SmartConfig

Review of M4 chunk C (steps 7-10)

Date: 2026-10-04. One reviewer (an AI agent) worked on cbd6483..b6f8dd5. The chunk is:

• the GRUB entry and menu flag (scripts/42_smartconfig);
• the grubenv flag in sc boot;
• the rescue drop-in;
• the +i/+a precheck.

The reviewer ran 11 boots of a throwaway QEMU guest, 5 UEFI and 6 BIOS, two of them with VGA screendumps. The guest had a separate /boot and the hardest menu settings: hidden, timeout 0, GRUB_RECORDFAIL_TIMEOUT=0. It found nothing high or medium, and 8 low findings and 5 cleanups.

Claude fixed all of them. Before committing, Claude ran an adversarial check: four skeptic agents each tried to refute one group of fixes. They confirmed 11 fixes. They refuted one: the console still overflowed 80×25, through symlink rows and the new-file mv. They also raised 18 smaller issues. All of that was then fixed in the same commit.

The step 11 design workflow, run alongside, found one more bug, in sc status’s mode. Everything is in 683678a.

Findings

Area	Finding	Severity	Fixed in
units	ConditionPathIsExecutable= is no systemd key; systemd ignored it with a warning, so “skipped without sc” (chunk B) did nothing. The tests took verify’s exit 0 for clean.	low	683678a: ConditionFileIsExecutable=, and the tests fail on any systemd-analyze output
flag	grub-editenv rewrites grubenv in place with no lock. Since C4, sc boot seen could run at the same time as grub-common.service (unset recordfail) and grub-initrd-fallback.service, losing writes. A stress test lost 9 flag writes and 21 recordfail unsets in 300 runs.	low	683678a: seen runs before both, sc-boot-ok after seen. Those three units now wait for seen, which takes about a second.
grub	With GRUB_DISABLE_LINUX_UUID=true, root= was PARTUUID=… or empty, where 10_linux gives the device.	low	683678a: GRUB_DISABLE_LINUX_PARTUUID defaults to true, as in 10_linux, tested with this machine’s real UUID and PARTUUID links
grub	ro came before GRUB_CMDLINE_LINUX, so an rw there made the rescue root writable. Shown in the lab.	low	683678a: ro after it
drop-in	The report went to /dev/console alone, which is the last console=. A screen with a serial console got no report.	low	683678a: the report goes to every console in /sys/class/tty/console/active, each with a 2 s write deadline, so a stalled console cannot hold up the shell
status	The console report went past 80 columns: 20 rows of report plus 5 of prompt filled 80×25 exactly, with no margin.	low	683678a: at most 20 screen rows, counting wrapped lines (see the refuted fix below)
restore	ReplaceRefused ran before the other refusals. An absent file’s deletion row was refused in a +i directory, a digest row’s message was hidden, and the file was opened before safeDir.	low	683678a: it runs last, after the blob read and safeDir, in both Restore and CanReplace
grub	GRUB_DISABLE_RECOVERY=true was ignored.	low	683678a: no entry is added; the menu flag stays
tests	Surviving mutations: version order, the UUID and PARTUUID branches, the timeout rule, Stat instead of Lstat, a failing grub-editenv, +a on the target and +i on the directory.	cleanup	683678a: a test for each
fsutil	The flags were read into a uint64, which is wrong on big-endian.	cleanup	683678a: uint32
plan	Section 3.3 named 00_header’s filesystem check; the code checks for a 1024-byte block.	cleanup	plan change C5
grub	A /boot whose kernels have no initrd got no entry, with no word said.	cleanup	683678a
plan	The rescue boot cannot clear the flag, so the first boot after the fix shows the menu once more.	cleanup	683678a: sc status says so, only when this boot has no ok verdict; plan change C5

Adversarial check of the fixes

Refuted, then fixed. The console could still pass 25 rows:

• a symlink row’s “now a symlink to TARGET” had no length cap;
• a new file’s mv PATH PATH.sc-off wrapped for any path over 33 characters.

Both now fit:

• a row budget counts screen rows, so a wrapped line counts twice;
• the problem column is cut to 40;
• a symlink’s target is left out;
• a new file is moved aside with cd DIR and a short mv;
• fit() cuts at a rune boundary.

Issues it raised, fixed:

• The seen unit’s comment “nothing waits for it” was now false.
• RequiresMountsFor=/usr/local/sbin was added: with a separate /usr/local, the condition was checked before the mount.
• powerpc encodes FS_IOC_GETFLAGS as 0x40086601, so there is now a constant per architecture.
• ReplaceRefused opened FIFOs and devices; it now opens only regular files and directories.
• It reported one flag per run; it now reports every flag at once.
• A console error reached only /dev/console; it now goes into the report.
• “The menu shows once more” was wrong when rescue was entered from a healthy boot.
• no_entry was not initialized.

Found by the step 11 design:

• sc status read the mode only from emergency.target and rescue.target.
• In the drop-in, only emergency.service or rescue.service is activating, and the target is reached after it.
• So the fstab-failure emergency report said “normal”, with no daemon-reload and no reboot.
• It now reads the services too.

Deferred:

• A multipath root: 10_linux switches to /dev/mapper/<name> and 42 gives UUID=. This sits with the LVM and LUKS non-goals.
• A whole-boot ordering-cycle test with the real grub units: verify runs each unit alone.
• The console report is held until sc returns, so a hung sc shows nothing; the shell still starts.

Held up

• The lab’s 11 boots, UEFI and BIOS:
  • The rescue entry booted 4 times, each with a read-only root and /boot not mounted.
  • The flag was set at seen, cleared on ok and kept on bad: 6 ok verdicts and 1 bad.
  • Every flagged boot showed a 30 s menu even with GRUB_TIMEOUT=0 and GRUB_RECORDFAIL_TIMEOUT=0.
  • The case recordfail misses was caught: the fstab failure went on to multi-user, recordfail was cleared, and the flag stayed.
• The drop-in: the report printed directly above “Press Enter” in emergency and rescue mode, and exit 2 did not stop the shell.
• ReplaceRefused: it matches the kernel. A +a directory blocks a rename into it, a +a target blocks a rename over it, and a +i directory blocks a create.

Tests

• New or extended: TestGrubScriptDetails, TestBootMenuFlag (a symlink, a failing tool), TestRestoreRefusesImmutable (5 flag cases, both at once, the digest refusal first, the absent deletion), TestStatusConsole (20 screen rows), TestStatusConsoleFits, TestStatusConsoleErrors, TestStatusAllConsoles, TestStatusModeFromSystemd, TestBootUnits and TestRescueDropIn (verify must print nothing).
• All tests pass as a user, as root and under race.
• sc builds for amd64, arm64, riscv64, loong64, ppc64le and s390x.