From cbd92baae73d483c2ed225f604cc6caf32e9069c Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sun, 14 Jun 2026 08:23:52 +0000
Subject: [PATCH] Fix missing head command

---
 docs/TODO.md                                   |  8 ++++++++
 files/dracut/95dot1x-macsec/dot1x-macsec-up.sh | 11 +++++++++--
 files/dracut/95dot1x-macsec/module-setup.sh    |  6 +++++-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/docs/TODO.md b/docs/TODO.md
index 9d10b50..ad4480a 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -165,6 +165,14 @@ export is read-only + single-namespace = inherently small attack surface.
 - **Confine the target** (whichever): unprivileged, drop caps, seccomp +
   SELinux/AppArmor profile, read-only container, minimal mounts; minimal
   immutable serving image, digest-pinned.
+- **Slim the SPDK image (multi-stage build)**: the current single-stage
+  from-source image is ~600 MB (it keeps the whole toolchain — gcc, meson/ninja,
+  kernel headers, the python venv — plus the SPDK/DPDK source and build trees).
+  Convert `serving/spdk/Dockerfile` to a builder stage + a minimal runtime stage
+  that copies only `nvmf_tgt` + its `ldd` shared libs (libnuma, libssl/crypto,
+  libuuid, libaio…) + `rpc.py`/`python3`. Expect ~150–250 MB (debian-slim base
+  or a static SPDK link trims further). Smaller attack surface + faster pulls,
+  and it pairs with the confinement above.
 - **Network-isolate :4420** so only the boot VLAN reaches the target (compose
   with 802.1X/MACsec segmentation in prod).
 - **Replicas** behind distinct discovery entries (availability is the real risk
diff --git a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
index a211b72..44b9383 100755
--- a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+++ b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
@@ -17,8 +17,15 @@ mkdir -p /run/dot1x /run/wpa_supplicant
 
 # --- knobs (override on the kernel cmdline) ---------------------------------
 NIC=$(getarg rd.dot1x.if=)
-# shellcheck disable=SC2010  # /sys/class/net names are kernel ifnames; ls|grep is safe here
-[ -n "$NIC" ] || NIC=$(ls /sys/class/net | grep -vE '^(lo|macsec)' | head -1)
+if [ -z "$NIC" ]; then
+    # First non-loopback, non-macsec interface. Pure shell — ls/grep/head are
+    # not guaranteed to exist in the initramfs.
+    for _dev in /sys/class/net/*; do
+        _name=${_dev##*/}
+        case "$_name" in lo|macsec*) continue ;; esac
+        NIC=$_name; break
+    done
+fi
 NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
 TIMEOUT=$(getarg rd.dot1x.timeout=); [ -n "$TIMEOUT" ] || TIMEOUT=60
 
diff --git a/files/dracut/95dot1x-macsec/module-setup.sh b/files/dracut/95dot1x-macsec/module-setup.sh
index 6e675c7..cae3e98 100755
--- a/files/dracut/95dot1x-macsec/module-setup.sh
+++ b/files/dracut/95dot1x-macsec/module-setup.sh
@@ -22,7 +22,11 @@ installkernel() {
 }
 
 install() {
-    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid
+    # wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
+    # RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
+    # present by default, so list everything the hook uses.
+    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
+        grep sed cut tr sha256sum sleep mkdir
 
     # TSS libraries that tpm2_nvread dlopens
     inst_libdir_file "libtss2-*"