From bb2c842b1f89632e6e487df600244b1c526f66ee Mon Sep 17 00:00:00 2001 From: Arian van Putten Date: Wed, 16 Sep 2026 11:57:03 +0200 Subject: [PATCH] imds: actually default to the build-time IMDS network mode The imds-network= meson option has never had an effect on the generated network configuration. It arrived in 168a7f7770 together with the IMDS generator, which wired IMDS_NETWORK_LOCKED_DEFAULT (turned into IMDS_NETWORK_DEFAULT by c3e4e8a527) into the generator's arg_network_mode. But the generator only ever compares that variable against IMDS_NETWORK_OFF, to decide whether to pull systemd-imds-early-network.service into the initial transaction, and "off" is not one of the option's choices. It also never forwards the mode on to systemd-imds-early-network.service, neither as a command line switch nor via a drop-in. 85-imds-early.network is written by systemd-imds-early-network.service, which runs "systemd-imdsd --setup-network", and that code path's arg_network_mode was left at _IMDS_NETWORK_MODE_INVALID. As setup_network() requires "!= IMDS_NETWORK_UNLOCKED" before emitting the "prohibit" routes, the unset sentinel behaves exactly like "locked". At first that went unnoticed, because the option defaulted to "locked" as well: the documented default matched the implemented behaviour by accident, and only "-Dimds-network=unlocked" was quietly ignored. 6240d420d6 ("meson: unlock imds network by default") then flipped the default by reordering the option's choices, i.e. moved a macro that nothing consumed. From that point on the default was wrong for everybody: unless systemd.imds.network= is passed on the kernel command line, every generated network file locks the IMDS endpoint down, no matter how the build is configured. ac64b2dfa3 later documented the new default in man:systemd-imdsd@.service(8) (#42687), which meant the documentation now described behaviour that does not exist. In practice this rarely became visible until the previous commit, since systemd-imdsd --setup-network mostly lost its race against udev and wrote no network file at all. Initialize arg_network_mode from IMDS_NETWORK_DEFAULT, the same way imds-generator.c does. No other code distinguishes the INVALID sentinel from a real mode; the remaining users compare against IMDS_NETWORK_OFF and IMDS_NETWORK_UNLOCKED only. The kernel command line still overrides the build-time default, and the only difference in the generated network file are the two "prohibit" routes: the fwmark routing table and the matching routing policy rule are written in either mode, as before. --- src/imds/imdsd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/imds/imdsd.c b/src/imds/imdsd.c index 6f71e50e17..39a337d4e5 100644 --- a/src/imds/imdsd.c +++ b/src/imds/imdsd.c @@ -108,7 +108,7 @@ static char* arg_key = NULL; static bool arg_cache = true; static bool arg_wait = false; static bool arg_varlink = false; -static ImdsNetworkMode arg_network_mode = _IMDS_NETWORK_MODE_INVALID; +static ImdsNetworkMode arg_network_mode = IMDS_NETWORK_DEFAULT; static bool arg_setup_network = false; /* The follow configure the IMDS service endpoint details */