[PATCH v5] image-postproc: gate systemd preset-all on masked unit state

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---
meta/classes-recipe/rootfs.bbclass | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..ca847b30 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -574,7 +574,9 @@ image_postprocess_populate_systemd_preset() {
--show systemd || echo "" )

if (test "$SYSTEMD_INSTALLED" = "installed"); then
- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
+ # Skip preset-all if any masked units exist
+ sudo chroot '${ROOTFSDIR}' systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
fi
}

--
2.47.3

[Jan Kiszka]

Minor optimization: I would execute the test and preset-all in the same
chroot instance.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---

meta/classes-recipe/rootfs.bbclass | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..f583e5bc 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
image_postprocess_populate_systemd_preset() {
- SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
- --showformat='${db:Status-Status}' \
- --show systemd || echo "" )
+ sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+ SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

- if (test "$SYSTEMD_INSTALLED" = "installed"); then

- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"

+ if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+ systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || systemctl preset-all --preset-mode="enable-only"
fi
+EOSH
}

do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
--
2.47.3

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---

meta/classes-recipe/rootfs.bbclass | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..d250690f 100644

--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
image_postprocess_populate_systemd_preset() {
- SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
- --showformat='${db:Status-Status}' \
- --show systemd || echo "" )
+ sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+ SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

- if (test "$SYSTEMD_INSTALLED" = "installed"); then
- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"

- fi

+ if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+ systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || systemctl preset-all --preset-mode="enable-only"

+ fi

[Zhihang Wei]

Applied to next, thanks.

Zhihang

[Heinisch, Alexander]

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
>
> Zhihang
>
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit
> > files
> > are detected, to avoid non-fatal failures when presetting units
> > that are
> > already masked.
> >
> > Move execution fully inside a single chroot invocation for
> > consistency
> > and reduced overhead.
> >
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > based on systemd presets")

Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all --
preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first
boot anyways.

BR Alexander

--
Alexander Heinisch
Siemens AG
www.siemens.com

[Prusty, Badrikesh]

Hi,

Here are the simple steps to reproduce the issue:

1. Check out Isar without this patch applied.

2. Create a recipe to mask a unit. Here I am using `ctrl-alt-del.target`
```
> cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
inherit dpkg-raw

SRC_URI = "file://postinst"

> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target
```

3. Install it to the rootfs:
```
> git diff
diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
index ea2bce8e..382acd29 100644
--- a/kas/package/pkg_hello.yaml
+++ b/kas/package/pkg_hello.yaml
@@ -6,4 +6,4 @@ header:

local_conf_header:
package-hello: |
- IMAGE_INSTALL:append = " hello"
+ IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
```

4. Trigger a build with distro set to debian-bookworm:
```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
```

Error log:
```
| DEBUG: Executing shell function image_postprocess_populate_systemd_preset
| Failed to preset unit, unit /etc/systemd/system/systemd-firstboot.service is masked.
| Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target is masked.
| Failed to preset unit, unit /lib/systemd/system/x11-common.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rc.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks-early.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rcS.service is masked.
| Failed to preset unit, unit /lib/systemd/system/hwclock.service is masked.
| Unit /etc/systemd/system/systemd-firstboot.service is masked, ignoring.
| Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
| Created symlink /etc/systemd/system/multi-user.target.wants/remote-cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
| Created symlink /etc/systemd/system/sysinit.target.wants/systemd-sysext.service → /lib/systemd/system/systemd-sysext.service.
| Unit /lib/systemd/system/x11-common.service is masked, ignoring.
| Unit /lib/systemd/system/rc.service is masked, ignoring.
| Failed to preset unit, file "/etc/systemd/system/ctrl-alt-del.target" already exists and is a symlink to "/dev/null".
```

Many thanks,
Badrikesh

[Heinisch, Alexander]

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an
existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by
masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly
mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle
that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your
distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU

[Prusty, Badrikesh]

Hi,

> I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```

Thanks for the suggestion!

Unfortunately, shipping a preset file with a "disable" rule won't work
in this case, because populate_systemd_preset applies presets
with:

systemctl preset-all --preset-mode="enable-only"

This means "disable" rules in preset files are silently ignored.

To make disable rules effective, the --preset-mode flag would need to
be dropped from populate_systemd_preset.

> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG

http://www.siemens.com/

[Heinisch, Alexander]

On Tue, 2026-07-14 at 04:05 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>

> > I'd propose to revert that "fix" and fix the preset shipped with
> > your distribution accordingly:
> >
> > e.g.:
> > ```
> > echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> > reboot-target-mask.preset
> > ```
>
> Thanks for the suggestion!
>
> Unfortunately, shipping a preset file with a "disable" rule won't
> work
> in this case, because populate_systemd_preset applies presets
> with:
>
> systemctl preset-all --preset-mode="enable-only"
>
> This means "disable" rules in preset files are silently ignored.
>

The preset-all with enable-only won't take care about the disabling nor
about masking, you just have to resolve the conflict between masking
and the preset for said unit by unsetting the units/targets preset
enable policy. (you could also just remove the line that states preset
enable for said unit - but imo the drop in config version is nicer)

The proposed handling below is not a replacement for masking the unit,
but a fix for the error you experienced during preset-all.

Based on the example you gave, that would result in something like:

```

cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target

echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

Note: My proposed solution is about resolving described conflict, not
about a replacement for masking the unit.


BR Alexander

> > > Failed to preset unit, unit /lib/systemd/system/x11-

[Prusty, Badrikesh]

Hi,

Apologies for delayed response.

> The proposed handling below is not a replacement for masking the unit,
> but a fix for the error you experienced during preset-all.
>
> Based on the example you gave, that would result in something like:
>
> ```
> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
> #!/bin/sh
>
> systemctl mask ctrl-alt-del.target
>
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```
>

I tried the suggested solution, and it is working as expected, the build completed
without any issues.

Initially there was concern this might affect systemctl reboot or reboot commands,
but both works as expected. Found out reboot.target is merely an alias for ctrl-alt-del.target,
and the actual reboot is performed by system-reboot.service which remains unaffected.

```
$ cat /usr/lib/systemd/system/reboot.target
[Unit]
Description=System Reboot
Documentation=man:systemd.special(7)
DefaultDependencies=no
Requires=systemd-reboot.service
After=systemd-reboot.service
AllowIsolate=yes
JobTimeoutSec=30min
JobTimeoutAction=reboot-force

[Install]
Alias=ctrl-alt-del.target
```

Many thanks,
Badri