Network Manager refactor

files/dracut/95dot1x-macsec/module-setup.sh

@@ -11,7 +11,10 @@ check() {
 }
 
 depends() {
-    echo "network-legacy bash"
+    # network-manager (not network-legacy): NM renews the DHCP lease in the real
+    # root after switch-root (the legacy one-shot lease was never renewed). The
+    # secure path drives DHCP on macsec0 via nmcli instead of the old `ifup`.
+    echo "network-manager bash"
     return 0
 }
 
@@ -29,7 +32,9 @@ install() {
     # distro's dracut nvmf module populates discovery.conf but never registers
     # an initqueue/online autoconnect hook). The nvmf module installs nvme too,
     # but list it here so the hook's dependency is explicit and load-order-safe.
-    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
+    # nmcli: the secure path brings macsec0 up via NetworkManager (DHCP+renewal)
+    # instead of the old network-legacy `ifup`.
+    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid nmcli \
         grep sed cut tr sha256sum sleep mkdir nvme
 
     # TSS libraries that tpm2_nvread dlopens
@@ -39,6 +44,13 @@ install() {
     inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
     inst_simple /etc/dot1x/radius-ca.pem             /etc/dot1x/radius-ca.pem
 
+    # cmdline-stage hook (runs BEFORE NetworkManager starts): in secure mode it
+    # drops /run/NetworkManager/conf.d/10-dot1x-unmanaged.conf so NM never grabs
+    # the physical EAPOL NIC (wpa_supplicant owns it). No-op in rd.dot1x=0 test
+    # mode, so NM manages+renews the boot NIC. Replaces the old static
+    # 99-dot1x-unmanaged.conf, which couldn't be mode-aware.
+    inst_hook cmdline 10 "$moddir/nm-unmanaged.sh"
+
     # Hook: runs from the initqueue once the NIC exists, before netroot
     inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"