Root Filesystem Changes

This section covers the Root Filesystem changes that affect customer workflows.

Copytarget

Target Changes	Backward Compatible	Platform	OS
For the copytarget filesystems block that provides finer control to include/exclude files in each PCT-variant-based rootfs, the PCT-variant string updated from (standard, production, production_debug) to PCT-variants (dev_nsr, prod_nsr, test_nsr) itself for clarity. Specifically for kernel module yamls, the string boot_initramfs moved to the new copytarget-initramfs.yaml that recognizes two variants: boot_initramfs and prod_boot_initramfs for better picking of kernel modules for non-prod and prod initramfs respectively.	Yes	NSR	Linux

Release Migration Path

7.0.3.0 to 7.0.4.0

Migration Rationale

To rename filesystem variant strings based on PCT variants to PCT-variants itself for clarity. Initramfs-specific kernel modules moved to its own copytarget yaml for clarity.

Steps to Migrate

To update the existing copytarget yaml files (or create new ones), use the new PCT-variant strings (dev_nsr, prod_nsr, test_nsr) instead of the old PCT variant strings (standard, production, production_debug) in the copytarget filesystems block. For example:

filesystems:
   - standard:
   - production:
   - production_debug:

…are updated to:

filesystems:
   - dev_nsr:
   - prod_nsr:
   - test_nsr:

Default Mount Options for Writable Partitions

Target Changes	Backward Compatible	Platform	OS
The test_nsr, prod_nsr PCT variants (alongside their rootfs variants) mount partitions that are not DM-Verity protected (which includes writable partitions) are mounted with additional args: nosuid,nodev,noexec. In 7.0.3.0 specifically, the mount arg applies also to dev_nsr in addition to test_nsr and prod_nsr.	No	NSR	Linux

Release Migration Path

7.0.2.0 to 7.0.4.0

Migration Rationale

The additional restrictive mount args were added for better security, because non-DM-Verity protected partitions do not provide data integrity guarantees. Executing code, creating device nodes, or enabling SUID bits on files are risky partitions that can be tampered with.

Steps to Migrate

No action is required. To disable the restrictive mount args, add the following file to the rootfs before flashing: /etc/nvidia/disable_security_hardening.