imds: actually default to the build-time IMDS network mode

The imds-network= meson option has never had an effect on the generated
network configuration. It arrived in 168a7f7770 together with the IMDS
generator, which wired IMDS_NETWORK_LOCKED_DEFAULT (turned into
IMDS_NETWORK_DEFAULT by c3e4e8a527) into the generator's
arg_network_mode. But the generator only ever compares that variable
against IMDS_NETWORK_OFF, to decide whether to pull
systemd-imds-early-network.service into the initial transaction, and
"off" is not one of the option's choices. It also never forwards the
mode on to systemd-imds-early-network.service, neither as a command
line switch nor via a drop-in.

85-imds-early.network is written by systemd-imds-early-network.service,
which runs "systemd-imdsd --setup-network", and that code path's
arg_network_mode was left at _IMDS_NETWORK_MODE_INVALID. As
setup_network() requires "!= IMDS_NETWORK_UNLOCKED" before emitting the
"prohibit" routes, the unset sentinel behaves exactly like "locked".

At first that went unnoticed, because the option defaulted to "locked"
as well: the documented default matched the implemented behaviour by
accident, and only "-Dimds-network=unlocked" was quietly ignored.
6240d420d6 ("meson: unlock imds network by default") then flipped the
default by reordering the option's choices, i.e. moved a macro that
nothing consumed. From that point on the default was wrong for
everybody: unless systemd.imds.network= is passed on the kernel command
line, every generated network file locks the IMDS endpoint down, no
matter how the build is configured. ac64b2dfa3 later documented the new
default in man:systemd-imdsd@.service(8) (#42687), which meant the
documentation now described behaviour that does not exist.

In practice this rarely became visible until the previous commit, since
systemd-imdsd --setup-network mostly lost its race against udev and
wrote no network file at all.

Initialize arg_network_mode from IMDS_NETWORK_DEFAULT, the same way
imds-generator.c does. No other code distinguishes the INVALID sentinel
from a real mode; the remaining users compare against IMDS_NETWORK_OFF
and IMDS_NETWORK_UNLOCKED only. The kernel command line still overrides
the build-time default, and the only difference in the generated network
file are the two "prohibit" routes: the fwmark routing table and the
matching routing policy rule are written in either mode, as before.

This commit is contained in:

Arian van Putten

2026-09-16 12:45:11 +02:00

committed by

Arian van Putten

parent 7bd5496bef

commit bb2c842b1f

1 changed files with 1 additions and 1 deletions

									
										src/imds/imdsd.c
									
		+1
		-1
	
												View File
												
				@@ -108,7 +108,7 @@ static char* arg_key = NULL;

				static bool arg_cache = true;

				static bool arg_wait = false;

				static bool arg_varlink = false;

				static ImdsNetworkMode arg_network_mode = _IMDS_NETWORK_MODE_INVALID;

				static ImdsNetworkMode arg_network_mode = IMDS_NETWORK_DEFAULT;

				static bool arg_setup_network = false;

				/* The follow configure the IMDS service endpoint details */