Enable ACL confidential VM boot and harden Azure time synchronization

build_library/rpm/additional_files/99-acl.conf

@@ -41,6 +41,8 @@ install_items+=" /usr/lib/systemd/systemd-veritysetup "
 # Include verity device timing drop-ins in initramfs
 # These ensure udev has finished device enumeration before verity setup runs
 install_items+=" /usr/lib/systemd/system/dev-mapper-usr.device.d/no-job-timeout.conf "
+# Ordering drop-in for bootengine's decrypt-root.service (CVM LUKS root)
+install_items+=" /usr/lib/systemd/system/decrypt-root.service.d/10-acl-ordering.conf "
 # Include flatcar-tmpfiles stub needed by bootengine's initrd-setup-root
 install_items+=" /usr/sbin/flatcar-tmpfiles "
 # Include setfiles stub for SELinux-disabled systems

build_library/rpm/dracut_install.sh

@@ -397,6 +397,16 @@ EOF
 [Unit]
 # Disable job timeout to allow verity setup to wait for slow device enumeration
 JobRunningTimeoutSec=infinity
+EOF
+
+    # Drop-in for bootengine's decrypt-root.service (31decrypt-root dracut module).
+    # Kept here rather than as a bootengine patch to avoid rebasing with bootengine updates.
+    info "RPM mode: Creating drop-in for decrypt-root.service (ordering before root device wait)"
+    sudo mkdir -p "${systemd_dropin_dir}/decrypt-root.service.d"
+    cat <<'EOF' | sudo tee "${systemd_dropin_dir}/decrypt-root.service.d/10-acl-ordering.conf" > /dev/null
+[Unit]
+# Decrypt ROOT before initramfs waits for it.
+Before=initrd-root-device.target
 EOF
 }
 

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -euo pipefail
+
+config_dir="/run/chrony-azure/conf.d"
+config_file="${config_dir}/azure-ptp.conf"
+
+install -d -m 0755 "${config_dir}"
+
+if [[ -e /dev/ptp_hyperv ]]; then
+    # trust keeps the host clock authoritative: without it a disagreement with the
+    # public NTP fallback marks both sources falsetickers and chronyd loses sync.
+    printf '%s\n' \
+        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer trust' \
+        > "${config_file}"
+else
+    rm -f "${config_file}"
+fi

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf

@@ -1,4 +1,8 @@
-# This should only be used when chronyd is configured to use the /dev/ptp_hyperv device
 [Unit]
-Wants=dev-ptp_hyperv.device
+# Order after the PTP device if present without waiting for it when unavailable.
+# No Wants= on purpose: CVMs never get this device, so it would stall chronyd every
+# boot. Cost is that a late device waits for the next chronyd restart.
 After=dev-ptp_hyperv.device
+
+[Service]
+ExecStartPre=-/usr/libexec/chrony-azure-ptp

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf

@@ -5,26 +5,20 @@
 # Include configuration files found in /etc/chrony/conf.d.
 confdir /etc/chrony/conf.d
 
-# This will use (up to):
-# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
-# - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm)
-# This means by default, up to 2 dual-stack and up to 3 additional IPv4-only
-# sources will be used.
-# At the same time it retains some protection against one of the entries being
-# down (compare to just using one of the lines).
-#
-# See http://www.pool.ntp.org/join.html for more information.
-#pool 0.flatcar.pool.ntp.org iburst maxsources 1
-#pool 1.flatcar.pool.ntp.org iburst maxsources 1
-#pool 2.flatcar.pool.ntp.org iburst maxsources 2
-#pool 3.flatcar.pool.ntp.org iburst maxsources 1
+# Include runtime configuration generated for Azure platform devices.
+# azure-ptp.conf is generated here before chronyd starts when the Hyper-V PTP
+# device is available.
+confdir /run/chrony-azure/conf.d
 
 # Use time sources from DHCP.
 sourcedir /run/chrony-dhcp
 
 # Use NTP sources found in /etc/chrony/sources.d.
 sourcedir /etc/chrony/sources.d
 
+# Retain the Azure Linux 3.0 public fallback.
+server time.windows.com iburst
+
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
 #keyfile /etc/chrony/chrony.keys
@@ -50,16 +44,11 @@ maxupdateskew 100.0
 rtcsync
 
 # Step the system clock instead of slewing it if the adjustment is larger than
-# one second, but only in the first three clock updates.
+# one second. Unbounded on purpose: the AKS VHD test jumps the clock years back
+# long after boot and expects chrony to step it, which a bounded limit can't do.
 makestep 1.0 -1
 
 # Get TAI-UTC offset and leap seconds from the system tz database.
 # This directive must be commented out when using time sources serving
 # leap-smeared time.
 leapsectz right/UTC
-
-# Azure hosts are synchronized to internal Microsoft time servers
-# that take their time from Microsoft-owned Stratum 1 devices.
-# The Hyper-V drivers surface this time source as a PTP-based
-# time source in the guest. This configures chrony to use it.
-refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh

@@ -55,23 +55,46 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then
     sed -i \
         's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
+
+    # Azure Linux adds this command, but its chrony-helper does not implement it,
+    # leaving chronyd failed after a clean stop.
+    if ! grep -qE '^ExecStopPost=.*/chrony-helper remove-daemon-state$' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"; then
+        echo "ERROR: expected chrony-helper remove-daemon-state line not found" >&2
+        exit 1
+    fi
+    sed -i \
+        '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"
 fi
 
 # Copy Azure-optimized chrony.conf from this directory.
 # Overwrites the RPM default that manglefs already moved from /etc.
-# Key differences: makestep 1.0 -1 (always-step), PTP refclock for Hyper-V clock.
+# Key differences: always-step, network fallback, and optional Hyper-V PTP.
 
 # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf
-if [[ -f "${script_dir}/chrony.conf" ]]; then
-    cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
+if [[ ! -f "${script_dir}/chrony.conf" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony.conf" >&2
+    exit 1
+fi
+cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
+
+# Generate the optional Hyper-V PTP source before chronyd starts.
+if [[ ! -f "${script_dir}/chrony-azure-ptp" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-azure-ptp" >&2
+    exit 1
 fi
+install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
+    "${rootfs}/usr/libexec/chrony-azure-ptp"
 
-# chronyd.service drop-in (Wants/After dev-ptp_hyperv.device)
-if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then
-    mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
-    cp "${script_dir}/chrony-hyperv.conf" \
-       "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
+# chronyd.service drop-in for optional Hyper-V PTP configuration.
+if [[ ! -f "${script_dir}/chrony-hyperv.conf" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-hyperv.conf" >&2
+    exit 1
 fi
+mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
+cp "${script_dir}/chrony-hyperv.conf" \
+   "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
 
 # Chrony tmpfiles: /var/lib/chrony dir + /etc/chrony.keys copy-on-boot
 if [[ -f "${script_dir}/var-chrony.conf" ]]; then

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.12.0.4-r2.ebuild

@@ -31,6 +31,8 @@ src_install() {
 	systemd_enable_service multi-user.target chronyd.service
 	insinto "$(systemd_get_systemunitdir)"/chronyd.service.d
 	doins "${FILESDIR}"/chrony-hyperv.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}"/chrony-azure-ptp
 	dotmpfiles "${FILESDIR}"/var-chrony.conf
 	dotmpfiles "${FILESDIR}"/etc-chrony.conf
 	insinto /usr/share/${PN}