inst_simple "$moddir/01-secex.ign" /usr/lib/coreos/01-secex.ign
+    install_ignition_unit "coreos-secex-ignition-decrypt.service"
+    inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
+        "/usr/sbin/coreos-secex-ignition-decrypt"
+
 }

overlay.d/05core/usr/lib/dracut/modules.d/99emergency-shell-setup/emergency-shell.sh

@@ -32,7 +32,7 @@ _display_relevant_errors() {
 
         # Print Ignition logs
         if echo ${failed} | grep -qFe 'ignition-'; then
-        cat <<EOF
+            cat <<EOF
 ------
 Ignition has failed. Please ensure your config is valid. Note that only
 Ignition spec v3.0.0+ configs are accepted.
@@ -70,6 +70,13 @@ EOF
     fi
 }
 
+# in SE case drop everything before entering shell
+if [ -f /run/coreos/secure-execution ]; then
+    rm -f /run/ignition.json
+    rm -f /usr/lib/ignition/user.ign
+    rm -f /usr/lib/coreos/ignition.asc
+fi
+
 # Print warnings/informational messages to all configured consoles on the
 # machine. Code inspired by https://github.com/dracutdevs/dracut/commit/32f68c1
 MESSAGE="$(_display_relevant_errors)"

overlay.d/05core/usr/lib/dracut/modules.d/99emergency-shell-setup/ignition-virtio-dump-journal.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=Dump Journal to Virtio Port
 ConditionPathExists=/etc/initrd-release
+ConditionPathExists=!/run/coreos/secure-execution
 DefaultDependencies=false
 ConditionVirtualization=|kvm
 ConditionVirtualization=|qemu