diff --git a/CLAUDE.md b/CLAUDE.md index ec3d422..ccd0b53 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -28,6 +28,9 @@ files/etc/dot1x/ Supplicant config + RADIUS CA (placeho files/etc/dracut.conf.d/90-diskless.conf no-hostonly + drivers + modules (NM unmanaged split is now runtime: 95dot1x-macsec/nm-unmanaged.sh, secure-mode only) +files/plymouth/themes/fleet/ Custom boot splash (scripted security + checklist; driven by hook status tokens) +files/kiosk/ weston+Chromium kiosk + chromium lockdown policy scripts/extract-artifacts.sh qcow2 -> kernel/initramfs/erofs+verity/cmdline scripts/build-oci.sh ukify + sbsign + roothash gate + OCI image serving/ Lab serving stack: dnsmasq + nginx + SPDK @@ -149,6 +152,13 @@ instead of working around it. build; the supplicant config carries both options. - erofs module availability on the target RHEL kernel (fallback: journal-less ext4 in `extract-artifacts.sh`). +- `fleet` Plymouth theme: confirm (a) the script plugin package actually + installed (`/usr/lib64/plymouth/script.so` — else the build fell back to + `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled + into the initramfs (`lsinitrd | grep -E 'fleet.script|script.so'`), and (c) it + renders (text via `Image.Text` needs the label plugin + a font in the early + initramfs). If blank, the splash silently no-ops but boot continues; ESC shows + the log. Untested in this workspace (needs a display). - `systemd.verity_root_options=hash-offset` is **NOT supported** by Rocky 9.8 systemd-veritysetup (verified: "unknown option hash-offset=" → "Failed to load verity superblock"). Resolved by the documented fallback — data and hash are @@ -195,14 +205,23 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress. stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving stack lives in `serving/` (docker compose). Re-enable security by dropping the var / setting `DISABLE_DOT1X: "false"` in the CI workflow. -- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for a - Plymouth graphical splash (theme `spinner`, set in the provisioner); `false` - bakes `plymouth.enable=0` for a verbose console boot — keep it OFF while - debugging the boot chain. Plymouth is always in the image + initramfs (the - `plymouth` dracut module, which pulls `drm`); only the cmdline changes. CI - currently sets `BOOT_SPLASH: "false"` during the network-manager bench-verify. - Press ESC at boot to see details behind a splash. ks.cfg no longer excludes - `plymouth`. +- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for the + Plymouth splash; `false` bakes `plymouth.enable=0` for a verbose console boot — + keep OFF while debugging the boot chain. Plymouth is always in the image + + initramfs (the `plymouth` dracut module, which pulls `drm`); only the cmdline + changes. Press ESC at boot to see details behind a splash. ks.cfg no longer + excludes `plymouth`. +- **Splash theme = custom `fleet`** (`files/plymouth/themes/fleet/`, script + plugin, asset-free — drawn with `Image.Text`). It renders a security-handshake + checklist (TPM → 802.1X → MACsec → Network → NVMe-oF) driven by best-effort + `plymouth update --status=` calls from the dracut hooks + (`dot1x-macsec-up.sh`, `nvmf-connect.sh`). Tokens: `mode-test` (marks + auth/MACsec skipped), `tpm|dot1x|macsec|net|nvme`-`active|done`. **Rules:** the + emits are non-fatal (`plymouth … || true`) and must never reorder the + load-bearing boot sequence; show only STATES, never per-host data (invariant + #1). The provisioner installs the script plugin best-effort and **falls back to + the stock `spinner` theme** if `script.so` is absent, so a plugin-package-name + change can't break the build. ## Testing changes diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl index 855e780..a3f445b 100644 --- a/diskless.pkr.hcl +++ b/diskless.pkr.hcl @@ -212,6 +212,13 @@ build { destination = "/tmp/" } + # Custom 'fleet' Plymouth theme (scripted security-handshake splash). Staged to + # /tmp/plymouth, installed + set default in the package step before dracut runs. + provisioner "file" { + source = "files/plymouth" + destination = "/tmp/" + } + # --- 2. Packages, configs, diskless adaptations -------------------------- provisioner "shell" { inline = [ @@ -228,13 +235,21 @@ build { # dracut warns and silently falls back to gzip (a larger initramfs). "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl", - # Plymouth boot splash. plymouth-scripts provides plymouth-set-default-theme; - # spinner is the clean modern theme. Set the default theme BEFORE the dracut - # build below so the (-no-hostonly) initramfs bundles it; no -R here because - # we rebuild the initramfs explicitly. Whether the splash shows at boot is - # decided by the cmdline (boot_splash var), not by installing this. - "dnf -y install plymouth plymouth-scripts plymouth-theme-spinner", - "plymouth-set-default-theme spinner", + # Plymouth boot splash. The custom scripted 'fleet' theme renders the + # security-handshake checklist driven by the dracut hooks + # (`plymouth update --status=...`). plymouth-plugin-label gives Image.Text + # its font rendering; dejavu fonts back it. The script-plugin package name + # has varied across releases, so install it best-effort and FALL BACK to the + # stock 'spinner' theme if script.so is absent — never break the build over + # the theme. Set the default theme BEFORE the dracut build below so the + # (--no-hostonly) initramfs bundles the theme + its plugin + a font; no -R + # (we rebuild the initramfs explicitly). Whether the splash shows at boot is + # gated by the cmdline (boot_splash var), not by installing this. + "dnf -y install plymouth plymouth-scripts plymouth-plugin-label dejavu-sans-fonts", + "dnf -y install plymouth-plugin-script 2>/dev/null || dnf -y install plymouth-theme-script 2>/dev/null || true", + "cp -a /tmp/plymouth/themes/fleet /usr/share/plymouth/themes/fleet", + "if [ -e /usr/lib64/plymouth/script.so ]; then plymouth-set-default-theme fleet; echo '==> plymouth theme: fleet (scripted security splash)'; else dnf -y install plymouth-theme-spinner && plymouth-set-default-theme spinner; echo 'WARNING: plymouth script plugin (script.so) missing — using spinner; fleet security splash unavailable' >&2; fi", + "rm -rf /tmp/plymouth", # Stage etc files into place "install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem /etc/dot1x/radius-ca.pem", diff --git a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh index d718a01..3ab4416 100755 --- a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh +++ b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh @@ -15,6 +15,11 @@ STAMP=/run/dot1x/.done [ -e "$STAMP" ] && exit 0 mkdir -p /run/dot1x /run/wpa_supplicant +# Best-effort boot-splash status for the 'fleet' Plymouth theme. NEVER fatal and +# NEVER reorders anything — a splash call must not perturb the load-bearing +# auth -> macsec -> DHCP -> NVMe sequence below. No-op if plymouth isn't running. +ply() { plymouth update --status="$1" 2>/dev/null || true; } + # --- knobs (override on the kernel cmdline) --------------------------------- NIC=$(getarg rd.dot1x.if=) if [ -z "$NIC" ]; then @@ -42,6 +47,7 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX" # networks only. Remove rd.dot1x=0 from the cmdline to restore full security. if [ "$(getarg rd.dot1x=)" = "0" ]; then warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security" + ply mode-test # splash: mark TPM/802.1X/MACsec rows as skipped (not failed) # Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline: # dracut's network module brings the NIC up, gets a lease and writes # resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second @@ -70,6 +76,7 @@ if [ "$(getarg rd.dot1x=)" = "0" ]; then fi # --- 1. client certificate out of TPM NV ------------------------------------ +ply tpm-active if [ ! -s /run/dot1x/client.pem ]; then if ! tpm2_nvread -T device:/dev/tpmrm0 "$NVINDEX" -o /run/dot1x/client.der; then warn "dot1x-macsec: tpm2_nvread failed — cannot authenticate" @@ -77,6 +84,7 @@ if [ ! -s /run/dot1x/client.pem ]; then fi openssl x509 -inform DER -in /run/dot1x/client.der -out /run/dot1x/client.pem fi +ply tpm-done # --- 2. supplicant as a root storage daemon --------------------------------- ip link set "$NIC" up @@ -88,6 +96,7 @@ if [ ! -e /run/dot1x/wpa.pid ]; then -c /etc/dot1x/wpa_supplicant-dot1x.conf \ -P /run/dot1x/wpa.pid" & fi +ply dot1x-active # --- 3. wait for authentication + macsec0 ----------------------------------- i=0 @@ -104,9 +113,13 @@ if [ "$i" -ge "$TIMEOUT" ]; then exit 1 fi info "dot1x-macsec: port authorized, macsec0 up after ${i}s" +ply dot1x-done +ply macsec-active # --- 4. address the secure interface; netroot rides on macsec0 -------------- ip link set macsec0 up +ply macsec-done +ply net-active # DHCP on macsec0 via NetworkManager (NOT the old network-legacy `ifup`): NM owns # macsec0, so it RENEWS the lease in the running system after switch-root — the # whole point of the network-manager port. macsec0 was created externally by @@ -127,6 +140,7 @@ if [ "$i" -ge "$TIMEOUT" ]; then exit 1 fi info "dot1x-macsec: macsec0 addressed via NetworkManager (DHCP)" +ply net-done # --- 5. derive per-host NVMe identity from the TPM certificate -------------- # Keeps the image fleet-generic: the host NQN is a function of the machine diff --git a/files/dracut/95dot1x-macsec/nvmf-connect.sh b/files/dracut/95dot1x-macsec/nvmf-connect.sh index b16b8ad..cb29e60 100644 --- a/files/dracut/95dot1x-macsec/nvmf-connect.sh +++ b/files/dracut/95dot1x-macsec/nvmf-connect.sh @@ -29,6 +29,12 @@ _trsvcid=${_rest##*,} # nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists. modprobe nvme_tcp 2>/dev/null +# Best-effort boot-splash status for the 'fleet' Plymouth theme (never fatal). By +# the time this runs the ip=dhcp link is up, so mark Network done and NVMe active. +ply() { plymouth update --status="$1" 2>/dev/null || true; } +ply net-done +ply nvme-active + # Keep-alive / reconnect tuning for the ROOT device. These persist across # switch-root (the in-kernel nvme-tcp controller and its opts survive). # -k 30 keep-alive timeout (s). The 5s default means a KA every 2.5s; under @@ -53,6 +59,7 @@ while [ "$_i" -lt 60 ]; do if [ -b "$_ns" ]; then mkdir -p /run/dot1x : > /run/dot1x/.nvmf-connected + ply nvme-done echo "nvmf-connect: connected ${_trtype}/${_traddr}/${_trsvcid} ($_ns)" exit 0 fi diff --git a/files/plymouth/themes/fleet/fleet.plymouth b/files/plymouth/themes/fleet/fleet.plymouth new file mode 100644 index 0000000..9fc93ea --- /dev/null +++ b/files/plymouth/themes/fleet/fleet.plymouth @@ -0,0 +1,8 @@ +[Plymouth Theme] +Name=Fleet +Description=Cyber sci-fi secure diskless bring-up splash (TPM / 802.1X / MACsec / NVMe-oF). Driven by `plymouth update --status=` tokens from the dracut hooks. +ModuleName=script + +[script] +ImageDir=/usr/share/plymouth/themes/fleet +ScriptFile=/usr/share/plymouth/themes/fleet/fleet.script diff --git a/files/plymouth/themes/fleet/fleet.script b/files/plymouth/themes/fleet/fleet.script new file mode 100644 index 0000000..d197b46 --- /dev/null +++ b/files/plymouth/themes/fleet/fleet.script @@ -0,0 +1,109 @@ +# Fleet — cyber sci-fi secure-bring-up splash (Plymouth "script" plugin). +# +# Asset-free on purpose: everything is drawn with Image.Text, so the repo carries +# no binary images. The dracut hooks drive it with `plymouth update --status=` +# (see dot1x-macsec-up.sh / nvmf-connect.sh); this script maps each token to a +# security-handshake checklist and pulses the in-progress step. Tokens are +# best-effort and order-independent — anything not reported just stays "pending", +# and in rd.dot1x=0 test mode the auth/MACsec rows are marked "skipped" (never +# "failed"). No per-host data is ever shown (only states), per the no-state rule. + +# ---- background (dark teal -> black) ---- +Window.SetBackgroundTopColor(0.00, 0.05, 0.07); +Window.SetBackgroundBottomColor(0.00, 0.00, 0.00); + +sw = Window.GetWidth(); +sh = Window.GetHeight(); + +# ---- title / subtitle ---- +title_img = Image.Text("F L E E T", 0.0, 1.0, 0.85, 1, "Sans Bold 36"); +title = Sprite(title_img); +title.SetX(sw / 2 - title_img.GetWidth() / 2); +title.SetY(sh / 2 - 150); + +sub_img = Image.Text("secure diskless bring-up", 0.30, 0.65, 0.65, 1, "Sans 14"); +sub = Sprite(sub_img); +sub.SetX(sw / 2 - sub_img.GetWidth() / 2); +sub.SetY(sh / 2 - 102); + +# ---- handshake stages ---- +# state per stage: 0 pending, 1 active, 2 done, 3 skipped +n = 5; +label[0] = "TPM identity"; +label[1] = "802.1X EAP-TLS"; +label[2] = "MACsec link"; +label[3] = "Network (DHCP)"; +label[4] = "NVMe-oF root"; + +col_x = sw / 2 - 150; +row_y = sh / 2 - 36; +row_h = 34; + +fun draw(i) { + glyph = "[ ]"; r = 0.22; g = 0.42; b = 0.42; # pending (dim teal) + if (state[i] == 1) { glyph = "[>>]"; r = 1.00; g = 0.72; b = 0.10; } # active (amber) + if (state[i] == 2) { glyph = "[OK]"; r = 0.10; g = 1.00; b = 0.50; } # done (neon green) + if (state[i] == 3) { glyph = "[--]"; r = 0.30; g = 0.30; b = 0.36; } # skipped (grey) + img = Image.Text(glyph + " " + label[i], r, g, b, 1, "Sans 16"); + row[i].SetImage(img); + row[i].SetX(col_x); + row[i].SetY(row_y + i * row_h); + row[i].SetOpacity(1.0); +} + +i = 0; +while (i < n) { + state[i] = 0; + row[i] = Sprite(); + draw(i); + i = i + 1; +} + +# ---- footer ---- +foot_img = Image.Text("erofs + dm-verity • NVMe/TCP • no per-host state", + 0.25, 0.45, 0.45, 1, "Sans 11"); +foot = Sprite(foot_img); +foot.SetX(sw / 2 - foot_img.GetWidth() / 2); +foot.SetY(sh / 2 + 150); + +# ---- status tokens from the boot hooks ---- +fun set(i, s) { state[i] = s; draw(i); } + +fun on_status(t) { + if (t == "mode-test") { set(0, 3); set(1, 3); set(2, 3); } + if (t == "tpm-active") set(0, 1); + if (t == "tpm-done") set(0, 2); + if (t == "dot1x-active") set(1, 1); + if (t == "dot1x-done") set(1, 2); + if (t == "macsec-active") set(2, 1); + if (t == "macsec-done") set(2, 2); + if (t == "net-active") set(3, 1); + if (t == "net-done") set(3, 2); + if (t == "nvme-active") set(4, 1); + if (t == "nvme-done") set(4, 2); +} +Plymouth.SetUpdateStatusFunction(on_status); + +# ---- optional free-text line (e.g. warnings via `plymouth message`) ---- +msg = Sprite(); +fun on_message(text) { + img = Image.Text(text, 0.55, 0.80, 0.80, 1, "Sans 12"); + msg.SetImage(img); + msg.SetX(sw / 2 - img.GetWidth() / 2); + msg.SetY(sh / 2 + 182); +} +Plymouth.SetMessageFunction(on_message); + +# ---- pulse the in-progress row ---- +tick = 0; +fun on_refresh() { + tick = tick + 1; + o = 1.0; + if (tick % 24 < 12) o = 0.45; + i = 0; + while (i < n) { + if (state[i] == 1) row[i].SetOpacity(o); + i = i + 1; + } +} +Plymouth.SetRefreshFunction(on_refresh);