nixos/systemd-initrd: silence various warnings #432704

andre4ik3 · 2025-08-11T05:35:57Z

Silences 2 warning messages that appear when using the systemd initrd:

"System tainted (var-run-bad)": occurs because /var/run isn't a symlink to /run. Fixed by making /run and linking /var/run to it.
"Failed to make /usr a mountpoint": occurs because ProtectSystem defaults to true in the initrd, which makes systemd try to remount /usr as read-only, which doesn't exist in the initrd. Fixed by linking /usr/bin and /usr/sbin to the initrd bin directories.

Also moves the /tmp creation from the initrd module to make-initrd-ng, to avoid making an unnecessary /tmp/.keep, saving a store path and a few bytes in the initrd image.

Things done

Add a 👍 reaction to pull requests you find important.

philiptaron

I like the solution to the first problem, but not the second.

philiptaron · 2025-08-11T22:39:53Z

nixos/modules/system/boot/systemd/initrd.nix

+        # Defaults to true in the initrd. Setting to false prevents systemd
+        # from attempting to remount a non-existent `/usr` as read-only.
+        ProtectSystem = false;


Should we do this instead of making an empty /usr?

My logic here was to prevent systemd from wasting time remounting it at all (since it would be empty anyway, it's not useful to remount it as read-only) instead of simply silencing it. But I'm happy to change it to create an empty /usr if that's better (or maybe do both?), since technically it's fewer characters of code.

Here is the relevant code in systemd, it doesn't check if /usr is empty and will always remount it, unless ProtectSystem disabled:

https://github.com/systemd/systemd/blob/5bd2538405660b10290bafdfa992a97970bffcc9/src/core/main.c#L1813-L1840

The main reason that I like making an empty /usr (and this is just me, the @NixOS/systemd team members might have a different opinion) is that ProtectSystem might gain other semantics beyond remounting usr as read-only. Making an empty /usr allows us to remain in the "default" zone with systemd settings.

After a few days thinking I will concede that making an empty /usr is better, like you said, to be more compatible with systemd defaults in the future. I updated it to do that instead.

nixos/modules/system/boot/systemd/initrd.nix

I meant to comment, not approve.

ElvishJerricco

Trying to build nixosTests.systemd-initrd-simple, it freezes immediately with systemd[1]: Freezing execution. Not sure why.

andre4ik3 · 2025-08-15T23:48:38Z

Trying to build nixosTests.systemd-initrd-simple, it freezes immediately with systemd[1]: Freezing execution. Not sure why.

Interesting. I ran the test for ProtectSystem=false but not for making an empty /usr, since I assumed (wrongly) it would work. Perhaps making an empty /usr won't work after all. I'll revert it back to the previous approach.

The "Freezing execution" means systemd crashed. It looks like it does make /usr read-only successfully, so something later must behave differently when ProtectSystem takes effect which causes it to crash:

machine # [    2.532235] Run /init as init process
machine # [    2.653999] input: QEMU QEMU USB Keyboard as /devices/platform/4010000000.pcie/pci0000:00/0000:00:0a.0/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input1
machine # [    2.661354] systemd[1]: Successfully made /usr/ read-only.
machine # [    2.671333] systemd[1]: systemd 257.6 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE)
machine # [    2.672085] systemd[1]: Detected virtualization qemu.
machine # [    2.672391] systemd[1]: Detected architecture arm64.
machine # [    2.672640] systemd[1]: Running in initrd.
machine # [    2.676972] systemd[1]: Freezing execution.

ElvishJerricco · 2025-08-16T00:20:05Z

Found the issue. We set console=tty0 in the test framework, which means a lot of super early systemd messages get swallowed. In principle this is supposed to be ok because we redirect the journal to the serial console, but in this case the error is too early for the journal to have started. That error says:

[!!!!!!] Refusing to run in unsupported envi…ment where /usr/ is not populated.

So this fixes it.

diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 394cbb487b..ffce5e7e0d 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -506,6 +506,8 @@
 
         "/bin".source = "${initrdBinEnv}/bin";
         "/sbin".source = "${initrdBinEnv}/sbin";
+        "/usr/bin".source = "${initrdBinEnv}/bin";
+        "/usr/sbin".source = "${initrdBinEnv}/sbin";
 
         "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /sbin/modprobe";
         "/etc/modprobe.d/systemd.conf".source = "${cfg.package}/lib/modprobe.d/systemd.conf";
diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index e0a415a09b..35fd66e89d 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -100,7 +100,7 @@
     ++ lib.optional makeUInitrd ubootTools;
   })
   ''
-    mkdir -p ./root/{run,tmp,usr,var/empty}
+    mkdir -p ./root/{run,tmp,var/empty}
     ln -s ../run ./root/var/run
     make-initrd-ng "$contentsPath" ./root
     mkdir "$out"

andre4ik3 · 2025-08-16T00:27:19Z

Interesting that an unpopulated /usr is explicitly unsupported but a nonexistent one isn't. Looking at the code, it seems it was done as a safeguard to ensure it's either mounted or on the same partition as the root.

Silences 2 warning messages that appear when using the systemd initrd: 1. "System tainted (var-run-bad)": occurs because `/var/run` isn't a symlink to `/run`. Fixed by making /run and linking /var/run to it. 2. "Failed to make /usr a mountpoint": occurs because ProtectSystem defaults to true in the initrd, which makes systemd try to remount `/usr` as read-only, which doesn't exist in the initrd. Fixed by linking `/usr/bin` and `/usr/sbin` to the initrd bin directories. Also moves the `/tmp` creation from the initrd module to make-initrd-ng, to avoid making an unnecessary `/tmp/.keep`, saving a store path and a few bytes in the initrd image.

philiptaron

Thanks for figuring this out!

nix-owners bot requested review from flokli, ElvishJerricco, aanderse and arianvp August 11, 2025 05:37

andre4ik3 force-pushed the initrd-var-run branch from 0e3edec to 6885eff Compare August 11, 2025 10:38

nix-owners bot requested a review from philiptaron August 11, 2025 10:40

nixpkgs-ci bot added the 6.topic: kernel The Linux kernel label Aug 11, 2025

philiptaron previously approved these changes Aug 11, 2025

View reviewed changes

andre4ik3 force-pushed the initrd-var-run branch from 6885eff to ae2e694 Compare August 15, 2025 12:09

philiptaron approved these changes Aug 15, 2025

View reviewed changes

nixpkgs-ci bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label Aug 15, 2025

ElvishJerricco requested changes Aug 15, 2025

View reviewed changes

andre4ik3 force-pushed the initrd-var-run branch from ae2e694 to 6885eff Compare August 15, 2025 23:49

andre4ik3 force-pushed the initrd-var-run branch from 6885eff to 970b0a6 Compare August 16, 2025 00:27

andre4ik3 force-pushed the initrd-var-run branch from 970b0a6 to 216d98a Compare August 16, 2025 00:28

ElvishJerricco approved these changes Aug 16, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Aug 16, 2025

philiptaron approved these changes Aug 16, 2025

View reviewed changes

philiptaron merged commit 54a65ab into NixOS:master Aug 28, 2025
29 of 30 checks passed

andre4ik3 deleted the initrd-var-run branch August 29, 2025 03:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

nixos/systemd-initrd: silence various warnings #432704

nixos/systemd-initrd: silence various warnings #432704

Uh oh!

andre4ik3 commented Aug 11, 2025 •

edited

Loading

Uh oh!

philiptaron left a comment

Uh oh!

philiptaron Aug 11, 2025

Uh oh!

andre4ik3 Aug 12, 2025

Uh oh!

philiptaron Aug 12, 2025

Uh oh!

andre4ik3 Aug 15, 2025

Uh oh!

Uh oh!

ElvishJerricco left a comment

Uh oh!

andre4ik3 commented Aug 15, 2025 •

edited

Loading

Uh oh!

ElvishJerricco commented Aug 16, 2025 •

edited

Loading

Uh oh!

andre4ik3 commented Aug 16, 2025

Uh oh!

philiptaron left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nixos/systemd-initrd: silence various warnings #432704

nixos/systemd-initrd: silence various warnings #432704

Uh oh!

Conversation

andre4ik3 commented Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

philiptaron left a comment

Choose a reason for hiding this comment

Uh oh!

philiptaron Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

andre4ik3 Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

philiptaron Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

andre4ik3 Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ElvishJerricco left a comment

Choose a reason for hiding this comment

Uh oh!

andre4ik3 commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ElvishJerricco commented Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andre4ik3 commented Aug 16, 2025

Uh oh!

philiptaron left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

andre4ik3 commented Aug 11, 2025 •

edited

Loading

andre4ik3 commented Aug 15, 2025 •

edited

Loading

ElvishJerricco commented Aug 16, 2025 •

edited

Loading