[PATCH v5] image-postproc: gate systemd preset-all on masked unit state

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---
meta/classes-recipe/rootfs.bbclass | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..ca847b30 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -574,7 +574,9 @@ image_postprocess_populate_systemd_preset() {
--show systemd || echo "" )

if (test "$SYSTEMD_INSTALLED" = "installed"); then
- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
+ # Skip preset-all if any masked units exist
+ sudo chroot '${ROOTFSDIR}' systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"
fi
}

--
2.47.3

[Jan Kiszka]

Minor optimization: I would execute the test and preset-all in the same
chroot instance.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---

meta/classes-recipe/rootfs.bbclass | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..f583e5bc 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
image_postprocess_populate_systemd_preset() {
- SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
- --showformat='${db:Status-Status}' \
- --show systemd || echo "" )
+ sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+ SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

- if (test "$SYSTEMD_INSTALLED" = "installed"); then

- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"

+ if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+ systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || systemctl preset-all --preset-mode="enable-only"
fi
+EOSH
}

do_rootfs_postprocess[vardeps] = "${ROOTFS_POSTPROCESS_COMMAND}"
--
2.47.3

[Badrikesh Prusty]

Skip systemd preset-all during image postprocessing if masked unit files
are detected, to avoid non-fatal failures when presetting units that are
already masked.

Move execution fully inside a single chroot invocation for consistency
and reduced overhead.

Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units based on systemd presets")

Signed-off-by: Badrikesh Prusty <badrikes...@siemens.com>
---

meta/classes-recipe/rootfs.bbclass | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index 8b502a50..d250690f 100644

--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -569,13 +569,14 @@ EOSUDO

ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'populate-systemd-preset', 'image_postprocess_populate_systemd_preset', '', d)}"
image_postprocess_populate_systemd_preset() {
- SYSTEMD_INSTALLED=$(sudo chroot '${ROOTFSDIR}' dpkg-query \
- --showformat='${db:Status-Status}' \
- --show systemd || echo "" )
+ sudo chroot "${ROOTFSDIR}" /bin/sh <<'EOSH'
+ SYSTEMD_INSTALLED=$(dpkg-query --showformat='${db:Status-Status}' --show systemd 2>/dev/null)

- if (test "$SYSTEMD_INSTALLED" = "installed"); then
- sudo chroot '${ROOTFSDIR}' systemctl preset-all --preset-mode="enable-only"

- fi

+ if [ "${SYSTEMD_INSTALLED}" = "installed" ]; then
+ systemctl list-unit-files --state=masked --no-legend | grep -q '^' \
+ || systemctl preset-all --preset-mode="enable-only"

+ fi

[Zhihang Wei]

Applied to next, thanks.

Zhihang

[Heinisch, Alexander]

On Mon, 2026-06-15 at 11:02 +0200, Zhihang Wei wrote:
> Applied to next, thanks.
>
> Zhihang
>
> On 4/29/26 15:02, 'Badrikesh Prusty' via isar-users wrote:
> > Skip systemd preset-all during image postprocessing if masked unit
> > files
> > are detected, to avoid non-fatal failures when presetting units
> > that are
> > already masked.
> >
> > Move execution fully inside a single chroot invocation for
> > consistency
> > and reduced overhead.
> >
> > Fixes: 72b88a12 ("classes/image-postproc: Enable systemd units
> > based on systemd presets")

Sorry for the (too)late reply.

Can you elaborate what this fix is about?

At least on my systems (and according to documentation) preset-all --
preset-mode="enable-only" handles masked services gracefully.

The command emits:
"Unit [redacted].service is masked, ignoring." correctly.
but exits with exit code 0.

Further, the previous behavior is exactly what systemd does on first
boot anyways.

BR Alexander

--
Alexander Heinisch
Siemens AG
www.siemens.com

[Prusty, Badrikesh]

Hi,

Here are the simple steps to reproduce the issue:

1. Check out Isar without this patch applied.

2. Create a recipe to mask a unit. Here I am using `ctrl-alt-del.target`
```
> cat meta-isar/recipes-example/no-ctrl-alt-del/no-ctrl-alt-del.bb
inherit dpkg-raw

SRC_URI = "file://postinst"

> cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target
```

3. Install it to the rootfs:
```
> git diff
diff --git a/kas/package/pkg_hello.yaml b/kas/package/pkg_hello.yaml
index ea2bce8e..382acd29 100644
--- a/kas/package/pkg_hello.yaml
+++ b/kas/package/pkg_hello.yaml
@@ -6,4 +6,4 @@ header:

local_conf_header:
package-hello: |
- IMAGE_INSTALL:append = " hello"
+ IMAGE_INSTALL:append = " hello no-ctrl-alt-del"
```

4. Trigger a build with distro set to debian-bookworm:
```
> ./kas/kas-container build kas/isar.yaml:kas/machine/x86-pc.yaml:kas/distro/debian-bookworm.yaml:kas/package/pkg_hello.yaml
```

Error log:
```
| DEBUG: Executing shell function image_postprocess_populate_systemd_preset
| Failed to preset unit, unit /etc/systemd/system/systemd-firstboot.service is masked.
| Failed to preset unit, unit /etc/systemd/system/ctrl-alt-del.target is masked.
| Failed to preset unit, unit /lib/systemd/system/x11-common.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rc.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks.service is masked.
| Failed to preset unit, unit /lib/systemd/system/cryptdisks-early.service is masked.
| Failed to preset unit, unit /lib/systemd/system/rcS.service is masked.
| Failed to preset unit, unit /lib/systemd/system/hwclock.service is masked.
| Unit /etc/systemd/system/systemd-firstboot.service is masked, ignoring.
| Unit /etc/systemd/system/ctrl-alt-del.target is masked, ignoring.
| Created symlink /etc/systemd/system/multi-user.target.wants/remote-cryptsetup.target → /lib/systemd/system/remote-cryptsetup.target.
| Created symlink /etc/systemd/system/sysinit.target.wants/systemd-sysext.service → /lib/systemd/system/systemd-sysext.service.
| Unit /lib/systemd/system/x11-common.service is masked, ignoring.
| Unit /lib/systemd/system/rc.service is masked, ignoring.
| Failed to preset unit, file "/etc/systemd/system/ctrl-alt-del.target" already exists and is a symlink to "/dev/null".
```

Many thanks,
Badrikesh

[Heinisch, Alexander]

Thx for clarifying steps to reproduce.

I followed your steps below with a minor modification to build an
existing image (isar-image-base)

```
./kas/kas-container build kas/isar.yaml:kas/machine/x86-
pc.yaml:kas/distro/debian-
bookworm.yaml:kas/package/pkg_hello.yaml:kas/image/isar-image-base.yaml
```

I could reproduce described log output in bookworm.

But, the error message is caused by a conflict you introduced by
masking /usr/lib/systemd/system/ctrl-alt-del.target!

ctrl-alt-del.target is a link to reboot.target which is explicitly
mentioned enabled in /usr/lib/systemd/system-preset/90-systemd.preset

Therefore, systemd (in bookworm) emits an error.
Later versions of systemd (e.g. the one shipped with trixie) handle
that more gracefully [1], as mentioned previously.


TL;DR:

I'd propose to revert that "fix" and fix the preset shipped with your
distribution accordingly:

e.g.:
```
echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

BR Alexander


[1]:
https://github.com/systemd/systemd/commit/d41f08bd2ac4cfa58191b64d31ca9e6f3dec7552

On Sat, 2026-06-20 at 04:35 +0000, Prusty, Badrikesh (FT FDS CES LX PBU

[Prusty, Badrikesh]

Hi,

> I'd propose to revert that "fix" and fix the preset shipped with your distribution accordingly:
>
> e.g.:
> ```
> echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> reboot-target-mask.preset
> ```

Thanks for the suggestion!

Unfortunately, shipping a preset file with a "disable" rule won't work
in this case, because populate_systemd_preset applies presets
with:

systemctl preset-all --preset-mode="enable-only"

This means "disable" rules in preset files are silently ignored.

To make disable rules effective, the --preset-mode flag would need to
be dropped from populate_systemd_preset.

> http://www.siemens.com/

--
Alexander Heinisch
Siemens AG

http://www.siemens.com/

[Heinisch, Alexander]

On Tue, 2026-07-14 at 04:05 +0000, Prusty, Badrikesh (FT FDS CES LX PBU
2) wrote:
> Hi,
>

> > I'd propose to revert that "fix" and fix the preset shipped with
> > your distribution accordingly:
> >
> > e.g.:
> > ```
> > echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
> > reboot-target-mask.preset
> > ```
>
> Thanks for the suggestion!
>
> Unfortunately, shipping a preset file with a "disable" rule won't
> work
> in this case, because populate_systemd_preset applies presets
> with:
>
> systemctl preset-all --preset-mode="enable-only"
>
> This means "disable" rules in preset files are silently ignored.
>

The preset-all with enable-only won't take care about the disabling nor
about masking, you just have to resolve the conflict between masking
and the preset for said unit by unsetting the units/targets preset
enable policy. (you could also just remove the line that states preset
enable for said unit - but imo the drop in config version is nicer)

The proposed handling below is not a replacement for masking the unit,
but a fix for the error you experienced during preset-all.

Based on the example you gave, that would result in something like:

```

cat meta-isar/recipes-example/no-ctrl-alt-del/files/postinst
#!/bin/sh

systemctl mask ctrl-alt-del.target

echo "disable reboot.target" > /usr/lib/systemd/system-preset/00-
reboot-target-mask.preset
```

Note: My proposed solution is about resolving described conflict, not
about a replacement for masking the unit.


BR Alexander

> > > Failed to preset unit, unit /lib/systemd/system/x11-