66 lines
2.7 KiB
Markdown
66 lines
2.7 KiB
Markdown
|
# Separate reboot procedure
|
||
|
|
|
||
|
|
This procedure begins only after successful package execution and review of its unique maintenance record. It never reboots automatically. Maintenance and validation records are atomic unique root-owned mode `0700` directories. They can contain sensitive operational metadata and must not be committed.
|
||
|
|
|
||
|
|
## Pre-reboot verification
|
||
|
|
|
||
|
|
Set the exact record path printed by `execute-maintenance.sh`:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
record=/var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
|
||
|
|
test -d "$record" || { printf 'STOP: invalid record path\n' >&2; return 1; }
|
||
|
|
```
|
||
|
|
|
||
|
|
Record the running kernel and review installed kernel packages:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
uname -a | tee "$record/running-kernel-immediately-before-reboot.txt"
|
||
|
|
pacman -Q linux linux-headers linux-zen linux-zen-headers |
|
||
|
|
tee "$record/installed-kernels-immediately-before-reboot.txt"
|
||
|
|
```
|
||
|
|
|
||
|
|
Verify both new module trees, kernel images, and nonempty initramfs files:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
find /usr/lib/modules /boot -maxdepth 2 -type f \
|
||
|
|
\( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
|
||
|
|
-printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' |
|
||
|
|
sort | tee "$record/verified-kernel-initramfs-files.txt"
|
||
|
|
|
||
|
|
find /boot -maxdepth 1 -type f \
|
||
|
|
\( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) -size 0 -print
|
||
|
|
```
|
||
|
|
|
||
|
|
Any zero-length artifact is a hard stop. Review DKMS and package hook output:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
dkms status | tee "$record/dkms-immediately-before-reboot.txt"
|
||
|
|
systemctl --failed --no-pager | tee "$record/failed-units-immediately-before-reboot.txt"
|
||
|
|
sed -n '1,240p' "$record/hook-restart-summary.txt"
|
||
|
|
```
|
||
|
|
|
||
|
|
Confirm bootloader state without changing it:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
bootctl status 2>&1 | tee "$record/bootctl-status-before-reboot.txt"
|
||
|
|
find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; 2>/dev/null |
|
||
|
|
tee "$record/systemd-boot-entries-before-reboot.txt"
|
||
|
|
|
||
|
|
grub-install --version 2>&1 | tee "$record/grub-version-before-reboot.txt"
|
||
|
|
test -f /boot/grub/grub.cfg &&
|
||
|
|
grep -E "^menuentry |^submenu |linux.*vmlinuz|initrd" /boot/grub/grub.cfg |
|
||
|
|
tee "$record/grub-entries-before-reboot.txt"
|
||
|
|
```
|
||
|
|
|
||
|
|
The operator must identify and record both the intended new-kernel entry and a known-good previous-kernel/fallback entry. Stop if boot entries or initramfs references are missing, DKMS failed, storage is degraded, backups are unavailable, SSH is unstable, or production is unhealthy.
|
||
|
|
|
||
|
|
## Separately approved reboot command
|
||
|
|
|
||
|
|
Only after explicit approval for this exact reboot:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
sudo systemctl reboot
|
||
|
|
```
|
||
|
|
|
||
|
|
Do not embed this command in the maintenance script, a timer, `at`, a shell trap, or a command chain. Keep independent console access open and proceed to `post-reboot-validate.sh` after the host returns.
|