From 2d1c85206cda04b3a9e1be6b18416468632cc86b Mon Sep 17 00:00:00 2001
From: Michael Raymond <michael.raymond@canonical.com>
Date: Thu, 20 Nov 2025 16:50:59 -0500
Subject: [PATCH] feat: Systemd one-shot service for Kernel fallback mechanism

Adds a systemd one-shot service to amend the bootloader on a successfully
booted, new kernel entry using the -no-boot-next option.

Should a newly installed kernel panic while booting, no changes will
occur in the boot loader and the service ensures BootNext is not set
again on the bad kernel (unless another evocation of nullbootctl does).

In the event that a new kernel successfully boots, nullboot will amend
the boot loader with the new kernel.
---
 debian/nullboot-fallback.service | 16 ++++++++++++++++
 debian/nullboot.postinst         | 10 ++++++----
 debian/rules                     |  3 +++
 3 files changed, 25 insertions(+), 4 deletions(-)
 create mode 100644 debian/nullboot-fallback.service

diff --git a/debian/nullboot-fallback.service b/debian/nullboot-fallback.service
new file mode 100644
index 0000000..c40ad58
--- /dev/null
+++ b/debian/nullboot-fallback.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Ammend boot loader on successful kernel upgrades for TPM-backed FDE instances
+
+# Runs after basic system initialization and local filesystems are mounted.
+# This ensures a stable environment before proceeding to higher-level services.
+After=sysinit.target local-fs.target
+
+[Service]
+Type=oneshot
+
+# If BootCurrent is the latest kernel, update BootOrder
+# Also ensures a bad kernel is not reset to BootNext if a boot was unsuccessful
+ExecStart=/usr/bin/nullbootctl -no-boot-next
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/nullboot.postinst b/debian/nullboot.postinst
index 95601fa..e33b0a5 100644
--- a/debian/nullboot.postinst
+++ b/debian/nullboot.postinst
@@ -1,9 +1,11 @@
 #!/bin/sh
 set -e
-if [ "$1" = "triggered" ] || [ "$1" = "configure" ]; then
-    if [ -e "/boot/efi/EFI/ubuntu/" ]; then
-        nullbootctl
-    fi
+if [ "$1" = "configure" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    systemctl enable nullboot-fallback.service
+    nullbootctl
+fi
+if [ "$1" = "triggered" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    nullbootctl
 fi
 
 #DEBHELPER#
diff --git a/debian/rules b/debian/rules
index af5113c..4d2798d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -27,6 +27,9 @@ override_dh_gencontrol:
 	dh_gencontrol -- -Vshim-signed:Version=$(SHIM_SIGNED_VERSION)
 
 override_dh_auto_install:
+	mkdir -p debian/nullboot/etc/systemd/system
+	cp debian/nullboot-fallback.service debian/nullboot/etc/systemd/system/
+	chmod +x debian/nullboot/etc/systemd/system/nullboot-fallback.service
 	mkdir -p debian/nullboot/usr/lib/nullboot/shim
 	cp $(SHIM_DIR)/shim*.signed $(SHIM_DIR)/fb*.efi $(SHIM_DIR)/mm*.efi debian/nullboot/usr/lib/nullboot/shim
 	dh_auto_install -- --no-source