From 32c8ef9b4bbbb121b15c43c7ad35828673d66e12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 13 Jan 2026 17:14:30 +0400 Subject: [PATCH 1/4] Fix ~/.local/bin installation instructions --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 86cd35a678..30c32a247b 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ might have to add `~/.local/bin` to your user's `PATH`. ```shell git clone https://github.com/systemd/mkosi -ln -s $PWD/mkosi/bin/mkosi ~/.local/bin/mkosi +ln -s $PWD/bin/mkosi ~/.local/bin/mkosi mkosi --version ``` From 0ce330a5ad942a0ba708d5c681de724cbf5d17ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 13 Jan 2026 17:15:21 +0400 Subject: [PATCH 2/4] Don't copy IMA attributes, that requires CAP_MAC_ADMIN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ‣ Validating certificates and keys cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted cp: setting attribute 'security.ima' for 'security.ima': Operation not permitted ‣ "cp --recursive --no-dereference --preserve=mode,links,timestamps,ownership,xattr --reflink=auto --copy-contents /work/usr/share/crypto-policies/back-ends/DEFAULT /work/home/elmarco/.cache/mkosi/mkosi-workspace-5c6zgtv2/sandbox/etc/crypto-policies/back-ends --no-target-directory" returned non-zero exit code 1. --- mkosi/tree.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/mkosi/tree.py b/mkosi/tree.py index 2e577c8a8f..662dc22ec1 100644 --- a/mkosi/tree.py +++ b/mkosi/tree.py @@ -98,6 +98,12 @@ def tree_has_selinux_xattr(path: Path) -> bool: ) +def tree_has_ima_xattr(path: Path) -> bool: + return any( + "security.ima" in os.listxattr(p, follow_symlinks=False) for p in (path, *path.rglob("*")) + ) + + def copy_tree( src: Path, dst: Path, @@ -118,9 +124,16 @@ def copy_tree( attrs = "mode,links" if preserve: attrs += ",timestamps,ownership" + with_xattrs = True # Trying to copy selinux xattrs to overlayfs fails with "Operation not supported" in containers. if statfs(os.fspath(dst.parent)) != OVERLAYFS_SUPER_MAGIC or not tree_has_selinux_xattr(src): + with_xattrs = False + + if tree_has_ima_xattr(src): + with_xattrs = False + + if with_xattrs: attrs += ",xattr" def copy() -> None: From 45c5ef4618b084db11d3d0d83e0e63b1ac942a96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 13 Jan 2026 18:55:26 +0400 Subject: [PATCH 3/4] mkosi-tools: install systemd-boot-unsigned on fedora MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ‣ An EFI bootable image with systemd-boot was requested but a systemd-boot binary was not found at /usr/lib/systemd/boot/efi This is required to provide /usr/lib/systemd/boot/efi/systemd-bootx64.efi --- mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf index bc2cc87bcf..0150472fe5 100644 --- a/mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf +++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf @@ -12,3 +12,4 @@ Packages= erofs-utils pkcs11-provider python3-pefile + systemd-boot-unsigned From 8b9a7aa9f9f220e03f8e25610c54d6fa952f5944 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 13 Jan 2026 19:06:42 +0400 Subject: [PATCH 4/4] qemu: remove dead code Dead since commit 634b0ef4c7ee7ccd3196b2f6cc1e1549ba316260. --- mkosi/qemu.py | 8 -------- 1 file changed, 8 deletions(-) diff --git a/mkosi/qemu.py b/mkosi/qemu.py index 6617677bfd..322c688c0f 100644 --- a/mkosi/qemu.py +++ b/mkosi/qemu.py @@ -318,14 +318,6 @@ def unshare_version() -> str: return run(["unshare", "--version"], stdout=subprocess.PIPE).stdout.strip().split()[-1] -def systemd_escape(config: Config, s: PathString, path: bool = False) -> str: - cmdline = ["systemd-escape", s] - if path: - cmdline += ["--path"] - - return run(cmdline, stdout=subprocess.PIPE, sandbox=config.sandbox()).stdout.strip() - - @contextlib.contextmanager def start_virtiofsd( config: Config,