systemd-run seems to be not working

[mvo5]

I tried to use systemd-run in the initramfs to run the "fde-reveal-key" binary. It seems this is not quite working yet, see the attached screenshot.

[xnox]

Ah, cute.

Will check...... it might be that systemd-run requires dbus to be up. I would have hoped that it can work without dbus.... over the private socket.

[mvo5]

If it's too hard/annoying just let us know, it would be lovely to be able to use it but we can try to talk to the private socket if the systemd-run binary is doing weird stuff

[xnox]

If it's too hard/annoying just let us know, it would be lovely to be able to use it but we can try to talk to the private socket if the systemd-run binary is doing weird stuff

i will double check things. It should be able to do all the things. And no, one would not want to reimplement the systemd-run argument regeneration.

[xnox]

@mvo what are the exact arguments use to systemd-run?

        if (arg_wait || arg_stdio != ARG_STDIO_NONE)
                r = bus_connect_transport(arg_transport, arg_host, arg_user, &bus);
        else
                r = bus_connect_transport_systemd(arg_transport, arg_host, arg_user, &bus);
        if (r < 0)
                return log_error_errno(r, "Failed to create bus connection: %m");

It looks like if wait is used; or one wants to collect output / connect to --pipe or --pty; we must ship dbus.service and start it.

Otherwise local transport (private systemd socket) is used.

[mvo5]

We use pipe, we could maybe try to avoid doing that. Need to look but we need the resulting output.

[mvo5]

@xnox in various meetings but I can try to drive this without --pipe or --pty

[xnox]

@xnox in various meetings but I can try to drive this without --pipe or --pty

$ systemd-run -p StandardOutput=append:/run/stdout hello
Running as unit: run-u166.service
$ cat /run/stdout 
Hello, world!

Most stanzas of any unit can be set via -p "universal property" option.

[xnox]

note that stnadardOutput takes a socket or fd:name too. So you could invoke this in such a way that it goes direct to socket or fd that is slurped up by snapd.

To avoid leaving any files on any filesystem.

[mvo5]

Hm, we also use "--wait" :/ so this requires some way via systemctl to wait for this in a nice way

[mvo5]

@pedronis Not being able to use "--wait" is a bummer, let's sync on Monday and talk about ditching systemd-run and doing something using seccomp-golang instead.

[xnox]

@pedronis Not being able to use "--wait" is a bummer, let's sync on Monday and talk about ditching systemd-run and doing something using seccomp-golang instead.

if you need wait, i can ship dbus, dbus.service and then it will work. will make initrd larger and have on more daemon running just to call this thing.

Instead of wait, you can do like ExecStartPost=snap fde-util-finished or some such. But it means async code, needing a goroutine and an await.

[mvo5]

We implemented a workaround now