Remove 5 seconds wait

Signed-off-by: Tommy <contact@tommytran.io>

UTM-Chrony.ign

@@ -6,12 +6,15 @@
     "shouldExist": [
       "mitigations=auto,nosmt",
       "spectre_v2=on",
+      "spectre_bhi=on",
       "spec_store_bypass_disable=on",
       "tsx=off",
       "kvm.nx_huge_pages=force",
       "nosmt=force",
       "l1d_flush=on",
       "spec_rstack_overflow=safe-ret",
+      "gather_data_sampling=force",
+      "reg_file_data_sampling=on",
       "random.trust_bootloader=off",
       "random.trust_cpu=off",
       "intel_iommu=on",

UTM-Chrony.yml

@@ -190,12 +190,15 @@ kernel_arguments:
   should_exist:
     - mitigations=auto,nosmt
     - spectre_v2=on
+    - spectre_bhi=on
     - spec_store_bypass_disable=on
     - tsx=off
     - kvm.nx_huge_pages=force
     - nosmt=force
     - l1d_flush=on
     - spec_rstack_overflow=safe-ret
+    - gather_data_sampling=force 
+    - reg_file_data_sampling=on
     - random.trust_bootloader=off
     - random.trust_cpu=off
     - intel_iommu=on

kargs

@@ -14,4 +14,4 @@
 
 # This file is just incase you want to quickly copy-paste the kernel arguments into `rpm-ostree kargs`
 
-mitigations=auto,nosmt spectre_v2=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=isolation_force efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off
+mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 console=tty0 console=ttyS0,115200

x86-QEMU-Docker.ign

@@ -6,12 +6,15 @@
     "shouldExist": [
       "mitigations=auto,nosmt",
       "spectre_v2=on",
+      "spectre_bhi=on",
       "spec_store_bypass_disable=on",
       "tsx=off",
       "kvm.nx_huge_pages=force",
       "nosmt=force",
       "l1d_flush=on",
       "spec_rstack_overflow=safe-ret",
+      "gather_data_sampling=force",
+      "reg_file_data_sampling=on",
       "random.trust_bootloader=off",
       "random.trust_cpu=off",
       "intel_iommu=on",
@@ -237,7 +240,7 @@
         "name": "postinst2.service"
       },
       {
-        "contents": "[Unit]\nDescription=Download gVisor\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Download gVisor\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "gvisor-downloader.service"
       },

x86-QEMU-Docker.yml

@@ -99,7 +99,6 @@ systemd:
         User=unpriv
         WorkingDirectory=/var/home/unpriv
         Type=oneshot
-        ExecStart=/usr/bin/sleep 5
         ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
         ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
         ExecStart=/usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
@@ -270,12 +269,15 @@ kernel_arguments:
   should_exist:
     - mitigations=auto,nosmt
     - spectre_v2=on
+    - spectre_bhi=on
     - spec_store_bypass_disable=on
     - tsx=off
     - kvm.nx_huge_pages=force
     - nosmt=force
     - l1d_flush=on
     - spec_rstack_overflow=safe-ret
+    - gather_data_sampling=force 
+    - reg_file_data_sampling=on
     - random.trust_bootloader=off
     - random.trust_cpu=off
     - intel_iommu=on