Root-embedded UKI #32
-
https://0pointer.net/blog/brave-new-trusted-boot-world.html mentions under Whole OS embedded in the UKI that you could potentially embed a root FS into a UKI, is there any documentation for how to go about creating such a UKI? |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 11 replies
-
You could use a tool like mkosi for that, see https://github.com/systemd/mkosi But it's not a ready-made solution for it.
but what is currently missing is to generate the "cpio" first, and then do the objcopy/systemd-measure/sbsign stuff with that so that the primary output is a UKI. @behrmann @DaanDeMeyer what's your take on this? |
Beta Was this translation helpful? Give feedback.
-
@poettering Just as a thought, normal UKIs can be constructed manually with |
Beta Was this translation helpful? Give feedback.
-
@julian-klode you could include the erofs loopback file in the cpio, then set it up via /dev/loop* and then continue running. Which would mean it's not backed by storage. If you want that, two ideas:
|
Beta Was this translation helpful? Give feedback.
-
Buildroot can be used to create a rootfs that contains a set of selected packages. Several rootfs types are supported, one of them is the cpio archive typically used for an initrd. The initrd can even be linked into the kernel binary (though that is not necessary for an UKI image). |
Beta Was this translation helpful? Give feedback.
-
Just another idea to throw into the discussion, how feasible do you think it'd be to use swap space to persist state between OS reboots? So, something like:
Or moreover, can the tmpfs created through |
Beta Was this translation helpful? Give feedback.
You could use a tool like mkosi for that, see https://github.com/systemd/mkosi
But it's not a ready-made solution for it.
but what is currently missing is to generate the "cpio" first, and then do the objcopy/systemd-measure/sbsign stuff with that so that the primary output is a UKI.
@behrmann @DaanDeMeyer what's your take on this?