ukify: Allow passing path to kernel and initramfs

While building a sealed UKI image we'd want to remove the original
kernel + initramfs from the final image and have only the final UKI
present. This was not possible before as `bootc container ukify`
expected kernel + initramfs to be present in `usr/lib/modules` of
container root

We now accept a parameter `kernel_dir` which must be of the format
`/path/$kernel_ver` for `bootc container ukify`

Fixes: #2185

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

crates/lib/src/cli.rs

@@ -442,6 +442,13 @@ pub(crate) enum ContainerOpts {
         #[clap(long)]
         write_dumpfile_to: Option<Utf8PathBuf>,
 
+        /// The directory containing the kernel and initramfs.img
+        /// Must be of the format /parent/$kernel_version
+        ///
+        /// Ex. /boot/6.18.7-100.fc42.x86_64
+        #[clap(long)]
+        kernel_dir: Option<Utf8PathBuf>,
+
         /// Additional arguments to pass to ukify (after `--`).
         #[clap(last = true)]
         args: Vec<OsString>,
@@ -1902,12 +1909,36 @@ async fn run_from_opt(opt: Opt) -> Result<()> {
                 kargs,
                 allow_missing_verity,
                 write_dumpfile_to,
+                kernel_dir,
                 args,
             } => {
+                let kernel = match kernel_dir {
+                    Some(kernel_dir) => {
+                        let kver = kernel_dir
+                            .components()
+                            .last()
+                            .ok_or_else(|| anyhow::anyhow!("Could not determine kernel version"))?;
+
+                        Some(crate::kernel::KernelInternal {
+                            kernel: crate::kernel::Kernel {
+                                unified: false,
+                                version: kver.to_string(),
+                            },
+                            k_type: crate::kernel::KernelType::Vmlinuz {
+                                path: kernel_dir.join("vmlinuz"),
+                                initramfs: kernel_dir.join("initramfs.img"),
+                            },
+                        })
+                    }
+
+                    None => None,
+                };
+
                 crate::ukify::build_ukify(
                     &rootfs,
                     &kargs,
                     &args,
+                    kernel,
                     allow_missing_verity,
                     write_dumpfile_to.as_deref(),
                 )

crates/lib/src/ukify.rs

@@ -15,6 +15,7 @@ use fn_error_context::context;
 
 use crate::bootc_composefs::digest::compute_composefs_digest;
 use crate::bootc_composefs::status::ComposefsCmdline;
+use crate::kernel::KernelInternal;
 
 /// Build a UKI from the given rootfs.
 ///
@@ -30,6 +31,7 @@ pub(crate) async fn build_ukify(
     rootfs: &Utf8Path,
     extra_kargs: &[String],
     args: &[OsString],
+    kernel: Option<KernelInternal>,
     allow_missing_fsverity: bool,
     write_dumpfile_to: Option<&Utf8Path>,
 ) -> Result<()> {
@@ -52,30 +54,46 @@ pub(crate) async fn build_ukify(
     let root = Dir::open_ambient_dir(rootfs, cap_std_ext::cap_std::ambient_authority())
         .with_context(|| format!("Opening rootfs {rootfs}"))?;
 
-    // Find the kernel
-    let kernel = crate::kernel::find_kernel(&root)?
-        .ok_or_else(|| anyhow::anyhow!("No kernel found in {rootfs}"))?;
+    let kernel_final = match kernel {
+        Some(ref kernel) => kernel,
+        None => &crate::kernel::find_kernel(&root)?
+            .ok_or_else(|| anyhow::anyhow!("No kernel found in {rootfs}"))?,
+    };
 
     // Extract vmlinuz and initramfs paths, or bail if this is already a UKI
-    let (vmlinuz_path, initramfs_path) = match kernel.k_type {
+    let (vmlinuz_path, initramfs_path) = match &kernel_final.k_type {
         crate::kernel::KernelType::Vmlinuz { path, initramfs } => (path, initramfs),
         crate::kernel::KernelType::Uki { path, .. } => {
             anyhow::bail!("Cannot build UKI: rootfs already contains a UKI at {path}");
         }
     };
 
     // Verify kernel and initramfs exist
-    if !root
-        .try_exists(&vmlinuz_path)
-        .context("Checking for vmlinuz")?
-    {
-        anyhow::bail!("Kernel not found at {vmlinuz_path}");
-    }
-    if !root
-        .try_exists(&initramfs_path)
-        .context("Checking for initramfs")?
-    {
-        anyhow::bail!("Initramfs not found at {initramfs_path}");
+    //
+    // NOTE: Not using cap_std here as the vmlinuz/initramfs path from
+    // args can be outside of "rootfs"
+    if kernel.is_some() {
+        if !vmlinuz_path.exists() {
+            anyhow::bail!("Kernel not found at {vmlinuz_path}");
+        }
+
+        if !initramfs_path.exists() {
+            anyhow::bail!("Initramfs not found at {initramfs_path}");
+        }
+    } else {
+        if !root
+            .try_exists(&vmlinuz_path)
+            .context("Checking for vmlinuz")?
+        {
+            anyhow::bail!("Kernel not found at {vmlinuz_path}");
+        }
+
+        if !root
+            .try_exists(&initramfs_path)
+            .context("Checking for initramfs")?
+        {
+            anyhow::bail!("Initramfs not found at {initramfs_path}");
+        }
     }
 
     // Compute the composefs digest
@@ -105,7 +123,7 @@ pub(crate) async fn build_ukify(
         .arg("--initrd")
         .arg(&initramfs_path)
         .arg("--uname")
-        .arg(&kernel.kernel.version)
+        .arg(&kernel_final.kernel.version)
         .arg("--cmdline")
         .arg(&cmdline_str)
         .arg("--os-release")
@@ -134,7 +152,7 @@ mod tests {
         let tempdir = tempfile::tempdir().unwrap();
         let path = Utf8Path::from_path(tempdir.path()).unwrap();
 
-        let result = build_ukify(path, &[], &[], false, None).await;
+        let result = build_ukify(path, &[], &[], None, false, None).await;
         assert!(result.is_err());
         let err = format!("{:#}", result.unwrap_err());
         assert!(
@@ -156,7 +174,7 @@ mod tests {
         )
         .unwrap();
 
-        let result = build_ukify(path, &[], &[], false, None).await;
+        let result = build_ukify(path, &[], &[], None, false, None).await;
         assert!(result.is_err());
         let err = format!("{:#}", result.unwrap_err());
         assert!(

docs/src/man/bootc-container-ukify.8.md

@@ -35,6 +35,10 @@ Any additional arguments after `--` are passed through to ukify unchanged.
 
     Write a dumpfile to this path
 
+**--kernel-dir**=*KERNEL_DIR*
+
+    The directory containing the kernel and initramfs.img Must be of the format /parent/$kernel_version
+
 <!-- END GENERATED OPTIONS -->
 
 # EXAMPLES