From cd87193b8623a51aab6e7e37a8da6f42153b0159 Mon Sep 17 00:00:00 2001 From: Douglas Teles Date: Tue, 23 Jun 2026 16:12:39 -0300 Subject: [PATCH] FHS F4.1: ssh host keys + iwd state to /var/lib (credentials) Two security-sensitive state dirs migrated to Arch-standard locations. openssh: - --with-keydir flipped from /storage/.cache/ssh to /var/lib/sshd. - post_install plants a bridge symlink /var/lib/sshd -> /storage/.cache/ssh so keys persist on the rw overlay. - sshd.service updates all three ExecStartPre paths. - tmpfiles z_04_openssh.conf keeps creating /storage/.cache/ssh as the real overlay dir. iwd: - Environment STATE_DIRECTORY in iwd.service now /var/lib/iwd. - post_makeinstall_target adds the /var/lib/iwd -> /storage/.cache/iwd bridge symlink. - wifictl (IWD_DIR, IWD_AP_CFG_DIR), post-update copy target and userconfig-setup all flipped to /var/lib/iwd. - tmpfiles z_03_iwd.conf keeps creating the backing dirs. Both follow the same bridge pattern as F2/F3: FHS surface, storage overlay substrate. SSH host keys and wifi credentials survive the migration because the underlying bytes never move (symlink swap). Co-Authored-By: Claude Opus 4.7 --- projects/ArchR/packages/archr/sources/post-update | 2 +- projects/ArchR/packages/archr/sources/scripts/wifictl | 4 ++-- projects/ArchR/packages/network/iwd/package.mk | 6 ++++++ projects/ArchR/packages/network/iwd/system.d/iwd.service | 2 +- projects/ArchR/packages/network/openssh/package.mk | 9 ++++++++- .../ArchR/packages/network/openssh/system.d/sshd.service | 6 +++--- .../packages/sysutils/systemd/scripts/userconfig-setup | 2 +- 7 files changed, 22 insertions(+), 9 deletions(-) diff --git a/projects/ArchR/packages/archr/sources/post-update b/projects/ArchR/packages/archr/sources/post-update index 8bd72abadb..85724b7f4b 100644 --- a/projects/ArchR/packages/archr/sources/post-update +++ b/projects/ArchR/packages/archr/sources/post-update @@ -60,7 +60,7 @@ echo "Apply dev wifi config if available..." >>${LOG} if [ -d /usr/config/iwd ] then tocon "Update developer wifi config..." - cp /usr/config/iwd/* /storage/.cache/iwd/ + cp /usr/config/iwd/* /var/lib/iwd/ fi ### Sync rsync configs diff --git a/projects/ArchR/packages/archr/sources/scripts/wifictl b/projects/ArchR/packages/archr/sources/scripts/wifictl index f5ccfeb71e..8435fefbdd 100755 --- a/projects/ArchR/packages/archr/sources/scripts/wifictl +++ b/projects/ArchR/packages/archr/sources/scripts/wifictl @@ -14,7 +14,7 @@ ### wifictl command [ssid] [psk] ### -IWD_AP_CFG_DIR="/storage/.cache/iwd/ap" +IWD_AP_CFG_DIR="/var/lib/iwd/ap" WIFI_TYPE=$(get_setting wifi.adhoc.enabled) NETWORK_ADDRESS="192.168.80" ADHOC_CLIENT_ID=$(get_setting wifi.adhoc.id) @@ -67,7 +67,7 @@ connect_wifi() { sleep 1 # Create iwd network profile for persistent connection - IWD_DIR="/storage/.cache/iwd" + IWD_DIR="/var/lib/iwd" mkdir -p "${IWD_DIR}" if [ -n "${PSK}" ]; then printf '[Security]\nPassphrase=%s\n' "${PSK}" > "${IWD_DIR}/${SSID}.psk" diff --git a/projects/ArchR/packages/network/iwd/package.mk b/projects/ArchR/packages/network/iwd/package.mk index db8bbf04df..1f30c24713 100644 --- a/projects/ArchR/packages/network/iwd/package.mk +++ b/projects/ArchR/packages/network/iwd/package.mk @@ -19,4 +19,10 @@ post_makeinstall_target() { mkdir -p ${INSTALL}/usr/bin cp -P ${PKG_DIR}/scripts/iwd_get-networks ${INSTALL}/usr/bin + + # FHS bridge: /var/lib/iwd is the Arch-standard state dir. tmpfiles + # z_03_iwd.conf creates the backing /storage/.cache/iwd so the + # symlinked target is writable on first boot. + mkdir -p ${INSTALL}/var/lib + ln -sf /storage/.cache/iwd ${INSTALL}/var/lib/iwd } diff --git a/projects/ArchR/packages/network/iwd/system.d/iwd.service b/projects/ArchR/packages/network/iwd/system.d/iwd.service index 88f260db40..bd96e872b1 100644 --- a/projects/ArchR/packages/network/iwd/system.d/iwd.service +++ b/projects/ArchR/packages/network/iwd/system.d/iwd.service @@ -7,7 +7,7 @@ Before=network.target Wants=network.target [Service] -Environment=STATE_DIRECTORY=/storage/.cache/iwd +Environment=STATE_DIRECTORY=/var/lib/iwd Type=dbus BusName=net.connman.iwd ExecStart=/usr/lib/iwd diff --git a/projects/ArchR/packages/network/openssh/package.mk b/projects/ArchR/packages/network/openssh/package.mk index 84399e7ae3..c90574471f 100644 --- a/projects/ArchR/packages/network/openssh/package.mk +++ b/projects/ArchR/packages/network/openssh/package.mk @@ -28,7 +28,7 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_header_rpc_types_h=no \ --disable-pututline \ --disable-pututxline \ --disable-etc-default-login \ - --with-keydir=/storage/.cache/ssh \ + --with-keydir=/var/lib/sshd \ --without-pam" pre_configure_target() { @@ -55,4 +55,11 @@ post_makeinstall_target() { post_install() { enable_service sshd.service + + # FHS bridge for host keys: --with-keydir is baked at configure time + # to /var/lib/sshd. Symlink it into /storage/.cache/ssh (rw overlay) + # so the keys persist across reboots. The backing path is still + # created by tmpfiles z_04_openssh.conf. + mkdir -p ${INSTALL}/var/lib + ln -sf /storage/.cache/ssh ${INSTALL}/var/lib/sshd } diff --git a/projects/ArchR/packages/network/openssh/system.d/sshd.service b/projects/ArchR/packages/network/openssh/system.d/sshd.service index 8b733405d7..d67ae6103c 100644 --- a/projects/ArchR/packages/network/openssh/system.d/sshd.service +++ b/projects/ArchR/packages/network/openssh/system.d/sshd.service @@ -8,10 +8,10 @@ ConditionPathExists=|/storage/.cache/services/sshd.conf [Service] Restart=on-failure EnvironmentFile=-/storage/.cache/services/sshd.conf -ExecStartPre=-/bin/sh -c 'mkdir -p /storage/.cache/ssh' +ExecStartPre=-/bin/sh -c 'mkdir -p /var/lib/sshd' ExecStartPre=/usr/bin/ssh-keygen -A -ExecStartPre=-/bin/sh -c 'chmod 600 /storage/.cache/ssh/ssh_host_*' -ExecStartPre=-/bin/sh -c 'chmod 644 /storage/.cache/ssh/ssh_host_*.pub' +ExecStartPre=-/bin/sh -c 'chmod 600 /var/lib/sshd/ssh_host_*' +ExecStartPre=-/bin/sh -c 'chmod 644 /var/lib/sshd/ssh_host_*.pub' ExecStart=/usr/sbin/sshd -D $SSH_ARGS ExecReload=/bin/kill -HUP $MAINPID TimeoutStopSec=1s diff --git a/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup b/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup index 43a3cd6e09..99e7479012 100755 --- a/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup +++ b/projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup @@ -33,7 +33,7 @@ then if [ -d /usr/config/iwd ] then tocon "Update developer wifi config..." - cp /usr/config/iwd/* /storage/.cache/iwd/ + cp /usr/config/iwd/* /var/lib/iwd/ fi if [ -e "/usr/bin/emulationstation" ]