From dd7962cdcfb60ad6e57a5b041d91e0d1707d7e96 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:07:22 +0000 Subject: op-mode: T9269: report Secure Boot as "n/a (container)" A container is not booted by any firmware, so neither the UEFI nor the BIOS wording applies. Worse, is_uefi_system() probes /sys/firmware/efi which a container inherits from its host, thus a container on a UEFI host reported the Secure Boot state of that host. Check is_running_as_container() first and report "n/a (container)", leaving the UEFI and BIOS detection untouched for everything else. --- src/op_mode/version.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/op_mode/version.py b/src/op_mode/version.py index b93e3081b..d6d8aaca1 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -26,6 +26,7 @@ import vyos.version import vyos.limericks from vyos.utils.boot import is_uefi_system +from vyos.system.image import is_running_as_container from vyos.utils.system import get_secure_boot_state from jinja2 import Template @@ -61,11 +62,16 @@ Copyright: VyOS maintainers and contributors def _get_raw_data(funny=False): version_data = vyos.version.get_full_version_data() - version_data["secure_boot"] = "n/a (BIOS)" - if is_uefi_system(): - version_data["secure_boot"] = "disabled" - if get_secure_boot_state(): - version_data["secure_boot"] = "enabled" + # A container has no firmware of its own - it is not booted at all, thus + # neither the UEFI nor the BIOS wording applies + if is_running_as_container(): + version_data["secure_boot"] = "n/a (container)" + else: + version_data["secure_boot"] = "n/a (BIOS)" + if is_uefi_system(): + version_data["secure_boot"] = "disabled" + if get_secure_boot_state(): + version_data["secure_boot"] = "enabled" if funny: version_data["limerick"] = vyos.limericks.get_random() -- cgit v1.2.3 From 5d9481d4f315c5e6296e374904d2f22768b995ec Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:10:36 +0000 Subject: version: T9269: omit hardware details on containers A container has no hardware of its own - vendor, model, serial and UUID are read from /sys/class/dmi/id and thus describe the host system. Listing them below "System type: container" reads as a property of the node. Leave the hardware_* keys unset when running as a container and omit the entire block in both "show version" and the airbag bug report. The latter moves the fields into an optional HARDWARE section, as str.format() has no conditionals. --- python/vyos/airbag.py | 14 +++++++++++--- python/vyos/version.py | 21 ++++++++++++--------- src/op_mode/version.py | 2 ++ 3 files changed, 25 insertions(+), 12 deletions(-) (limited to 'src') diff --git a/python/vyos/airbag.py b/python/vyos/airbag.py index 69b44dc9d..4e7bdfd06 100644 --- a/python/vyos/airbag.py +++ b/python/vyos/airbag.py @@ -78,8 +78,13 @@ def bug_report(dtype, value, trace): note = 'noteworthy:\n' note += '\n'.join(list(_noteworthy)) + hardware = '' + if 'hardware_vendor' in information: + hardware = HARDWARE.format(**information) + information.update({ 'date': datetime.now().strftime('%Y-%m-%d %H:%M:%S'), + 'hardware': hardware, 'trace': trace, 'instructions': INSTRUCTIONS, 'note': note, @@ -141,14 +146,17 @@ Build commit ID: {build_git} Architecture: {system_arch} Boot via: {boot_via} System type: {system_type} +{hardware} +{trace} +{note} +""" +# Optional section of FAULT - a container has no hardware of its own +HARDWARE = """ Hardware vendor: {hardware_vendor} Hardware model: {hardware_model} Hardware S/N: {hardware_serial} Hardware UUID: {hardware_uuid} - -{trace} -{note} """ INTRO = """\ diff --git a/python/vyos/version.py b/python/vyos/version.py index dcaec8817..50359ddf6 100644 --- a/python/vyos/version.py +++ b/python/vyos/version.py @@ -104,15 +104,18 @@ def get_full_version_data(fname=version_file): boot_via = "installed image" version_data['boot_via'] = boot_via - # Get hardware details from DMI - dmi = '/sys/class/dmi/id' - version_data['hardware_vendor'] = read_file(dmi + '/sys_vendor', 'Unknown') - version_data['hardware_model'] = read_file(dmi +'/product_name','Unknown') - - # These two assume script is run as root, normal users can't access those files - subsystem = '/sys/class/dmi/id/subsystem/id' - version_data['hardware_serial'] = read_file(subsystem + '/product_serial','Unknown') - version_data['hardware_uuid'] = read_file(subsystem + '/product_uuid', 'Unknown') + # Get hardware details from DMI - a container has no hardware of its own and + # would report the DMI data of the host system, thus the keys are left unset + # and consumers are expected to omit them + if not is_running_as_container(): + dmi = '/sys/class/dmi/id' + version_data['hardware_vendor'] = read_file(dmi + '/sys_vendor', 'Unknown') + version_data['hardware_model'] = read_file(dmi +'/product_name','Unknown') + + # These two assume script is run as root, normal users can't access those files + subsystem = '/sys/class/dmi/id/subsystem/id' + version_data['hardware_serial'] = read_file(subsystem + '/product_serial','Unknown') + version_data['hardware_uuid'] = read_file(subsystem + '/product_uuid', 'Unknown') return version_data diff --git a/src/op_mode/version.py b/src/op_mode/version.py index d6d8aaca1..bc74f83fc 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -48,11 +48,13 @@ Architecture: {{system_arch}} Boot via: {{boot_via}} System type: {{system_type}} Secure Boot: {{secure_boot}} +{%- if hardware_vendor is defined %} Hardware vendor: {{hardware_vendor}} Hardware model: {{hardware_model}} Hardware S/N: {{hardware_serial}} Hardware UUID: {{hardware_uuid}} +{%- endif %} Copyright: VyOS maintainers and contributors {%- if limerick %} -- cgit v1.2.3 From 2faaa23085bd5beee1ed1b8a63dfa5be84375841 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:01:37 +0000 Subject: system-option: T9269: no Kernel cmdline warning on containers A container shares the Kernel with its host and does not own the Kernel cmdline, so the requested options never compare equal to /proc/cmdline. Every commit thus asked the user to save the configuration and reboot, which would not apply anything at all. Never treat a kexec as required when running as a container. --- src/conf_mode/system_option.py | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src') diff --git a/src/conf_mode/system_option.py b/src/conf_mode/system_option.py index 190db232d..6e7ced37a 100755 --- a/src/conf_mode/system_option.py +++ b/src/conf_mode/system_option.py @@ -600,6 +600,11 @@ def generate_cmdline_for_kexec(options): def apply(options): kexec_required, cmdline_new = generate_cmdline_for_kexec(options) + # T9269: a container does not own the Kernel cmdline - it belongs to the + # host system, thus neither kexec nor a reboot would apply anything and the + # options always compare as changed + if image.is_running_as_container(): + kexec_required = False if kexec_required: if not boot_configuration_complete() and os.getenv('VYOS_CONFIGD'): cmdl([ -- cgit v1.2.3