From 7fcbe246a79223c8a4f7a7f397f28c2dffb6c7b4 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Fri, 22 Nov 2019 22:15:51 +0000
Subject: [PATCH] Enforce that Ignition run once even if interrupted

I have seen in practice us trying to run Ignition multiple times
if the system is forcibly rebooted before we run the firstboot
complete service, which actually today runs in the real rootfs.

Forcibly prevent this by adding a few tiny new shell scripts
which write a state file to `/boot/ignition.state`.  The first
to run is `ignition-prelaunch.service` which runs even before
`fetch` and bombs out directly if we detect the stamp file
exists.

Next, we have a service which writes the stamp file after `fetch`
and before `disks`.  Finally, another service updates the stamp
file just to signal `complete`.

Note none of these services run on live systems, as there's
no `/boot` there, and Ignition runs every boot anyways.
---
 dracut/30ignition/ignition-finished.service  | 15 +++++++++++++++
 dracut/30ignition/ignition-generator         |  5 +++++
 dracut/30ignition/ignition-prelaunch.service | 19 +++++++++++++++++++
 dracut/30ignition/ignition-started.service   | 18 ++++++++++++++++++
 dracut/30ignition/module-setup.sh            |  3 ++-
 5 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 dracut/30ignition/ignition-finished.service
 create mode 100644 dracut/30ignition/ignition-prelaunch.service
 create mode 100644 dracut/30ignition/ignition-started.service

diff --git a/dracut/30ignition/ignition-finished.service b/dracut/30ignition/ignition-finished.service
new file mode 100644
index 0000000..8595be4
--- /dev/null
+++ b/dracut/30ignition/ignition-finished.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Ignition (log completion)
+DefaultDependencies=false
+Before=ignition-complete.target
+After=basic.target
+
+After=ignition-files.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+MountFlags=slave
+TemporaryFileSystem=/run/boot
+# Flag completion of Ignition, so that we can immediately error out if we detect we started
+ExecStart=/bin/sh -c 'mount /dev/disk/by-label/boot /run/boot && echo completed > /run/boot/ignition.state'
diff --git a/dracut/30ignition/ignition-generator b/dracut/30ignition/ignition-generator
index cea08ce..71b2524 100755
--- a/dracut/30ignition/ignition-generator
+++ b/dracut/30ignition/ignition-generator
@@ -52,6 +52,11 @@ if $(cmdline_bool 'ignition.firstboot' 0); then
 Requires=dev-disk-by\x2dlabel-boot.device
 After=dev-disk-by\x2dlabel-boot.device
 EOF
+
+        # And these units write to /boot too
+        for unit in prelaunch started finished; do
+            add_requires ignition-${unit}.service ignition-complete.target
+        done
     fi
 else
     # If we're doing a non-Ignition (subsequent) boot, then
diff --git a/dracut/30ignition/ignition-prelaunch.service b/dracut/30ignition/ignition-prelaunch.service
new file mode 100644
index 0000000..d5b2d35
--- /dev/null
+++ b/dracut/30ignition/ignition-prelaunch.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Ignition (validate first run)
+DefaultDependencies=false
+Before=ignition-complete.target
+After=basic.target
+
+Before=ignition-fetch.service
+
+Requires=dev-disk-by\x2dlabel-boot.device
+After=dev-disk-by\x2dlabel-boot.device
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+MountFlags=slave
+TemporaryFileSystem=/run/boot
+# Flag completion of Ignition, so that we can immediately error out if we detect we started
+ExecStart=/bin/sh -c 'mount -o ro /dev/disk/by-label/boot /run/boot && if [ -f /run/boot/ignition.state ]; then echo -n "Detected previous run of Ignition:" $(cat /run/boot/ignition.state); exit 1; fi'
+
diff --git a/dracut/30ignition/ignition-started.service b/dracut/30ignition/ignition-started.service
new file mode 100644
index 0000000..55f50e5
--- /dev/null
+++ b/dracut/30ignition/ignition-started.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Ignition (log initiation)
+DefaultDependencies=false
+Before=ignition-complete.target
+After=basic.target
+
+# Run after ignition-setup has run because ignition-setup
+# may copy in new/different ignition configs for us to consume.
+After=ignition-fetch.service
+Before=ignition-disks.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+MountFlags=slave
+TemporaryFileSystem=/run/boot
+# Flag initiation of Ignition, so that we can immediately error out if we detect we started
+ExecStart=/bin/sh -c 'mount /dev/disk/by-label/boot /run/boot && echo started > /run/boot/ignition.state'
diff --git a/dracut/30ignition/module-setup.sh b/dracut/30ignition/module-setup.sh
index 58090dc..98f9caf 100755
--- a/dracut/30ignition/module-setup.sh
+++ b/dracut/30ignition/module-setup.sh
@@ -59,7 +59,8 @@ install() {
     inst_simple "$moddir/ignition-generator" \
         "$systemdutildir/system-generators/ignition-generator"
 
-    for x in "complete" "subsequent" "diskful" "diskful-subsequent"; do
+    for x in "complete" "subsequent" "diskful" "diskful-subsequent"
+             "prelaunch" "started" "finished"; do
         inst_simple "$moddir/ignition-$x.target" \
             "$systemdsystemunitdir/ignition-$x.target"
     done