sys-apps/systemd: allow @mount syscalls for systemd-udevd.service

[danzatt]

In Flatcar we are using modprobe helpers that run depmod in temporary overlay. systemd-udevd.service may try to load drivers for some block devices (e.g. ZFS), which ends up calling our helpers, which invoke mount command. The mount syscalls are forbidden by the default systemd-udevd syscall filter.

[pothos]

Instead of patching the source, can we ship a unit drop in?

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/19365076690

[chewi]

Instead of patching the source, can we ship a unit drop in?

Indeed, that is what I was expecting. The SystemCallFilter setting is cumulative.

[pothos]

One can argue where this would go, e.g., we have some drop-ins in https://github.com/flatcar/init/tree/flatcar-master/systemd/system

[danzatt]

I was discussing with @t-lo, and he suggested it would be better to ship it directly in a systemd package instead of baselayout. But yeah, it might be easier to ship it in init/baselayout so that we don't have to maintain yet another patch.

[pothos]

The package is also a good place: the drop-in file can be brought in through the ebuild installing it instead of a source patch

[chewi]

Our systemd package is currently forked from Gentoo, but ideally we would unfork it at some point. You could add the drop-in using a post_src_install function. We already do exactly this for timesyncd in sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd.

[chewi]

You don't need to put this in the cros_post_src_install_timesync function. You can create another function called cros_post_src_install_udev.

[chewi]

Sorry, I should have spotted this before. You've based this on the other function, but it doesn't use || die enough and doesn't use ebuild helpers either. Don't feel you have to waste CI time running it again though, a local build is enough to check this.

Suggested change

	mkdir -p "${dir}"
	pushd "${dir}"
	cat <<EOF >flatcar.conf || die
	# In Flatcar we are using modprobe helpers that run depmod in temporary
	# overlay. systemd-udevd.service may try to load drivers for some block devices
	# (e.g. ZFS), which ends up calling our helpers, which invoke mount command.
	# The mount syscalls are forbidden by the default systemd-udevd syscall filter.
	[Service]
	SystemCallFilter=@mount
	EOF
	popd
	insinto "$(systemd_get_systemunitdir)/systemd-udevd.service.d"
	newins - flatcar.conf <<EOF
	# In Flatcar we are using modprobe helpers that run depmod in temporary
	# overlay. systemd-udevd.service may try to load drivers for some block devices
	# (e.g. ZFS), which ends up calling our helpers, which invoke mount command.
	# The mount syscalls are forbidden by the default systemd-udevd syscall filter.
	[Service]
	SystemCallFilter=@mount
	EOF

[danzatt]

Thanks for the feedback! Updated the implementation to use proper ebuild helpers (insinto and newins) as suggested. The code now follows the recommended pattern and should be ready for merging. @chewi

[chewi]

Great! Sorry for all the round trips.

[chewi]

Oops, this should have had a changelog entry. Please use the PR template in future.

[chewi]

The missing changelog has been added to 4515 and the fix (with the changelog) has been backported to 4459.