varlink: add varlink interface for syncing fwupd capsule updates across ESPs

Cargo.toml

@@ -44,6 +44,8 @@ tempfile = "^3.26"
 uapi-version = "0.4.0"
 walkdir = "2.3.2"
 signal-hook-registry = "1.4.8"
+zlink = { version = "0.7.0", default-features = false, features = ["tokio", "service", "tracing"] }
+tokio = { version = "1.53", default-features = false, features = ["rt"] }
 
 # EFI-only dependencies
 [target.'cfg(any(target_arch = "x86_64", target_arch = "aarch64", target_arch = "riscv64"))'.dependencies]

Makefile

@@ -43,7 +43,7 @@ install-grub-static:
 
 .PHONY: install-systemd-unit
 install-systemd-unit:
-	install -m 644 -D -t "${DESTDIR}$(PREFIX)/lib/systemd/system/" systemd/bootloader-update.service
+	install -m 644 -D -t "${DESTDIR}$(PREFIX)/lib/systemd/system/" systemd/bootloader-update.service systemd/bootupd-varlink.service systemd/bootupd-varlink.socket
 
 .PHONY: install-all
 install-all: install install-grub-static install-systemd-unit

contrib/packaging/bootupd.spec

@@ -56,6 +56,8 @@ Conflicts:      bootc < 1.14.1
 %{_prefix}/lib/bootupd/grub2-static/
 %{_prefix}/lib/bootupd/packagesystem/query-file-owner
 %{_unitdir}/bootloader-update.service
+%{_unitdir}/bootupd-varlink.socket
+%{_unitdir}/bootupd-varlink.service
 
 %prep
 %autosetup -n %{crate}-%{version} -p1 -a1

src/backend/statefile.rs

@@ -65,7 +65,7 @@ fn get_parent_device(root: &Dir) -> Result<Device> {
 
 impl SavedState {
     /// System-wide bootupd write lock (relative to sysroot).
-    const WRITE_LOCK_PATH: &'static str = "run/bootupd-lock";
+    pub(crate) const WRITE_LOCK_PATH: &'static str = "run/bootupd-lock";
     /// Top-level directory for statefile (relative to sysroot).
     pub(crate) const STATEFILE_DIR: &'static str = "boot";
     /// On-disk bootloader statefile, akin to a tiny rpm/dpkg database,

src/cli/bootupd.rs

@@ -1,5 +1,7 @@
 use crate::bootloader::Bootloader;
 use crate::bootupd::{self, ConfigMode};
+#[cfg(efi_arch)]
+use crate::varlink;
 use anyhow::{Context, Result};
 use camino::Utf8Path;
 use cap_std::ambient_authority;
@@ -42,6 +44,9 @@ pub enum DVerb {
     Install(InstallOpts),
     #[cfg(efi_arch)]
     SetDefaultBootloader(DefaultBootloaderOpts),
+    #[cfg(efi_arch)]
+    #[clap(name = "varlink", hide = true, about = "Run the varlink service")]
+    Varlink,
 }
 
 #[derive(Debug, Parser)]
@@ -116,6 +121,8 @@ impl DCommand {
             DVerb::GenerateUpdateMetadata(opts) => Self::run_generate_meta(opts),
             #[cfg(efi_arch)]
             DVerb::SetDefaultBootloader(opts) => Self::set_default_bootloader(opts),
+            #[cfg(efi_arch)]
+            DVerb::Varlink => Self::run_varlink_service(),
         }
     }
 
@@ -178,4 +185,9 @@ impl DCommand {
 
         Ok(())
     }
+
+    #[cfg(efi_arch)]
+    fn run_varlink_service() -> Result<()> {
+        varlink::run_varlink_service()
+    }
 }

src/efi.rs

@@ -106,7 +106,7 @@ const ESP_MOUNT_FLAGS: MountFlags =
 const ESP_MOUNT_DATA: &std::ffi::CStr = c"fmask=0177,dmask=0077";
 
 /// Mount the ESP from the provided device into a temporary directory.
-fn mount_esp(device: &str) -> Result<TempMount> {
+pub(crate) fn mount_esp(device: &str) -> Result<TempMount> {
     TempMount::mount_dev(device, "vfat", ESP_MOUNT_FLAGS, Some(ESP_MOUNT_DATA))
 }
 

src/main.rs

@@ -49,6 +49,8 @@ mod packagesystem;
 mod secureboot;
 mod sha512string;
 mod util;
+#[cfg(efi_arch)]
+mod varlink;
 
 use clap::crate_name;
 

src/varlink.rs

@@ -0,0 +1,243 @@
+use anyhow::{anyhow, Context};
+use cap_std::{ambient_authority, fs::Dir};
+use cap_std_ext::dirext::CapStdExtDirExt;
+use log::info;
+use std::{
+    fs::create_dir_all,
+    io::{copy, Write},
+    os::{
+        fd::IntoRawFd,
+        unix::io::{FromRawFd, OwnedFd},
+    },
+    path::{Path, PathBuf},
+};
+
+use crate::{
+    bootupd::list_dev_current_root, efi, freezethaw::fsfreeze_thaw_cycle, model::SavedState,
+};
+
+const SOCKET_PATH: &str = "/run/bootupd/org.coreos.bootupd1";
+
+/// Find the ESP device matching a given partition UUID
+fn find_esp_by_partuuid<'a>(
+    devices: &'a [bootc_internal_blockdev::Device],
+    partuuid: &str,
+) -> Option<&'a bootc_internal_blockdev::Device> {
+    devices.iter().find(|d| {
+        d.partuuid
+            .as_deref()
+            .is_some_and(|u| u.eq_ignore_ascii_case(partuuid))
+    })
+}
+
+/// Validate that a given path is a valid capsule directory
+fn validate_capsule_dir(capsule_dir: &Path) -> Result<(), BootupdVarlinkError> {
+    // Must be relative
+    if capsule_dir.is_absolute() {
+        return Err(BootupdVarlinkError::new(
+            "capsule_dir must be relative to the ESP".into(),
+        ));
+    }
+
+    // Must not contain path traversal components
+    if capsule_dir
+        .components()
+        .any(|c| c == std::path::Component::ParentDir)
+    {
+        return Err(BootupdVarlinkError::new(
+            "capsule_dir must not contain '..' components - path traversal not allowed".into(),
+        ));
+    }
+
+    Ok(())
+}
+
+#[derive(Debug, Clone, zlink::ReplyError, zlink::introspect::ReplyError)]
+#[zlink(interface = "org.coreos.bootupd1")]
+enum BootupdVarlinkError {
+    Failed { message: String },
+}
+
+impl BootupdVarlinkError {
+    fn new(message: String) -> Self {
+        Self::Failed { message }
+    }
+}
+
+impl From<anyhow::Error> for BootupdVarlinkError {
+    fn from(err: anyhow::Error) -> Self {
+        log::error!("varlink call failed: {err:#}");
+        Self::Failed {
+            message: format!("{err:#}"),
+        }
+    }
+}
+
+struct BootupdVarlinkService;
+
+#[zlink::service(interface = "org.coreos.bootupd1")]
+impl BootupdVarlinkService {
+    /// Sync capsule update files from a "primary" ESP to all colocated ESPs.
+    ///
+    /// partuuid: GPT partition UUID of the ESP containing the source capsule files.
+    /// capsule_dir: Path to the directory containing the source capsule files, relative
+    ///              to the ESP root (e.g. "EFI/fedora/fw")
+    #[allow(clippy::unused_async)]
+    async fn sync_fwupd_updates(
+        &mut self,
+        partuuid: &str,
+        capsule_dir: &str,
+    ) -> Result<(), BootupdVarlinkError> {
+        if partuuid.is_empty() {
+            return Err(BootupdVarlinkError::new(
+                "partuuid must not be empty".into(),
+            ));
+        }
+        if capsule_dir.is_empty() {
+            return Err(BootupdVarlinkError::new(
+                "capsule_dir must not be empty".into(),
+            ));
+        }
+
+        let capsule_dir = Path::new(capsule_dir);
+        validate_capsule_dir(capsule_dir)?;
+
+        let root_device = list_dev_current_root()?;
+        let esp_devices = root_device
+            .find_colocated_esps()?
+            .ok_or_else(|| anyhow!("could not find any co-located ESPs"))?;
+
+        // Find the source ESP (the one fwupd wrote to).
+        let primary_device = find_esp_by_partuuid(&esp_devices, partuuid).ok_or_else(|| {
+            BootupdVarlinkError::new(format!("No ESP found with partuuid {partuuid}"))
+        })?;
+
+        // Avoid running at the same time as bootloader updates
+        let sysroot = Dir::open_ambient_dir("/", ambient_authority()).context("opening sysroot")?;
+        let _lock = SavedState::acquire_write_lock("/".into(), sysroot)?;
+
+        // Mount primary ESP and find capsule updates dir
+        let primary_efi = efi::mount_esp(&primary_device.path()).with_context(|| {
+            format!(
+                "Creating temp ESP mount for primary ESP (partuuid: {partuuid}) at {:?}",
+                primary_device.path(),
+            )
+        })?;
+        let primary_mount = primary_efi.dir.path().to_path_buf();
+
+        let src_capsule_path = primary_mount.join(capsule_dir);
+        let src_dir = Dir::open_ambient_dir(&src_capsule_path, ambient_authority())
+            .context("opening source capsule dir")?;
+
+        // Sync to every other co-located ESP.
+        let mut synced_count = 0;
+        for esp in esp_devices.iter() {
+            if esp
+                .partuuid
+                .as_ref()
+                .is_some_and(|u| u.eq_ignore_ascii_case(partuuid))
+            {
+                continue;
+            }
+
+            let secondary_efi = efi::mount_esp(&esp.path()).with_context(|| {
+                format!(
+                    "Creating temp ESP mount for secondary ESP (partuuid: {}) at {:?}",
+                    esp.partuuid.as_deref().unwrap_or("unknown"),
+                    esp.path(),
+                )
+            })?;
+            let dest_mount = secondary_efi.dir.path().to_path_buf();
+
+            let dest_capsule_path = dest_mount.join(capsule_dir);
+            create_dir_all(&dest_capsule_path)
+                .with_context(|| format!("creating {dest_capsule_path:?}"))?;
+
+            let dest_dir = Dir::open_ambient_dir(&dest_capsule_path, ambient_authority())
+                .context("opening destination capsule dir")?;
+
+            for entry in src_dir.entries().context("reading source capsule dir")? {
+                let entry = entry.context("reading dir entry")?;
+                let name = entry.file_name();
+                dest_dir
+                    .atomic_replace_with(&name, |dest_file| -> std::io::Result<()> {
+                        let mut src_file = src_dir.open(&name)?;
+                        copy(&mut src_file, dest_file)?;
+                        dest_file.flush()?;
+                        dest_file.get_ref().as_file().sync_data()
+                    })
+                    .with_context(|| {
+                        format!(
+                            "syncing {name:?} from ESP {partuuid} to ESP {}",
+                            esp.partuuid.as_deref().unwrap_or("unknown")
+                        )
+                    })?;
+            }
+
+            fsfreeze_thaw_cycle(
+                dest_dir
+                    .reopen_as_ownedfd()
+                    .context("reopening dest dir as owned fd")?,
+            )?;
+            drop(dest_dir);
+            drop(secondary_efi);
+
+            synced_count += 1;
+        }
+        info!("successfully synced {capsule_dir:?} from ESP {partuuid} to {synced_count} colocated ESP(s)");
+
+        drop(src_dir);
+        drop(primary_efi);
+
+        Ok(())
+    }
+}
+
+/// Ensure the Unix socket can be created
+fn get_socket() -> anyhow::Result<PathBuf> {
+    let socket_path = PathBuf::from(SOCKET_PATH);
+
+    // Ensure the parent directory exists.
+    if let Some(parent) = socket_path.parent() {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("creating directory {}", parent.display()))?;
+    }
+
+    // Remove any stale socket from a previous run.
+    if let Err(e) = std::fs::remove_file(&socket_path) {
+        if e.kind() != std::io::ErrorKind::NotFound {
+            return Err(e)
+                .with_context(|| format!("removing stale socket {}", socket_path.display()));
+        }
+    }
+
+    Ok(socket_path)
+}
+
+pub fn run_varlink_service() -> anyhow::Result<()> {
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()?
+        .block_on(async {
+            let listener = if std::env::var_os("LISTEN_FDS").is_some() {
+                // Socket-activated
+                let fd = libsystemd::activation::receive_descriptors(false)
+                    .context("receiving socket-activated fds")?
+                    .into_iter()
+                    .next()
+                    .ok_or_else(|| anyhow!("no fds received"))?;
+                // SAFETY: `into_raw_fd` transfers ownership from `FileDescriptor`, ensuring the
+                // fd is valid and not closed elsewhere. `from_raw_fd` takes exclusive ownership.
+                let owned_fd = unsafe { OwnedFd::from_raw_fd(fd.into_raw_fd()) };
+                zlink::tokio::unix::Listener::try_from(owned_fd)
+                    .context("creating listener from socket-activated fd")?
+            } else {
+                // Bind our own socket
+                let socket_path = get_socket()?;
+                zlink::tokio::unix::bind(socket_path)?
+            };
+
+            let server = zlink::Server::new(listener, BootupdVarlinkService);
+            server.run().await.context("running varlink service")
+        })
+}

systemd/bootupd-varlink.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Bootupd Varlink Service
+Documentation=https://github.com/coreos/bootupd
+# Interface only implemented on EFI systems
+ConditionPathExists=/sys/firmware/efi
+
+[Service]
+Type=simple
+# It doesn't make sense to sync ESP updates in "Live" environments.
+# https://github.com/coreos/fedora-coreos-tracker/issues/2136
+ExecCondition=/bin/bash -c '[[ ! $(findmnt -n -o FSTYPE /sysroot) =~ ^(erofs|squashfs)$ ]]'
+ExecStart=/usr/libexec/bootupd varlink
+# Keep this stuff in sync with SYSTEMD_ARGS_BOOTUPD in general
+PrivateNetwork=yes
+ProtectHome=yes
+KillMode=mixed
+MountFlags=slave

systemd/bootupd-varlink.socket

@@ -0,0 +1,12 @@
+[Unit]
+Description=Bootupd Varlink Socket
+Documentation=https://github.com/coreos/bootupd
+# Interface only implemented on EFI systems
+ConditionPathExists=/sys/firmware/efi
+
+[Socket]
+ListenStream=/run/bootupd/org.coreos.bootupd1
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target

tests/kola/varlink/data/libtest.sh

@@ -0,0 +1 @@
+../../data/libtest.sh