chore: Cleanup udev changes (#10656)

Cleanup old udev "fixes", now that
#10619 has been merged.

Author: Bownairo

ic-os/components/early-boot/fstab/fstab-guestos

@@ -3,8 +3,7 @@ tmpfs    /tmp    tmpfs   defaults 0   2
 /dev/disk/by-partuuid/b78084e2-3363-1346-8c25-d426f26b8928   /boot/efi   vfat    defaults    0   2
 /dev/disk/by-partuuid/6788e4cf-f456-104e-9a34-a2c58cfb0ee6   /boot/grub  vfat    defaults    0   2
 /dev/disk/by-partuuid/a5ba3816-beaa-d74d-993e-cfa5aa6ba1f6   /boot/config    ext4    defaults,sync    0   2
-# Remove the BindsTo on the underlying crypt device. We suspect the device flapping in udev can lead to the mount locking up.
-/dev/mapper/var_crypt   /var  ext4    defaults,x-systemd.device-bound=false    0   2
+/dev/mapper/var_crypt   /var  ext4    defaults    0   2
 # If you add a new mount that depends on /dev/mapper/store, don't forget to add it to maybe-disable-store-mounts.service
 /dev/mapper/store-shared--backup   /var/lib/ic/backup    ext4 defaults,context=system_u:object_r:ic_data_t:s0  0   2
 /dev/mapper/store-shared--crypto   /var/lib/ic/crypto    ext4 defaults   0   2

ic-os/components/guestos.bzl

@@ -64,7 +64,6 @@ def component_files(mode):
         Label("guestos/init/setup-encryption/setup-data-encryption.sh"): "/opt/ic/bin/setup-data-encryption.sh",
         Label("guestos/init/setup-encryption/setup-data-encryption.service"): "/etc/systemd/system/setup-data-encryption.service",
         Label("guestos/init/setup-encryption/setup-var-encryption.sh"): "/opt/ic/bin/setup-var-encryption.sh",
-        Label("guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service"): "/etc/systemd/system/systemd-fsck@dev-mapper-var_crypt.service",
         Label("guestos/init/setup-lvs/setup-lvs.service"): "/etc/systemd/system/setup-lvs.service",
         Label("guestos/init/setup-lvs/setup-lvs.sh"): "/opt/ic/bin/setup-lvs.sh",
         Label("guestos/init/cleanup-config-bootstrap/cleanup-config-bootstrap.service"): "/etc/systemd/system/cleanup-config-bootstrap.service",

ic-os/components/guestos/init/setup-encryption/systemd-fsck@dev-mapper-var_crypt.service

@@ -130,37 +130,38 @@ function make_var_cryptsetup() {
     echo "Description=Cryptography Setup for var_crypt"
     echo "DefaultDependencies=no"
     echo "IgnoreOnIsolate=true"
-    echo "After=cryptsetup-pre.target"
+    echo "After=cryptsetup-pre.target systemd-udevd-kernel.socket"
     echo "Before=blockdev@dev-mapper-var_crypt.target"
     echo "Wants=blockdev@dev-mapper-var_crypt.target"
     echo "Before=var.mount"
+    # Run fsck after we are done, since we also create the FS in this generated unit
+    echo "Before=systemd-fsck@dev-mapper-var_crypt.service"
     echo "Conflicts=umount.target"
     echo "Before=cryptsetup.target"
     echo "Requires=init-config.service"
     echo "After=init-config.service"
     echo "Wants=ic-node-tmpfiles.service"
     echo "After=ic-node-tmpfiles.service" # needed for metrics
     # We need /boot/config for the decryption key (unless SEV is enabled)
-    echo "RequiresMountsFor=/boot/config"
+    echo "RequiresMountsFor=/boot/config/store.keyfile"
     echo "BindsTo=${SYSTEMD_DEVICE}"
     echo "After=${SYSTEMD_DEVICE}"
     echo "Before=umount.target"
     echo ""
     echo "[Service]"
     echo "Type=oneshot"
     echo "RemainAfterExit=yes"
-    echo "TimeoutSec=0"
+    echo "TimeoutSec=infinity"
     echo "KeyringMode=shared"
+    echo "OOMScoreAdjust=500"
     echo "ExecStart=/opt/ic/bin/setup-var-encryption.sh /dev/disk/by-partuuid/${PARTUUID} /dev/disk/by-partuuid/${ALT_PARTUUID}"
     echo "ExecStop=/lib/systemd/systemd-cryptsetup detach var_crypt"
-    echo "StandardOutput=journal+console"
-    echo "StandardError=journal+console"
 }
 
 CURRENT_SYSTEM=$(get_boot_arg_value dfinity.system)
 
 make_boot_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/boot.mount
-make_requires localfs.target boot.mount
+make_requires local-fs.target boot.mount
 make_requires boot-efi.mount boot.mount
 make_requires boot-grub.mount boot.mount
 
@@ -170,4 +171,5 @@ if [ "$OS_TYPE" == "hostos" ]; then
 else
     make_var_cryptsetup "$CURRENT_SYSTEM" >"$UNIT_DIR"/systemd-cryptsetup@var_crypt.service
     make_requires dev-mapper-var_crypt.device systemd-cryptsetup@var_crypt.service
+    make_requires cryptsetup.target systemd-cryptsetup@var_crypt.service
 fi