UTM-Chrony.ign

@@ -191,6 +191,14 @@
       {
         "path": "/etc/systemd/system/multi-user.target.wants/tuned.service",
         "target": "/usr/lib/systemd/system/tuned.service"
+      },
+      {
+        "path": "/etc/systemd/system/kdump.service",
+        "target": "/dev/null"
+      },
+      {
+        "path": "/etc/systemd/system/debug-shell.service",
+        "target": "/dev/null"
       }
     ]
   },
@@ -235,16 +243,6 @@
       {
         "enabled": true,
         "name": "sshd.socket"
-      },
-      {
-        "enabled": false,
-        "mask": true,
-        "name": "kdump.service"
-      },
-      {
-        "enabled": false,
-        "mask": true,
-        "name": "debug-shell.service"
       }
     ]
   }

UTM-Chrony.yml

@@ -100,12 +100,6 @@ systemd:
       enabled: false
     - name: sshd.socket
       enabled: true
-    - name: kdump.service
-      enabled: false
-      mask: true
-    - name: debug-shell.service
-      enabled: false
-      mask: true
 storage:
   files:
     - path: /etc/zincati/config.d/51-rollout-wariness.toml
@@ -184,6 +178,10 @@ storage:
       target: /usr/lib/systemd/system/unbound.service
     - path: /etc/systemd/system/multi-user.target.wants/tuned.service
       target: /usr/lib/systemd/system/tuned.service
+    - path: /etc/systemd/system/kdump.service
+      target: /dev/null
+    - path: /etc/systemd/system/debug-shell.service
+      target: /dev/null
 kernel_arguments:
   should_exist:
     - mitigations=auto,nosmt

etc/pki/rpm-gpg/RPM-GPG-KEY-divested

@@ -25,5 +25,4 @@ Oty5be+U84lKVIgG5N60VrJzkwi5J+FSx2hTJl0C5BZyKChDXXvlnJI2Y4Qrwjyz
 ayf77gecLuCVt+LhCH1rFejeIZrl0QEw+udrTYrPt3BWUK2OOIzF8PqLHfyUF+7W
 ZuLgMxj0nGLMqOlPSszrQ6RxmL//GmXkmE3CeDNXV+7SpmMYe07pHzycg8+d/tNq
 EajUfLQJqUYj3m51MnKW2r+QUKjkIYsn4iFfk+2aeY5HX1RalWJ7d4NHJQ==
-=qpX+
------END PGP PUBLIC KEY BLOCK-----
+=qpX+

x86-QEMU-Docker.ign

@@ -217,6 +217,14 @@
       {
         "path": "/etc/systemd/system/multi-user.target.wants/tuned.service",
         "target": "/usr/lib/systemd/system/tuned.service"
+      },
+      {
+        "path": "/etc/systemd/system/kdump.service",
+        "target": "/dev/null"
+      },
+      {
+        "path": "/etc/systemd/system/debug-shell.service",
+        "target": "/dev/null"
       }
     ]
   },
@@ -228,7 +236,7 @@
         "name": "postinst.service"
       },
       {
-        "contents": "[Unit]\nDescription=Initial System Setup Part 2\n# We run this after the packages have been overlayed\nAfter=network-online.target\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/lib/postinst.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/echo 'libhardened_malloc.so' | tee /etc/ld.so.preload\nExecStart=/usr/bin/systemctl enable --now firewalld\nExecStart=/usr/bin/firewall-cmd --lockdown-on\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup Part 2\n# We run this after the packages have been overlayed\nAfter=network-online.target\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/lib/postinst.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/echo 'libhardened_malloc.so' | tee /etc/ld.so.preload\nExecStart=/usr/bin/systemctl enable --now firewalld\nExecStart=/usr/bin/firewall-cmd --lockdown-on\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "postinst2.service"
       },
@@ -276,16 +284,6 @@
       {
         "enabled": true,
         "name": "sshd.socket"
-      },
-      {
-        "enabled": false,
-        "mask": true,
-        "name": "kdump.service"
-      },
-      {
-        "enabled": false,
-        "mask": true,
-        "name": "debug-shell.service"
       }
     ]
   }

x86-QEMU-Docker.yml

@@ -72,7 +72,6 @@ systemd:
         ExecStart=/usr/bin/echo 'libhardened_malloc.so' | tee /etc/ld.so.preload
         ExecStart=/usr/bin/systemctl enable --now firewalld
         ExecStart=/usr/bin/firewall-cmd --lockdown-on
-        ExecStart=/usr/bin/touch /var/lib/%N.stamp
         ExecStart=/usr/bin/systemctl --no-block reboot
 
         [Install]
@@ -157,12 +156,6 @@ systemd:
       enabled: false
     - name: sshd.socket
       enabled: true
-    - name: kdump.service
-      enabled: false
-      mask: true
-    - name: debug-shell.service
-      enabled: false
-      mask: true
 storage:
   files:
     - path: /etc/zincati/config.d/51-rollout-wariness.toml
@@ -251,6 +244,10 @@ storage:
       target: /usr/lib/systemd/system/unbound.service
     - path: /etc/systemd/system/multi-user.target.wants/tuned.service
       target: /usr/lib/systemd/system/tuned.service
+    - path: /etc/systemd/system/kdump.service
+      target: /dev/null
+    - path: /etc/systemd/system/debug-shell.service
+      target: /dev/null
 kernel_arguments:
   should_exist:
     - mitigations=auto,nosmt