search

linux-system-roles / nbde_client

Ansible role for configuring Network Bound Disk Encryption clients (e.g. clevis)
https://linux-system-roles.github.io/nbde_client/
MIT License
14 stars 24 forks source link

Place files in /usr/local instead of /usr #155

Closed maddymeows closed 5 months ago

maddymeows commented 5 months ago

Ideally the role uses /usr/local instead of /usr, as /usr is typically reserved for package managers. Some systems may also leave /usr read only with a writeable /usr/local, like in ostree based systems.

I'm unsure if dracut supports /usr/local/lib/dracut as an additional path however, but a rough equivalent of the network flushing scripts can be achieved via NetworkManager config to place in /etc/NetworkManager/conf.d/ like this:

[device]
keep-configuration=no
allowed-connections=except:origin:nm-initrd-generator
richm commented 5 months ago

which files should be in /usr/local?

maddymeows commented 5 months ago

The role installs several files into /usr/bin and /usr/lib instead of the /usr/local/bin and /usr/local/lib counterparts to achieve network flushing:

maddymeows commented 5 months ago

Experimenting myself, sadly dracut doesn't seem to support /usr/local.

I believe the NetworkManager config snippet I provided would be a good replacement for the current network flushing behaviour, but it only works for el8 and up.

On el7 nmcli con up eth0 on startup seems to work, as the ifcfg script doesn't seem to persist on disk, but I'm unsure if that's a good solution. Maybe el7 support could be dropped however, as maintenance support is ending in 2 months.

sergio-correia commented 5 months ago

I like the config snippet, as it is much cleaner and simple. If it works fine, let's use it, sure. Perhaps we could use the old approach for el7 and use this better solution for el8+.