From e44dd152670fba4293d04fca2ed368d5f3d4a20e Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Mon, 15 Jun 2026 10:52:43 +0000
Subject: [PATCH] Fix stuff

---
 docs/TODO.md                                |  5 +++++
 files/dracut/95dot1x-macsec/module-setup.sh | 19 +++++++++++++++----
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/docs/TODO.md b/docs/TODO.md
index 91386e4..bfcf2d4 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -157,6 +157,11 @@ boot LAN.
     `nvme connect-all` until the namespace appears. The dracut module installs
     the unit + script and enables it via an `initrd-root-device.target.wants`
     symlink; `diskless.pkr.hcl` hard-asserts the unit is in the initramfs.
+    Gotcha: `$systemdsystemunitdir` is **empty** in this dracut's module-setup
+    context — `inst_simple` then silently drops the unit (empty dest dir). Use a
+    `${systemdsystemunitdir:-/usr/lib/systemd/system}` fallback and `return 1`
+    if the unit didn't land, so the build fails loudly instead of shipping a UKI
+    that can't connect its root.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire
diff --git a/files/dracut/95dot1x-macsec/module-setup.sh b/files/dracut/95dot1x-macsec/module-setup.sh
index be7b0a2..f33d7d7 100755
--- a/files/dracut/95dot1x-macsec/module-setup.sh
+++ b/files/dracut/95dot1x-macsec/module-setup.sh
@@ -51,11 +51,22 @@ install() {
     # deterministically. ConditionKernelCommandLine=rd.dot1x=0 makes it a no-op
     # on the secure path.
     inst_simple "$moddir/nvmf-connect.sh" /usr/sbin/nvmf-connect
-    inst_simple "$moddir/nvmf-connect.service" \
-        "$systemdsystemunitdir/nvmf-connect.service"
-    mkdir -p "${initdir}${systemdsystemunitdir}/initrd-root-device.target.wants"
+
+    # systemdsystemunitdir is normally /usr/lib/systemd/system, but dracut does
+    # not reliably export it into module-setup context here — when empty,
+    # inst_simple's dir handling silently DROPS the unit (the bug that left the
+    # initramfs without nvmf-connect.service). Fall back to the canonical path.
+    local _unitdir="${systemdsystemunitdir:-/usr/lib/systemd/system}"
+    inst_simple "$moddir/nvmf-connect.service" "${_unitdir}/nvmf-connect.service"
+    mkdir -p "${initdir}${_unitdir}/initrd-root-device.target.wants"
     ln -sf ../nvmf-connect.service \
-        "${initdir}${systemdsystemunitdir}/initrd-root-device.target.wants/nvmf-connect.service"
+        "${initdir}${_unitdir}/initrd-root-device.target.wants/nvmf-connect.service"
+    # Hard-fail the dracut build if the unit didn't land — never ship a UKI that
+    # silently can't connect its NVMe-oF root in test mode.
+    if [ ! -e "${initdir}${_unitdir}/nvmf-connect.service" ]; then
+        derror "95dot1x-macsec: nvmf-connect.service not installed into ${_unitdir}"
+        return 1
+    fi
 
     dracut_need_initqueue
 }