DRM drivers are filtered for drm_crtc_init symbol,
but not all drivers use it. Especially, cirrus driver
doesn't use it since Linux 5.2.
The practical result is text plymouth theme instead of graphical when in qemu.
Fix it by looking also for drm_dev_register symbol.
Suggested by @haraldh
Fixes#712
Currently there is no usb support on RPi4 in the
initrd phase as the pcie-brcmstb module is missing.
If part of the boot is handled from a USB stick
(e.g. with Ignition), the stick cannot be accessed.
Reference: boo#1162669
systemd provides its own cryptsetup facilities, and the
cryptsetup binary might not even exist, failing
to execute the discard flag processing.
Fixes#602
Debian mkinitramfs does not create the file 'early_cpio', so detection
of additional cpio images fails and only the first cpio is listed.
I checked some Arch and Gentoo initramfs files and these didn't have
'early_cpio' either, but they also have only one cpio part.
Fix this so that if check for 'early_cpio' fails, check if firmware
files ('/kernel/*/microcode/*.bin') exist.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
If the temporary directory for images is mounted with 'noexec', dracut
would construct unbootable images because most dynamic libraries
aren't installed. Avoid this by not resolving library dependencies
lazily if the temporary directory is mounted with 'noexec'.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
GitHub workflows fetch a clone of the dracut repository which doesn't
contain git tags, thus "breaking" the RPM build in certain situations
i.e.:
DRACUT_MAIN_VERSION in Makefile is defined as an output of `git describe`,
which in full git clone returns a tag with a numeric version. However,
without tags it returns SHA of the last commit, which later propagates into
`Provides:` attribute of the built RPM and can break dependency tree when
installed
`make rpm` usually chose `/tmp` as the `$rpmbuild` dir, which breaks the
dracut build, since it needs to execute `./configure`, but `/tmp` is
mounted with `-o noexec`, leading to:
```
/var/tmp/rpm-tmp.SwEhJO: line 46: ./configure: Permission denied
error: Bad exit status from /var/tmp/rpm-tmp.SwEhJO (%build)
RPM build errors:
Bad exit status from /var/tmp/rpm-tmp.SwEhJO (%build)
```
Switching to `/var/tmp` helps in this case.
The original behavior of $env{INTERFACE} was undocumented and changed in
the recent udev versions, breaking the ability to bring up networking
reliably. Switching to $name directive should fix this issue.
Related links:
- systemd/systemd#12700 (udev PR)
- systemd/systemd#12291 (related udev issue)
- systemd/systemd#14935 (this issue, udev side)
- #732 (this issue, dracut side)
Fixes: #732
Previously, we were doing `setup_net` from `ifup` for any setup that
wasn't DHCP, since those are already taken care of by `dhclient-script`.
The issue is that the case-statement we use to detect this doesn't catch
options like `ip=dhcp,dhcp6`.
Fix this by reworking the logic here to just check if a
`setup_net_$netif.sh` hook exists. If so, then we know that `setup_net`
will be called for this interface later.
This was causing issues in RHCOS which now ships with `ip=dhcp,dhcp6` to
support IPv6 environments[1]. The code here would make us do `setup_net`
pre-emptively which IIUC would then cause the initqueue to finish
earlier even if we had more udev netif events to process.
[1] https://github.com/coreos/coreos-assembler/pull/1067
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803926
Checks if `uefi_splash_image` exists in `dracutsysroot` if not unset
`uefi_splash_image`. Alternate Value parameter expansion adds section-vma
for splash image to EFI stub loader when the path to image is valid and
not an empty file.
I did not test on other distributions, but on Arch Linux the `systemd`
package includes a splash image at the path
`/usr/share/systemd/bootctl/splash-arch.bmp`. Perhaps, if this is a
common practice, a default image could be gathered from that directory.
It is required that the image be in bitmap (`.bmp`) format according to
`splash.c`.
The code for `stub.c` and `splash.c` can be found at:
https://github.com/systemd/systemd/blob/master/src/boot/efi/stub.chttps://github.com/systemd/systemd/blob/master/src/boot/efi/splash.c
This reverts commit c603419030.
wait_for_ipv6_dad_link is only called from dhclient script,
so the original intent "wait for IPv6 RA if using none/static IPv6 assignment"
does not seem to be correct.
Anyway, this brings an issue on isolated networks, where you don't
have any routes outside. dhclient-script hangs on this check
and after it times out, dhclient is able to set the address normally.
Due to the way dracut-install handles modules from custom kmoddirs, add
a test that ensures the kmoddir argument seems sane.
In addition to erroring out, provide some guidance on how to proceed, as
well as a method of skipping the test via environment variable.
dracut, when passing --kmoddir, would only install modules that exist at
the same location as it will appear in the initramfs.
For most (possibly all) outputs, the output path would be /lib/modules,
so previously all kernel modules must be copied there or the module
installation silently fails.
Now use the original path variable, and install to the shortened path
variable (as calculated by kerneldirlen).
Note: This means that the argument to --kmoddir (and the modules filetree)
should be a directory that ends in 'lib/modules/$kernelversion'.
Some distributions (Arch, Gentoo) ship prepacked microcode images. These
are cpio images that follow the structure specified in the Linux kernel
documentation (x86/microcode.rst, "Early load microcode"), the same
structure dracut uses for its early microcode images.
In case of Arch Linux, the microcode for Intel CPUs is currently only
available in this packed form, /usr/lib/firmware/intel-ucode does not
exist. This commit adds a way to make use of these images on such
systems by unpacking them to the early cpio directory. (Note that the
packed image cannot be used directly since dracut might need to add ACPI
tables to the early initramfs.)
This approach has the drawback that it is not possible to control the
selection of CPUs to be included in the microcode file in host-only
mode, so we only try it as a last ressort if no unpacked microcode could
be found in fw_dir.
The list of possible file names for the packed microcode image is taken
from GRUB (cf. GRUB_EARLY_INITRD_LINUX_STOCK), but can be adapted by
setting "early_microcode_image_name" (and "early_microcode_image_dir")
in a dracut configuration file.
Otherwise we won't retry dhclient again on that interface. In
FCOS/RHCOS, we want to bake in `ip=dhcp,dhcp6` so we automatically try
getting a DHCPv6 lease if DHCPv4 failed.
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1793591
If hostonly mode is in use, and there isn't any block device included
as hostonly device, then the initramfs won't need any block driver.
Eg. for kdump built image, there could be only one nfs mount point,
or the initramfs may only execute some network operation then reboot.
In such case, skip block driver installation to save space and time.
Signed-off-by: Kairui Song <kasong@redhat.com>
This is a simple trick to honor RFC 3442:
If the DHCP server returns both a Classless Static Routes option and
a Router option, the DHCP client MUST ignore the Router option.
Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
Previous all files are installed with inst_dir, which will not install
the files under /etc/iscsi/, and it create folders with the same of the
files which is wrong.
Now only use inst_dir to install the config dir and ensure it
exists, and use inst_multiple to install the config files.
Signed-off-by: Kairui Song <kasong@redhat.com>
NetworkManager would unnecessarily bring up the devices, colliding with
further attempts to rename the devices.
This is arguably a NetworkManager bug and should eventually be fixed there.
Running NetworkManager without the connection is unnecessary regardless.
Instead of carrying the kernel and hmac in the install.img (which takes
up more space) use the vmlinuz installed under /images/pxeboot/ and the
.hmac in the install.img /boot.
This check is triggered by the presence of /run/install/repo/images/pxeboot/vmlinuz
Related: rhbz#1782737
since we handle the retries explicitly via rd.net.dhcp.retry
Without -1 if user sets ip=dhcp6 and there is no dhcp on the network,
dhclient seems to wait indefinitely, ignoring rd.net.timeout.dhcp
The actual syntax of nsswitch.conf is slightly different from the
current regular expression:
- A comment can appear anywhere, not just at the beginning of a
line.
- Action items take the general form [STATUS=ACTION] or
[!STATUS=ACTION] (with some optional whitespace).
- A service name cannot include a colon. This is a nitpick,
because there should never be more than a single colon per
line.
Signed-off-by: Petr Tesarik <ptesarik@suse.com>
Setting up the machinery to boot with the aid of real networked boot loader
(such as iPXE) would involve much hassle, including possibly serving the kernel
and initrd via TFTP, etc.
Let us generate the iBFT table ourselves, with a Perl script. Include the
pregenerated table as well so that the test run won't depend on Perl. In the
end it's just reproducibly built static data, totally independent of the host
system.
New systemd defaults to generating MAC addresses for software devices (whereas
previously they would inherit them from the first enslaved slave).
Sadly, among the things this breaks is our test fixture, where the dhcp servers
are configured to expect a particular MAC address. Disable this for the
affected tests, which are essentially the ones that use bridges and bonds.
The network interfaces appear asynchronously and sometimes just too late,
after we're already halfway throught server-init.sh:
+ ip link set dev eth0 name ens3
Cannot find device "eth0"
+ ip addr add 192.168.50.1/24 dev ens3
Cannot find device "ens3"
+ dhcpd -cf /etc/dhcpd.conf -lf /var/lib/dhcpd/dhcpd.leases ens3 ens5
...
[ 8.040825] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:01:12:34:56
[ 8.047105] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection
...
No subnet declaration for ens3 (no IPv4 addresses).
** Ignoring requests on ens3. If this is not what
you want, please write a subnet declaration
in your dhcpd.conf file for the network segment
to which interface ens3 is attached. **
Whoopsie. Let's ensure all the interfaces are there before we proceed
fiddling around with them.
dmraid requires kpartx to activate device mapper.
But kpartx is only a recommend dependency.
Check for kpartx's existent first.
Signed-off-by: Doan Tran Cong Danh <congdanhqx@gmail.com>
multipath requires kpartx to activate device mapper.
But kpartx is only a recommend dependency.
Check for kpartx's existent first.
Signed-off-by: Doan Tran Cong Danh <congdanhqx@gmail.com>
commit 5e0f8c8a4c ('network-manager: remove useless use of basename')
somewhat carelessly didn't take into account that $_i has a slash at
the end which made the result of the ## substitution be just an empty
string.
The slash was put to the end of /sys/class/net/*/ to make sure we're only
iterating directories, but it's not strictly necessary. In an unlikely case
something else than a directory appears in /sys/class/net/, we'll already deal
with it gracefully. Remove it.
This fixes the TEST-30-ISCSI test.
E.g. in RHCOS, the `BOOT_IMAGE` from the cmdline is:
(hd0,gpt1)/ostree/rhcos-e493371e5ee8407889029ec979955a2b86fd7e3cae5a0591b9db1cd248d966e8/vmlinuz-4.18.0-146.el8.x86_64
Which of course is a GRUB thing, not an actual pathname we'll be able to
resolve. In fact, we can simply scrap it off from the variable. Our code
is already able to handle both cases: whether the device refers to a
separate boot partition, or just the root filesystem with a regular
`/boot` directory.
It's already the case the `BOOT_IMAGE_PATH` today, in the non-empty
case, includes a trailing `/`, but let's add it to the path we build
here too to make it more obvious.
That way, the HMAC file can contain a relative path instead of an
absolute one. The issue is that right now the kernel RPM bakes the
`/boot/vmlinuz-${kver}` path into the HMAC file which poses an issue for
rpm-ostree systems (and any other system where the kernel isn't simply
in the top-level `/boot`.
For now, we're hacking around this in rpm-ostree:
https://github.com/coreos/rpm-ostree/pull/1934
Though I'd like to propose the same change in the kernel spec file.
There is a small regression in #343: when handling the 'separate boot
partition' case, we're checking for the kernel image in the wrong
location: `BOOT_IMAGE` is the `/boot`-relative path to the kernel image,
so `/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE}` expands to e.g.
`/boot/mysubdir1/mysubdir2/mysubdir1/mysubdir2/vmlinuz...`.
We should be using `BOOT_IMAGE_NAME` here instead (and in fact, the next
if-statement does this correctly, so it might've just been accidentally
left out of #343).
For the shell scripts, new environment variables were introduced.
dracutsysrootdir is the root directory, file existence checks use it.
DRACUT_LDCONFIG can override ldconfig with a different one that works
on the sysroot with foreign binaries.
DRACUT_LDD can override ldd with a different one that works
with foreign binaries.
DRACUT_TESTBIN can override /bin/sh. A cross-compiled sysroot
may use symlinks that are valid only when running on the target
so a real file must be provided that exist in the sysroot.
DRACUT_INSTALL now supports debugging dracut-install in itself
when run by dracut but without debugging the dracut scripts.
E.g. DRACUT_INSTALL="valgrind dracut-install or
DRACUT_INSTALL="dracut-install --debug".
DRACUT_COMPRESS_BZIP2, DRACUT_COMPRESS_LBZIP2, DRACUT_COMPRESS_LZMA,
DRACUT_COMPRESS_XZ, DRACUT_COMPRESS_GZIP, DRACUT_COMPRESS_PIGZ,
DRACUT_COMPRESS_LZOP, DRACUT_COMPRESS_ZSTD, DRACUT_COMPRESS_LZ4,
DRACUT_COMPRESS_CAT: All of the compression utilities may be
overridden, to support the native binaries in non-standard places.
DRACUT_ARCH overrides "uname -m".
SYSTEMD_VERSION overrides "systemd --version".
The dracut-install utility was overhauled to support sysroot via
a new option -r and fixes for clang-analyze. It supports
cross-compiler-ldd from
https://gist.github.com/jerome-pouiller/c403786c1394f53f44a3b61214489e6f
DRACUT_INSTALL_PATH was introduced so dracut-install can work with
a different PATH. In a cross-compiled environment (e.g. Yocto), PATH
points to natively built binaries that are not in the host's /bin,
/usr/bin, etc. dracut-install still needs plain /bin and /usr/bin
that are relative to the cross-compiled sysroot.
The hashmap pool allocate_tile/deallocate_tile code was removed
because clang-analyze showed errors in it. hashmap_copy was removed
because it wasn't used and clang-analyze showed errors in it.
DRACUT_INSTALL_LOG_TARGET and DRACUT_INSTALL_LOG_LEVEL were
introduced so dracut-install can use different settings from
DRACUT_LOG_TARGET and DRACUT_LOG_LEVEL.
Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
It looks like only the 'fips=1' is really supported and it is working
correctly. So instead of failing on 'fips' not clear way give user
information why we are failing.
Intel has notified us that some microcode updates are not safe
to be applied during runtime. To accomodate for that, microcode
files shipped by SUSE and openSUSE have an '.early' postfix such
that triggering
/sys/devices/system/cpu/microcode/reload
from a booted system cannot pick up the ucode by accident, while
still allowing the code to be picked up during initrd time.
This change is needed to make this scheme work also in a hostonly
situation.
Currently, this affects only 06-4f-01, which is now 06-4f-01.early.
If a distro does not change the filename, the behavior does not
change.
Reference: osc#1098915
The new qedi driver needs to be handled just like
the bnx2i driver, so update 95iscsi scripts to do this.
References: bsc#1113712
Signed-off-by: Lee Duncan <lduncan@suse.com>
Unmounting the image iso, detaching its loop device, and unmounting
its parent partition can simplify installation to the parent disk.
Note that programs or scripts using the /run/initramfs/live mount
point will fail.
Fixes these error messages during intird build:
cat: '/sys/devices/platform/host2/flashnode_sess-*/is_boot_target': No such file or directory
/usr/lib/dracut/modules.d/95iscsi/module-setup.sh: line 91: [: -eq: unary operator expected
cat: '/sys/devices/platform/host3/flashnode_sess-*/is_boot_target': No such file or directory
/usr/lib/dracut/modules.d/95iscsi/module-setup.sh: line 91: [: -eq: unary operator expected
The goal of this module is to enable automatic loading of the
thermal/fan control modules on PowerPC based Macs, as on some
modular kernel configurations this will not happen automatically
which will result in the fans spinning up to 100% until they are
manually loaded.
This is especially a problem in live systems where it takes some
time to boot up and the spin-up happens before the system even
leaves initramfs.
Commmit 8a33e52e2f94 assumes that dracut's work is done if a root device
is found. This holds usually for booting computers, but it may be wrong
for other environments.
Only short-cut the waiting if $netroot is also set.
Fixes: 8a33e52e2f94 ("network: stop waiting for interfaces if root device is present")
References: bsc#1152006
On SLE15-SP1 at least, iscsiadm doesn't support combining --op and --login":
> # iscsiadm -m node -T iqn.2018-06.de.suse.zeus:01 --op=update --name=node.startup --value=onboot --login
> iscsiadm: Invalid parameters. Login/logout and op passed in
This breaks iSCSI login in initrd, and thus, iSCSI boot.
Fix it by not coalescing everything into a single iscsiadm command.
Fixes: a59b776bc215 ("Dracut: only login to one target at a time")
References: bsc#1152650
According to the dracut README, module code to be run in
the initrd must be POSIX-compliant. Replace remaining
bashisms (as reported by checkbashisms) with POSIX compliant
code.
The use of "type" is not strictly POSIX compliant, but it's
all over the place in dracut code. dash supports it, anyway.
In multipath scenarios, "iscsiadm -m node" may contain
several records with the same target.
There's no point in trying "iscsiadm --login" multiple
time for the same target, through the same portal.
Moreover, warn if the desired target is not on the node
list.
dracut waits for every iscsiroot connection to be established
before switching root. This is not necessary in multipath scenarios,
where a single path is usually sufficient to set up the root device,
and where users expect booting to succeed unless all paths are down.
Don't wait for the iscsi portal to start if the root device has
already been found.
For handling the configuration where there are two
paths to an iscsi root target, each using a different
NIC. In such a case, the initramfs was trying to configure
the first NIC, then call iscsiroot to login to both targets,
which would fail for the 2nd target, since the path to the
2nd target was not yet configured. This would eventually
work after a timeout. But it's better to login to just
one target at a time.
This change makes the initramfs handle multiple paths to an
iscsi target better by logging into only one target at a time,
rather than trying to login to all targets when only one of
several NICs is up.
This can be further optimized by using the initrd parameter
"rd.iscsi.testroute", which would skip iscsiadm login attempts
for targets to which no route exists.
If the script is called again via the timeout initqueue,
we try "iscsiadm -L onboot" again, hoping that some targets
may now have become reachable.
Harald Hoyer <harald@redhat.com>: Squashed commit of the following:
commit 4b5e5da6061983964a85d1671bd1c97c48ee76f1
Author: jbash aka John Bashinski <jbash@velvet.com>
Date: Thu Aug 1 13:21:35 2019 -0400
Documentation: add systemd warning for rd.luks.key, clean up related text
Currently it starts the cleaner early and do the clean up job if switch
root is called. It's better to just start the service only on switch
root to avoid any risk of service dependency failure and make is
simpler.
Signed-off-by: Kairui Song <kasong@redhat.com>
Before we check if dad is done we should first make sure,
that there is a link local address where we do the check.
Due to this issue, on ipv6 only setups sometimes dhclient started
asking for ip address, before the link local address was present
and failed immediately.
I'd like to rework CoreOS Ignition (which runs in the initramfs)
to include some values from the *real* `/etc/os-release` in
HTTP headers.
Looking at this, it turns out dracut eats almost all of the useful
information from it. I don't think `dracut` should be the `ID`
here...dracut's not an OS itself, it's a way to *build* little
operating systems. It'd be kind of like if Fedora's Koji
injected itself into `/etc/os-release`.
This code dates back a long time; not sure of all the rationale
behind it.
I changed it so that we keep extending the VERSION/PRETTY_NAME
with the dracut version, but otherwise "pass through" the
rest of the real `/etc/os-release` we were built from unchanged.
This change still supports Python 2.6 and 2.7 but loses support
for Python 2.5.
The reason for this change was that Fedora 30 does not ship
python-imgcreate but ships python3-imgcreate.
Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>
The `README.md` was nearly empty. Move the travis bits into
`README`, then rename `README` to `README.md`.
This matches the Github standard. A major compelling feature
of Github is how prominently it displays a project's `README.md`,
so let's ensure ours has content.
Starting with the 0.7.7 release of the multipath tools, the multipath
udev rules always set a value in ENV{DM_MULTIPATH_DEVICE_PATH} for any
device that multipath scans. A value of 0 means that the device is not
claimed by multipath, and a value of 1 means that it is. Because of
this, udev rules that check ENV{DM_MULTIPATH_DEVICE_PATH}=="?*" will
always return True, and act as if every scanned device is claimed by
multipath. Checking ENV{DM_MULTIPATH_DEVICE_PATH}=="1" will work
correctly for both the old and new versions of the multipath tools.
For LUKS2 partitions cryptsetup needs a locking directory. If it does
not exist, cryptsetup will create it, but produce a warning
WARNING: Locking directory /run/cryptsetup is missing!
in the process that we do not want to see in the dracut output.
Since Bash 4.4, command substitutions containing null bytes produce a
warning of the form
/usr/sbin/dracut: line 1958: warning: command substitution: ignored null byte in input
Remove the trailing null byte from the UEFI kernel command line file
before printing it to suppress this warning.
The RPM build failed on due to missing and unpackaged files on my Fedora
machine that happened to have %fedora set to %nil for reasons long
forgotten.
This is probably not a likely scenario, but some of the conditions in the
SPEC file are still wrong and perhaps worth fixing.
Default value of EVMKEYDESC (in evm-enable.sh) is "evm-key" and it's
also specified previously in this README file.
Signed-off-by: Petr Vorel <pvorel@suse.cz>
When booting with Fedora-Server-dvd-x86_64-30-20190411.n.0.iso,
/proc/cmdline is empty (libvirt, qemu host with bios, not sure if that
matters), after installation to disk, anaconda would "crash" in kernel-core
%posttrans, after calling kernel-install, because dracut would fail
with
> Could not determine the kernel command line parameters.
> Please specify the kernel command line in /etc/kernel/cmdline!
I guess it's legitimate, even if unusual, to have no cmdline parameters.
Two changes are done in this patch:
1. do not fail if the cmdline is empty.
2. if /usr/lib/kernel/cmdline or /etc/kernel/cmdline are present, but
empty, ignore /proc/cmdline. If there's explicit configuration to
have empty cmdline, don't ignore it.
The compressed firmware support was supposed to be already
implemented, but it didn't work as expected in the end, because dracut
moved to use dracut-install binary. This patch adds the support of
XZ-compressed firmware installation to dracut-install for fixing the
missing piece.
At best the firmware files should be uncompressed in initrd, but this
patch simply copies the compressed file as-is, as a quick workaround.
BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1146769
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When a SHA-1 hash of a specific commit is used as a tag, the regex
shenanigans later in the script can (and will) corrupt it in certain
cases.
e.g.:
$ perl -e '
$tag="6e8cd92261577230daa1098f7e05ec198c3c4281";
$tag=~s/[^0-9]+?([0-9]+)/$1/;
print("$tag\n");
'
68cd92261577230daa1098f7e05ec198c3c4281
(Notice the missing 'e')
Let's fix this by limiting the regex's scope to a non-SHA-1 tags only.
Previously with squash module, some binaries will be reinstalled, but
stripping happens before that so new installed binaries is not stripped.
So adjust the squash and strip order, ensure new installed binaries are
stripped just the same way with the old binaries.
Also split squash into two stage to make the split easier, move the
squash temp dir into initdir so stripping will cover that too,
and print more usefule message.
Signed-off-by: Kairui Song <kasong@redhat.com>
When you install a third-party driver, you will probably end in a
situation, where the module will be in a different directory and
in $depmod_module_dir you will only have symlink. If we resolve the
symlink before we pass the module path to instmod, the dracut-install
will only include the module with its original path, but not the
symlink. Hence the module can't be automatically loaded.
Dracut-install is clever enough to handle symlinks and will include both
the symlink and the module to the initrd.
In e54ab383 we moved the fips script to a later pahse of boot, since
the /boot might not be available early on.
The problem is that systemd-cryptsetup* services could be run now
started before the do_fips is executed and need the crypto modules
to decrypted the devices.
So let's split the do_fips and load the module before udev does the
trigger.
When DRACUT_SYSTEMD is set and DRACUT_QUIET=yes, vinfo returns 1. This
is a problem for hooks which end with vinfo, as then the hook returns 1.
Especially problematic if this is a shutdown hook, as it will be
restarted again and again.
This commit fixes that.
Signed-off-by: Arnaud Rebillout <arnaud.rebillout@collabora.com>
on line 1086 it's used to check for the uefi_stub:
"${systemdutildir}/boot/efi/linux${EFI_MACHINE_TYPE_NAME}.efi.stub"
so it needs to be defined before that
The EFI executables produced by dracut --uefi must be placed in the
subdirectory /EFI/Linux of the EFI system partition (ESP) according to
the Boot Loader Specification, see
https://systemd.io/BOOT_LOADER_SPECIFICATION#logic
This is done correctly for the mount points /boot and /boot/efi, but for
the mount point /efi, the files are placed in /efi/Linux instead of the
correct /efi/EFI/Linux. This commit fixes the directory so that the EFI
executables are picked up correctly by conforming boot loaders.
Apart from complying to the specification, the change is also in line
with the commit message of 5c57209ba5
("dracut.sh: add default path for --uefi") which introduced this feature
as well as the documentation in dracut.8.asc.
If the network-manager plugin is used instead, it wouldn't write out
ifcfg files and we wouldn't have anything to check.
While at that, also enable the test.
The IFCFG test will make sure the network-legacy plugin keeps writing
out correct ifcfg files.
This is a separate commit so that actual changes are visible in the
following one.
If the root is on network, let nm-initrd-generator create configuration
even if none was explicitly specified on the command line.
Also do the same if /tmp/net.ifaces exists, because the anaconda plugin
creates an empty file in that location in hopes that will make us
configure the network.
On Fedora 30 the paritition sizes turn out to be too small again:
+ mkdir -p /sysroot
+ mount /dev/dracut/root /sysroot
+ cp -a -t /sysroot /source/bin /source/dev /source/etc /source/lib /source/lib64 /source/proc /source/root /source/sbin /source/sys /source/tmp /source/usr /source/var
cp: error writing '/sysroot/usr/lib64/libkrb5.so.3.3': No space left on device
cp: error writing '/sysroot/usr/lib64/libkrb5support.so.0.1': No space left on device
It turns out that there has been quite some size increase in some libraries,
notably glibc, though not all -- some even shrunk, ruling out a toolchain
problem. Here's are files over 1M we install on Fedora 30:
f29 f30
2.7M => 6.4M /usr/lib64/{libc-2.28.so => libc-2.29.so}
3.1M => 6.0M /usr/lib64/libcrypto.so.1.1.1c
2.0M => 3.5M /usr/lib64/{libm-2.28.so => libm-2.29.so}
2.9M => 2.8M /usr/lib/systemd/{libsystemd-shared-239.so => libsystemd-shared-241.so}
1.7M => 2.5M /usr/lib64/libunistring.so.2.1.0
2.3M => 2.4M /usr/lib64/bind9-export/libdns-export.so.1105.0.0
1.2M => 2.1M /usr/bin/bash
1.1M => 1.4M /usr/lib64/libkrb5.so.3.3
1.2M => 1.4M /usr/lib64/libgcrypt.so.20.2.4
612K => 1.1M /usr/lib64/libssl.so.1.1.1c
This increases the image sizes to accomodate for this. There's probably
little else we can do.
The kernel may only enable 'libfcoe' module. Some modules like bnx2fc
provides FCoE but only depend on 'libfcoe'. Loading 'fcoe' module may
fail but the kernel do support FCoE.
'libfcoe' will be installed as a dependency when installing block device
drivers if it's required. So no need to install it in installkernel.
Signed-off-by: Kairui Song <kasong@redhat.com>
When a module is compressed, uncompress it before packing into initrd.
Since initrd is already compressed, it makes no sense to put the
compressed module files.
The patch contains a slight refactoring and adds a helper function to
get the command for uncompressing a file per extension.
Bash 5 apparently longer propagates variable assignments to local variables
in front of function calls when in POSIX mode:
[lkundrak@demiurge ~]$ cat feh.sh
print_VAR () {
echo "$VAR";
}
testfunc () {
local VAR="OLD"
VAR=NEW print_VAR
}
testfunc
[lkundrak@demiurge ~]$ bash4 --posix feh.sh
NEW
[lkundrak@demiurge ~]$ bash5 --posix feh.sh
OLD
[lkundrak@demiurge ~]$ bash5 feh.sh
NEW
[lkundrak@demiurge ~]$
It works the way it did in Bash 4 in non-POSIX mode, for external programs,
or for non-local variables. Don't ask me why -- it's probably some
compatibility thing for some sad old people.
However, this precisely happens when fsck_single() is calling into the
fsck_drv_com(), assigned to _drv by fsck_able(). That ruins the
TEST-70-BONDBRIDGETEAMVLAN test's server and probably more.
Let's pass the fsck driver binary via the function argument instead. It's
less messy anyway.
- The network script and config could be in
"/etc/sysconfig/network-scripts", so try look for network config in
all possible path.
- The regex used for sed is not working, so fix it too.
- Make bootproto a local variable
Signed-off-by: Kairui Song <kasong@redhat.com>
The dracut-root-block-created line should not be created if we fail to copy
in the required files to sysroot. Let's turn on -e to trap failures and
poweroff on them, like some other tests do.
Also remove the &&. Not only it is unnecessary with -e, but defeats it.
From bash(1):
The shell does not exit if the command that fails is [...] part of any
command executed in a && or || list except the command following the
final && or || [...]
when system's default entropy sources are poor (e.g. use of SSD disks or
UEFI RNG not available)
On systems with low entropy at boot, the boot can take up to several
hours, specially when NBDE is used (e.g. clevis) which makes use of
the random number generator.
Enabling rngd service at boot early, because dracut-initqueue runs,
enables to initialize the random number generator in a couple of seconds
instead of minutes or hours.
Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
The commit 9f3c31cd8d ("99base: enable initqueue if extra devices are added")
only covers 'dracut --add-device' case, but it did not cover 'dracut --mount'
case, which causes the kdump failure in the Amazon virtual machine.
Lets make sure that the initqueue is enabled in both cases in order to wake up
the device in time.
Reported-by: Xiao Liang <xiliang@redhat.com>
Signed-off-by: Lianbo Jiang <lijiang@redhat.com>
systemctl need to be accessible on switch-root, but we unmount the
squash image on switch-root, so it will fail. systemctl depends on a lot
of libraries, squash them can save more RAM. So allow modules
(eg. kdump) to tell dracut that switch-root will be intercepted,
then we don't need to take care of that.
Signed-off-by: Kairui Song <kasong@redhat.com>
If required target is a symbol link, create the link then following the
link. If it's a directory, create new directory, else just move it.
Signed-off-by: Kairui Song <kasong@redhat.com>
systemd binary and udevadm are not needed to be outside the squash
image. Some binaries are kept outside because they are required before
mounting the image, or after umounting the image (when switching root),
or they may block umounting the image. But we are using lazy umounting,
so actually nothing will block the umount.
Keep more binaries outside the squash image won't hurt but cost extra
memories, the idea of squash image is to save memory usage.
So, there is no reason to keep udevadm outside, that should be a debug
left over. For systemd binary, it's running when switch root happens,
But we have lazy umounted the image and overlay, once systemd process
exec the new systemd in new root, everything will be cleared by kernel.
Also tidy up the comment make it less confussing.
Signed-off-by: Kairui Song <kasong@redhat.com>
Previous in commit 7047294, dracut will include the loaded kernel module
list in initramfs, so other tools could check if the loaded kernel
module is changed and rebuild the host only initramfs in case some
module required to boot the machine is missing due to host only install.
It's better to use modalias list generated by dracut-install, that
list includes the device modalias list combined with current loaded
kernel module list. In this way, if any kernel module is yet to be
loaded when the initramfs is built, or got unloaded by accident the
module list will not change. This make the list more stable over
initramfs builds.
Signed-off-by: Kairui Song <kasong@redhat.com>
insmods will consider all arguments as optional modules by default, but
for squash module, all listed modules are required, if any of them is
missing the initramfs won't boot. So pass the '-c' argument to let instmos
know all those modules are mandatory, it will fail and give an error if
it failed to install any of those modules.
In commit [9d1b81c dracut.sh: improve udevdir and systemdutildir
fallback logic] , it checked a common binary `collect' to location
udevdir.
But upstream systemd drop binary `collect' since systemd v240
[a168792c2d]
So check binary `ata_id' to instead.
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
The parse-fcoe.sh hook is sourced, and hence must not contain
exit 0 calls. Otherwise, the cmdline sequence will be interupted,
and no error will be reported to systemd. Use return instead.
Reference: boo#1136977
The upcoming kernel will have a support for loading compressed
firmware files, and this patch corresponds to that kernel change.
When a firmware file with the extra .xz extension is found, dracut
copies to initrd as fallback. Since initrd itself is compressed, the
file is uncompressed in initrd beforehand.
When using dracut with --hostonly and --no-hostonly-default-device,
/boot will be inaccessible as dracut will most fs modules unless
specified. But FIPS require /boot to be accessible, and it will try
to mount it on boot. It will fail if corresponding fs module is missing.
For most case /boot will be a simple partition, include the fs module
will be enough for FIPS to mount it. For other cases users have to pass
extra parameters by themselves.
Suggested-by: Kenneth Dsouza <kdsouza@redhat.com>
Signed-off-by: Kairui Song <kasong@redhat.com>
Let the caller pass in the module path instead of try to find the module
path everytime. This helps optimize the overall runtime.
Test results (3 rounds) on Fedora 30 in KVM VM with 8 CPUs, 2G memory, HDD:
$ time ./dracut.sh --local --quiet --hostonly --hostonly-cmdline --hostonly-i18n --hostonly-mode 'strict' -o 'plymouth dash resume ifcfg' --mount '/dev/mapper/fedora-root /sysroot xfs defaults' --no-hostonly-default-device -f initramfs.img
Before the commit:
real 0m11.782s | real 0m11.505s | real 0m11.958s
user 0m9.169s | user 0m9.218s | user 0m9.327s
sys 0m10.839s | sys 0m10.829s | sys 0m10.925s
After this commit:
real 0m9.866s | real 0m9.580s | real 0m9.638s
user 0m9.048s | user 0m9.142s | user 0m9.120s
sys 0m7.411s | sys 0m7.775s | sys 0m7.745s
Test result of building a ordinary image:
$ time ./dracut.sh --local --quiet -f initramfs.img
Before the commit:
real 0m34.697s | real 0m34.371s | real 0m35.122s
user 0m27.608s | user 0m27.524s | user 0m27.705s
sys 0m22.341s | sys 0m22.032s | sys 0m22.246s
After the commit:
real 0m31.914s | real 0m31.006 | real 0m31.289ss
user 0m27.315s | user 0m27.324 | user 0m27.290ss
sys 0m19.051s | sys 0m18.916 | sys 0m19.022ss
This will have an ~2s speed up.
Signed-off-by: Kairui Song <kasong@redhat.com>
cat: '/sys/devices/platform/host2/flashnode_sess-*/is_boot_target': No such file or directory
/usr/lib/dracut/modules.d/95iscsi/module-setup.sh: line 90: [: -eq: unary operator expected
The recent systemd upstream introduced a slightly modified version
string which included information about a git commit, which however
broke the version check in dracut. Unfortunately, the (( )) bash syntax
went along with it in certain cases and introduced a pretty nasty issue,
when the systemd would boot up but with slightly changed environment.
To prevent this from happening in the future, let's at least check if
the version parsed from the `systemd --version` output is a comparable
number.
Eliminate erroneous substring matches when looking up already processed keymaps to prevent necessary keymaps not getting added to the initramfs sometimes e.g. if there are the files 'compose.latin1' and 'compose.latin1.add' the unfixed version would skip processing 'compose.latin1' if find returned 'compose.latin1.add' first due to the directory listing not being in sorted order.
Images built with the fcoe module will always run the lldpad
service as part of their pre-trigger scripts if the network
is active. This prevents network installations in
environments where, for security reasons, LLDPDU frames
cause a switchport shutdown.
Add a new rd.nofcoe option to cause dracut to skip the
lldpad.sh script and the entire 95-fcoe module.
Signed-off-by: Patrick Talbert <ptalbert@redhat.com>
When the initramfs is built with squash module enabled, the content
inside squash image will be invisible from the lsinitrd tool. This
commit make lsinitrd detect and list the content of the squash image as
well to avoid possible confusion.
Signed-off-by: Kairui Song <kasong@redhat.com>
- allow emergency login on every console
specified in the kernel cmdline
- require password for hostonly images
- emergency mode: Manually multiplex emergency infos
This will bring all vital information to all ttys specified
as console devices, regardless of wether they hold the C flag.
Reference: FATE#325386
Reference: #449
busybox seems to not properly support this option,
and it can be be safely ommitted or replaced
with piping the output through head.
Rev 2:
* rebased on master
* addressed open points from review
Look for "connection-uuid" instead of "managed" to determine the devices
that are actually activated with a connection and call the online hook.
This fixes the anaconda-net root mount, which utilizes the online hook.
When building squash image, squash module forgot to install the new
shutdown.sh, and the shutdown hooks are always skipped on ordinary
shutdown if squash module is enabled.
The new shutdown.sh will remount the squash image and then everything
will just work, but currently re-mounting the squash image on shutdown
may have selinux problem and make the system hang, and there is no
easy way to fix it.
So skip fixing the shutdown.sh not being install problem, instead
just drop the new shutdown.sh, and unsquash the image on ordinary
shutdown, which is safer and should always work.
Signed-off-by: Kairui Song <kasong@redhat.com>
The kernel-install is called even if you run make install.
Since we don't call dracut with -f a second make install will fail
because initrd with same version is already there.
This makes kernel developers feel miserable.
https://bugzilla.redhat.com/show_bug.cgi?id=1642402
These dependencies cause an odd issue where swap devices specified
by resume= on the kernel command line will cause systemd device
timeouts to occur on boot. According to @haraldh these lines aren't
needed because the socket activiation will take care of it for us.
Removing these lines now as it fixes the resume= device timeout issue.
Fixes#480
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1641268
The only time we need to cleanup squahfs manually is on switch root, to
release resource and memory. We've covered that by setting
"Conflicts=initrd-switch-root.target" for squash cleanup service.
On shutdown systemd will take care of squahfs mounts. But for other
isolate, files in initramfs are most likely still required, so don't
clean up squahfs. For example, kdump's emergency handler will isolate
into its own target, if squahfs is cleaned up it will fail.
Signed-off-by: Kairui Song <kasong@redhat.com>
commit 7347391 ('network-legacy: split off from network module')
splitted network function to network-legacy and removed check() function
of 40network. This caused 40network to be included even if network is
not needed.
Signed-off-by: Kairui Song <kasong@redhat.com>
70291e0 ('dracut.spec: Add dracut-squash package') introduced a new
dracut-squash package, but by accident it overrided some other package
spec and the dependency name is wrong. This patch will fix it.
The previous logic would not handle absolute paths on the left side of
the "=>" properly. For example, on Gentoo ARM64, ldd outputs this:
/lib/ld-linux-aarch64.so.1 => /lib64/ld-linux-aarch64.so.1
At runtime, the kernel tries to load the file from /lib, and fails if we
only provide it in /lib64.
Instead of looking for the first slash after the "=>", just look for the
first slash, period. This would fail if we somehow had a relative path
on the left side (foo/libbar.so), but I'm not aware of any binaries that
would contain such an entry in DT_NEEDED.
Bug: https://bugs.gentoo.org/667752
Signed-off-by: Mike Gilbert <floppym@gentoo.org>
It parses depmod configuration and scans modules.dep for kernel modules
present in directories supplied in "overrides", "external", and "search"
depmod configuration options. The resulting list of (absolute) kernel
module paths is then supplied to instmods.
* modules.d/90kernel-modules-extra/module-setup.sh: New file.
* dracut.spec (%files): Add
%{dracutlibdir}/modules.d/90kernel-modules-extra.
Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
ln: failed to create symbolic link '/usr/lib/systemd/system/sockets.target.wants/iscsid.socket': Permission denied
ln: failed to create symbolic link '/usr/lib/systemd/system/sockets.target.wants/iscsiuio.socket': Permission denied
No way. Just ensure the links are there in the initramfs image. In fact,
that is already the case for iscsiuio.socket. Add iscsid.socket too.
If the network module obtained a lease using dhclient, NetworkManager
must be configured to use it too, otherwise it would obtain a different
lease (and could potentially break a connection to the network volume).
With all files stored in ramfs, and most of them are not compressed,
the initramfs will take up a lot of memory. Besides, if the file number
is large, each file will waste some memory due to page fragmetation.
This is due to ramfs' design, at least one page will be allocated for
one file however small the file is. On machine with large page size,
this will become worse and waste too many memory.
One approach to reducing the memory usage is to reduce the number of
files that got directly loaded into the root ramfs, and compress files
by put most files will into a read-only squash image and keep a minimum
set of executable and libraries outside as the loader for the squash
image. After the squash image is mounted, the real 'init' will be
executed and then everything behaves as usual.
This patch will introduce a '99squash' module which will never be
included by default. User can force add it, and if it is included,
dracut will perform some extra steps before creating the final image:
For now, "/etc" and "/usr" will be moved into the squashfs image.
"/init" will be renamed to "/init.stock" and replaced by "/init.squash".
Files and folders need to be accessible before mounting the image will
be still avaliable at their original place. And due to squashfs is
readonly, an overlayfs layer will be created on top of squashfs mount
point, as many dracut module require readwrite access to "/etc" and
"/usr", "init.squash" will ultimately call "/init.stock".
An extra systemd service will be installed. This service will umount all
squashfs related mount points right before switch-root to release
resources properly. This service will not actually do anything if
switch-root is not used.
This is very helpful when mem resource is very limited, like Kdump.
According to my tests, this squash module can help save about 35MB of
memory with 64K page size, or about 15MB with 4K page size on an
ordinary kdump capture routine. This module could also help reduce
memory usage for normal boot up process.
Won't change any behavior if squash module is not enabled.
Signed-off-by: Kairui Song <kasong@redhat.com>
Lets not unnecessarily rely on __WORDSIZE, which is not clearly specified
by any spec. Use explicit size comparisons if we're not interested in the
WORDSIZE, anyway.
Patch ported from systemd.
(commit 8507eb20b64010b26f23822cbf442bb0bf96511c)
Original-patch-by: Emil Renner Berthing <systemd@esmil.dk>
Bug: https://bugs.gentoo.org/602122
On my system the following initrd-release is generated:
...
VERSION="4 dracut-048 dracut-048"
...
VERSION is not defined in /etc/os-release, so the variable is
concatenated with its previous value:
* "4" comes from the kernel build system since dracut is called from the
kernel install hook ("4" is a major kernel version);
* first "dracut-048" comes from the "systemd-initrd" module;
* second "dracut-048" comes from the "base" module.
This is what happened before this patch (edited for brevity):
dracut-cmdline-ask.service in modules.d/98dracut-systemd, which invokes
dracut-cmdline-ask.sh. This script and systemd-vconsole-setup are
started in parallel for the same console (tty1).
Then dracut-cmdline-ask quits immediately without doing anything (unless
rd.cmdline=ask is given). As this is a bash script and it gets tty as
stdin as specified in its *.service, this triggers the hangup of tty1 at
its exit.
Meanwhile systemd-vconsole-setup continues and tries some ioctls after
that, but they fail because of the hung up tty1.
The usual culprit for starting systemd-vconsole-setup early on is
plymouth-start.service, even if plymouth.enable=0 is set.
A popular (and annoying) symptom of this as reported by users was
the inability use their configured keyboard layout in plymouth when
unlocking their crypted block devices.
Reference: boo#1055834
When extra devices are added, initqueue should be enabled to make sure
those devices are present, so following services and routines could
use those devices.
See PR #442 for more detail.
Use multiple lower layer directories in a single OverlayFS mount with
a transient overlay directory.
Tolerate a command line with rd.live.overlay.readonly and NO persistent
overlay by reconfiguring the OverlayFS mount options.
Use more compatible shell syntax for testing symlinks, and use printf
instead of echo -e.
A simplified root filesystem structure may be provided for OverlayFS
overlays by squashing the root filesystem directly instead of squashing
an embedded image file at /LiveOS/rootfs.img. Detect and configure
such a squashed root filesystem for live booting.
For OverlayFS boots, avoid the read-only Device-mapper linear device
at /dev/mapper/live-base.
Create a consistent device link at /dev/live-base for the read-only
base loop device for all overlayed live root filesystems.
Consistently provide a link at /dev/root for wait_for_dev.
Update documentation.
Adjust sysroot.mount configuration for rd.live.overlay.overlayfs option.
Use link at /dev/root as a consistent flag for wait_for_dev.
Adjust documentation.
The old code used /tmp/net.$netif.resolv.conf with $netif being randomly
chosen.
As it is not known which nameserver have which priority, just sort them
and deduplicate.
This is needed since few gpio/pinctrl can be built as modules and are
useful on early boot.
One example is jetson-tx1 where sata and external mmc can work only
after loading pinctrl-max77620 and gpio-max77620 modules.
Having theses kind of drivers bundled into the initramfs will also
avoid some deferred probes.
V2: add pinctrl for all arches
Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>
Currently, when trying to unpack or print the content of multiple
files, lsinitrd will decompress the image and pipe the decompressed
content to cpio to retrive each file if the image is compressed.
Which mean if we want to extract 10 files the image will be decompressed
10 times, which is a waste of time.
This patch will let lsinitrd decompress the image file to a temp file
first if multiple file names are given, then cpio will read from the
decompressed temp file, which will speed up a lot.
Time consumption test for command:
`lsinitrd initramfs-4.16.15-300.fc28.x86_64.img \
usr/lib/dracut/build-parameter.txt \
usr/lib/dracut/modules.txt \
etc/machine-id \
etc/hostname \
usr/lib/udev/rules.d/99-systemd.rules`
Before the patch:
2.37user 0.33system 0:02.12elapsed
After the patch:
0.50user 0.42system 0:00.72elapsed
There would be a more significant time difference if we try to
extract more files.
Before this patch, "--unpack" will always unpack the whole image.
Make "--unpack" be able to unpack only certain files, it will be
easier to retrieve files from initramfs image.
Signed-off-by: Kairui Song <kasong@redhat.com>
A hostonly image will not include every possibly required kernel module,
so if any hardware or configuration changed, the image may fail to boot.
One way to know if there are any hardware change or configuration change
that will require an image rebuild or not is to check the loaded kernel
module list. If the loaded kernel module list differs from last build
time, then the image may require to be rebuilt.
This commit will let dracut record the loaded kernel module list when
the image is being built, so other tools or services can compare this
list with currently loaded kernel modules to decide if dracut should be
called to rebuild the image.
To retrieve the loaded kernel modules list when an image is built, use
lsinitrd command:
lsinitrd $image -f */lib/dracut/loaded-kernel-modules.txt
if rd.md.uuid is in ID_FS_UUID format with dashes
e40a0234-7e52-5f10-f267-658d8ec463fa
convert it for the /dev/disk/by-id/md-uuid-${uuid} format
e40a0234:7e525f10:f267658d:8ec463fa
Check for a common binary in systemdutildir. This resolves an issue on
split-usr systems, where it is common to have both /lib/systemd[/system]
and /usr/lib/systemd[/user] present.
Check for systemd-udevd specifically, since some distros (Gentoo) allow
udev to be installed without the rest of the systemd stack.
Similar logic is applied to udevdir simply for consistency.
This commit basically reverts 5ce7cc73
90-multipath-hostonly module was added in 5ce7cc73, because if hostonly
mode is enabled, multipath module will always hardcode wwids which
causes problems when the initramfs is cloned to another system with same
hardware.
Now with tri-state hostonly mode, the two modules could be merged and only
hardcode wwids when "strict" hostonly mode is enabled.
Only pick rules for interfaces which have a carrier in the running
system. Those interfaces will be assembled by udev to allow booting
from those devices (i.e. iSCSI).
Reference: FATE#323440
Add a new option --hostonly-mode which accept an <mode> parameter, so we have a tri-state hostonly mode:
* generic: by passing "--no-hostonly" or not passing anything.
"--hostonly-mode" has no effect in such case.
* sloppy: by passing "--hostonly --hostonly-mode sloppy". This
is also the default mode when only "--hostonly" is given.
* strict: by passing "--hostonly --hostonly-mode strict".
Sloppy mode is the original hostonly mode, the new introduced strict
mode will allow modules to ignore more drivers or do some extra job to
save memory and disk space, while making the image less portable.
Also introduced a helper function "optional_hostonly" to make it
easier for modules to leverage new hostonly mode.
To force install modules only in sloppy hostonly mode, use the form:
hostonly="$(optional_hostonly)" instmods <modules>
Signed-off-by: Kairui Song <kasong@redhat.com>
Dracut uses the module deps to determine module dependencies
but that only works for modules with hard symbolic dependencies.
Some modules have dependencies created via callback API's or other
methods which aren't reflected in the modules.dep but rather in
modules.softdep through the use of "pre:" and "post:" commands
created in the kernel with MODULE_SOFTDEP().
Since in dracut we are only concerned about early boot, this patch
only looks at the pre: section of modules which are already being
inserted in the initrd under the assumption that the pre: section
lists dependencies required for the functionality of the module being
installed in the initrd.
Signed-off-by: Jeremy Linton <lintonrjeremy@gmail.com>
For EFI systems, the BLS fragments were stored in the EFI System Partition
(ESP) while in non-EFI systems it was stored in /boot.
For consistency, it's better to always store the BLS fragments in the same
path regardless of the firmware interface used.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
The code in 50drm which tries to include all DRM drivers for
hardware attached to the system did not look for virtio devices.
So if the system is a VM using the 'virtio' graphics adapter,
the 'virtio-gpu' module which should be included is not. This
extends the code to also look for virtio devices.
https://bugzilla.redhat.com/show_bug.cgi?id=1593028
Signed-off-by: Adam Williamson <awilliam@redhat.com>
Since the kernel doesn't allow using any non-FIPS-compliant crypto
algorithms, it doesn't make sense to install them. Even if they are
installed, tcrypt will not test them anyway.
Tested on Fedora 28 x86_64 by booting with fips=1 (with hand-patched
module-setup.sh).
This patch cleans up the default list of kernel modules in the 01fips
dracut module. All the algorithms that are tested in tcrypt are listed
by their algorithm name so that all the generic implementations and
drivers are picked up automatically based on the module alias.
This drops several unneeded modules and even a bogus one (rot13 -- this
one was obviously copy-pasted from tcrypt.c where it was listed as an
easter egg :).
The patch adds also some algorithms that weren't included in the
original set. It turns out in FIPS mode we only need those algorithms
that are marked as FIPS-allowed in testmgr.c (failure to find a non-FIPS
algorithm is ignored). The non-FIPS algorithms are further removed in a
subsequent patch.
since kmod-25 keyword "external" was implemented in order to avoid
additional actions(like weak-modules) when kernel was updated, which
makes it more simple while kernels' kabi were compatible.
but if move some special modules such as megaraid_sas, mpt3sas and
so on, to a external path like /opt/modules, these modules will not
be install to initramfs by default, which make the initramfs can't
be used to boot for disk detection failure.
according to kmod's document, you must specify a absolute path with
"external" keyword, so scan the lines in modules.dep that begin with
"/" and install them, to make sure necessary modules in external path
can be installed to initramfs too.
Signed-off-by: Hui Wang <john.wanghui@huawei.com>
After the $COMMAND case statement, the exit status of the last executed
command is added to the $ret variable.
But for the "add" pattern, this last executed command is an arithmetic
expression that also adds the exit status $? to the $ret variable. If
both $? and $ret are 0, then the arithmetic expression evaluates to 0
so is considered false and has an exit status of 1.
This makes the script to wrongly exit with an status code of 1 when it
should had been 0.
case "$COMMAND" in
add)
...
((ret+=$?))
# $ret is 0 here
;;
...
esac
((ret+=$?))
# $ ret is 1 here
exit $ret
Since $ret is set in the case statement, just exit with that status code
and remove the last arithmetic expression that wrongly sets $ret to 1.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
The main 01fips module should always load all optimized/driver modules
of all relevant crypto algorithms (based on their aliases), so we can
drop this useless module.
Commit bf5c53a implements support for mounting LUKS devices with
detached headers; however, it assumes that the LUKS device sits on an
unpartitioned disk.
Mirroring the `rd.luks.serial` option, this commit implements the
`rd.luks.partuuid` cmdline option, supporting headless LUKS devices on
drive partitions.
When dracut silently produces a broken initramfs, then the system will
likely not boot and this can be very problematic. Typical use case is
after the kernel has been updated.
It appears that dracut is not protected against the BASH_ENV variable,
causing various scripts called by dracut to possibly fail or provide
wrong output (e.g. "ldd" is one of these).
Having a broken output for "ldd" makes the generated initramfs be not
usable, typically because vital binaries will be missing (e.g.
"awk", "udevadm", ...).
Note: because the shebang line cannot contain more than one argument,
the '--norc' option had to be removed. IMHO, it was useless anyway.
Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
In kdump, if dump-target is ssh on ipv6, we need to sync until ipv6 addr
is ready. Currently ip=auto6/dhcp6 provides such function. But in 1st kernel,
it is hard to know whether the ipv6 addr is got by dhcpv6 or SLAAC.
E.g ifcfg-eth* contains DHCPV6C=yes direction, but there is no dhcpv6
server in the network, and then after the system is up, the user
echo 1 > /proc/sys/net/ipv6/conf/eth0/autoconf && accept_ra by manual
to obtain a ipv6 addr. Or vice.
So this patch suggests to make dhcpv6 as auto6 fallback
Signed-off-by: Pingfan Liu <piliu@redhat.com>
If a process (maybe plymouth) was still pinning /oldroot, then shutdown
would
- kill -9 $pid
- umount_a
- umount_a
in a very short timeframe. A small sleep hopefully lets the scheduler free
up /oldroot in the mean time.
It's possible for e.g. `kernel` to be installed as an RPM BuildRequires or equivalent,
and there's no reason to sync, and *definitely* no reason to fsfreeze.
Another case where this happens is rpm-ostree, which performs its own sync/fsfreeze
globally. See e.g. 8642ef5ab3
Convert the s390x into s390 to also include s390-specific crypto
modules, for example, aes_s390 into the initramfs.
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Some distros have both /usr/lib/plymouth and /usr/libexec/plymouth
directorirs, so we should check the existance of plymouth-populate-initrd
script.
Fixes: 421b46f8ae
Commit 5e574046e76e ("5?-dracut*.install: Allow scripts to install
the initramfs in /boot dir") added support to generate initramfs
images in the /boot directory and copy the respective BLS files.
Unfortunately, it broke the rescue initramfs generation when it's
not installed on /boot due not checking for the correct condition.
It checks for the 0-rescue sub-dir to exist, but this is created so
instead if the parent sub-dir exists has to be checked. Also, check
if the destination directory is /boot or not, instead if it exists.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Error: SHELLCHECK_WARNING:
/usr/lib/dracut/dracut-init.sh:939:20: error: Argument to implicit -n is always true due to literal strings. [SC2157]
937| dracut_kernel_post() {
938| for _f in modules.builtin.bin modules.builtin modules.order; do
939|-> [[ $srcmods/$_f ]] && inst_simple "$srcmods/$_f" "/lib/modules/$kernel/$_f"
940| done
941|
Error: SHELLCHECK_WARNING:
/usr/lib/dracut/modules.d/98syslog/parse-syslog-opts.sh:18:12: error: This expression is constant. Did you forget a $ somewhere? [SC2078]
16| elif [ -e /sbin/syslogd ]; then
17| syslogtype="syslogd"
18|-> elif [ /sbin/syslog-ng ]; then
19| syslogtype="syslog-ng"
20| else
Error: SHELLCHECK_WARNING:
/usr/lib/dracut/modules.d/90crypt/crypt-lib.sh:15:29: error: Since you double quoted this, it will not word split, and the loop will only run once. [SC2066]
13| strstr "$d" "${luks##luks-}" && return 0
14| if [ -n "$dev" ]; then
15|-> for _dev in "$(devnames $d)"; do
16| [ "$dev" -ef "$_dev" ] && return 0
17| done
The GRUB 2 bootloaders expect the initrd to be installed in /boot instead
of /boot/$MACHINE_ID/$KERNEL_VERSION/{linux,initrd}, so if that directory
doesn't exists, install the initramfs images on the /boot directory.
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
If no network related params are specific, but rd.neednet=1 is set,
the default initqueue action is to wait until one of the network
interfaces is marked as setup properly.
This also help with initqueue's race condition when the network interface
shows up late
References: bnc#866771
Signed-off-by: Hannes Reinecke <hare@suse.de>
The existence of dpkg-achitecture is not indicative of a debian
installation. It may well be installed on systems of people who
package for both distros. The previous code path did not take
that into account.
We now traverse all known plymouth directories, locking on the first
valid one, and try to work with it.
At the same time, we do not include the module if the plymouth directory
could not be found.
Previously if no symmetric key was configured for EVM, then the
initialization process was aborted. It can be a valid use case, however,
to only use EVM digital signatures. In this case only X.509 certificates
need to be loaded.
With this change EVM initialization will continue if any of the
symmetric or X.509 keys could be loaded.
This implements logic analogous to the one already implemented in
ima-keys-load.sh, only for the .evm/_evm keyrings.
If the kernel was built with CONFIG_IMA_TRUSTED_KEYRING then the kernel
initially creates and configures .ima and .evm keyrings. These keyrings
only accept x509 certificates that have been signed by a local CA which
belongs to the kernel builtin trusted keyring.
Thus if such a keyring is already present then additional evm keys
should be loaded into them. If this is not the case then the _evm
keyring needs to be created in userspace and keys will be loaded into
it instead.
Before this change dracut always created the _evm keyring and loaded
keys into it without considering an existing .evm keyring. In case of
CONFIG_IMA_TRUSTED_KEYRING being enabled, the _evm keyring will not be
used by the kernel, however, and EVM digital signatures will not work as
expected.
We initially enabled it for Haswell TSX bug (mga#16657)
Now there is also Meltdown and Spectre security issues,
and more microcode issues will most likely show up...
So the sane default for 'early_microcode' to have it enabled,
as theese changes must be done early in boot process to take
effect as intended.
Update documentation accordingly.
Reference: https://bugs.mageia.org/show_bug.cgi?id=16657
Signed-off-by: Thomas Backlund <tmb@mageia.org>
Signed-off-by: Neal Gompa <ngompa13@gmail.com>
There is currently no way to override dracut's preference for
/dev/mapper device names. But using these is problematic in
different scenarios: For example, if a user has a multipath-
enabled system but wants to disable multipath, or if the
names of multipath maps change because of configuration changes
(e.g. toggling user_friendly_names in /etc/multipath.conf).
This patch makes dracut prefer the user-specified
--persistent_policy names over /dev/mapper names.
It might be worthwhile to discuss why dracut prefers /dev/mapper
of /dev/disk/by-uuid at all. This preference was introduced
in 9037b63e with the argument "dm devices maintain /dev/mapper/* as
persistent names", but that's wrong for the scenarios mentioned
above, and is not a compelling reason for preferring /dev/mapper
over /dev/disk/by-uuid.
References: bsc#908143
Signed-off-by: Martin Wilck <mwilck@suse.de>
As the 'multipath' program will be triggered directly from
udev events it will be called before the multipath service
unit has started up. Which means we cannot rely on the
service unit to load the module for us, but we rather
have to do it early before udev is started.
References: bsc#986734
Signed-off-by: Hannes Reinecke <hare@suse.com>
Instead of trying all /dev/mapper/* devices to match the maj:min, and
get the VG name with "lvm lvs", use the dm/name from /sys and dmsetup
splitname.
This should speedup execution with lots of LVs.
81cio_ignore: handle cio_ignore commandline
References: bnc#874902
Incorporates following on-top patches/fixes:
----------------------------
Subject: 81cio_ignore: skip module if cio_ignore is not active
When cio_ignore is not active we should skip the entire module
during boot; otherwise it'll lead to adverse effects.
References: bnc#882685
----------------------------
Subject: 81cio_ignore: rewrite module
Rewrite cio_ignore module to rely on the dracut commandline
parameter 'rd.cio_accept', which takes a comma-separated list
of CCW IDs. Each of those IDs are being removed from the
list of devices from cio_ignore.
The default values for rd.cio_accept are taken from
/boot/zipl/active_devices.txt.
References: bnc#882685
-----------------------------
Subject: More empty cmdline fixes
This fixes up some more modules which might print out empty
commandline files.
-----------------------------
Subject: Mark scripts as executable
All scripts need to be marked as executable, otherwise dracut
won't be running them.
References: bnc#887010
Signed-off-by: Thomas Renninger <trenn@suse.de>
According to Cathy Zhou <Cathy.Zhou@Oracle.COM>:
"iscsistart is not designed to be working together with iscsid. When an
interface gets the dhcp offer successfully, the iscsiroot script is run
which starts the iscsistart service to establish the iSCSI session. With
the existence of iscsid, the iscsistart service's attempt to setup its
own mgmt ipc fails. Instead, the request to login to the iscsi target
is handled by the mgmt ipc of iscsid. After iscsistart finishes its
login attempt, it eventually sends a stop_event_loop request to stop
the mgmt process. As the result, it terminates iscsid."
So, iscsid is kicked out again.
Additionally iscsistart-flocked is used to make sure iscsistart is not
run in parallel.
91zipl tries to read the filesystem for the /boot/zipl device.
On SLE12, however, the ext2 and ext3 filesystems are handled
by the ext4 module.
And due to bug#886839 no error is registered and booting fails.
So implement a band-aid to translate it into ext4.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Add new module to update the dracut commandline values
during booting with the values found in the file
dracut-cmdline.conf on the device specified by
rd.zipl.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Contrary to the original patch, this one has been modified
to check for /boot/zipl, the location of the first stage kernel
in indirect boot, in order not to install on systems
booting directly via zipl.
Signed-off-by: Daniel Molkentin <daniel.molkentin@suse.com>
When the system boots with EFI, then initrd image is stored
on EFI System Partition. Thus dracut always warn about the
failure to invoke fsfreeze on the partition.
This prevents to run fsfreeze on ESP and suppress the warning.
Add s390 dcssblk driver and introduce rd.dcssblk= to pass mounts
that should get activated at initrd stage.
References: FATE#308263
Signed-off-by: Hannes Reinecke <hare@suse.de>
Allow filesystem modules to install a fs-specific text file with
instructions on what to do when mount fails. This is printed when we go into
an emergency shell.
Signed-off-by: Mark Fasheh <mfasheh@suse.de>
- dracut replaced every instance of "-i" in the cmdline,
even if it was part of a kernel image name, e.g. "vmlinuz-i"
- Fixes boo#908452
Signed-off-by: Fabian Vogt <fvogt@suse.com>
Adjusted to not support "dracut -ifoo bar", as this breaks expected
upstream behavior.
8f5c5 broke the case where BOOT_IMAGE is not set at all.
This code should handle following:
1) BOOT_IMAGE not set
2) BOOT_IMAGE set to something unrelated (s390)
3) BOOT_IMAGE=vmlinuz-4.14.7-300.fc27.x86_64
4) BOOT_IMAGE=/vmlinuz-4.14.7-300.fc27.x86_64
5) BOOT_IMAGE=/boot/vmlinuz-4.14.7-300.fc27.x86_64
6) BOOT_IMAGE=subdir/vmlinuz-4.14.7-300.fc27.x86_64
7) BOOT_IMAGE=/subdir/vmlinuz-4.14.7-300.fc27.x86_64
8) BOOT_IMAGE=/boot/subdir/vmlinuz-4.14.7-300.fc27.x86_64
https://bugzilla.redhat.com/show_bug.cgi?id=1415032
Using the module option 'scsi_mod.scan=manual'
this implements LUN masking by selectively enable only those
devices required for booting.
References: bsc#954600,FATE#319786
Signed-off-by: Hannes Reinecke <hare@suse.de>
Now that we are using persistent network names we can switch
to using the interface names when specifying the fcoe configuration.
With that we can print the fcoe configuration only once.
Signed-off-by: Hannes Reinecke <hare@suse.com>
Occasionally the FCoE connection might be reset after fipvlan was
called, causing the FCoE connection to be dropped and boot to fail.
For these cases we should be adding a timeout entry for the
initqueue to have a failsave mechanism to re-run fipvlan in
these cases.
References: bsc#1052840
Signed-off-by: Hannes Reinecke <hare@suse.com>
bnx2fc doesn't _actually_ need fcoemon, so fipvlan is sufficient
to start the FCoE connection.
And, in fact, fcoemon is started for every interface, causing
subsequent invocations to fail with
fcoemon[1157]: error 98 address already in use
and fcoemon tearing down the connection.
References: bsc#1052840
Signed-off-by: Hannes Reinecke <hare@suse.com>
The 'mode' argument was never referenced in the printf format, causing
invalid rules to be written.
References: bsc#1036323
Signed-off-by: Hannes Reinecke <hare@suse.com>
We should be disabling the FCoE connection (which triggers sending
a LOGO internally) to logout from the target; this resets the target
and will avoid hitting a busy condition during reboots.
References: bsc#994860
Signed-off-by: Hannes Reinecke <hare@suse.com>
fcoemon is well capable of figuring out whether a vlan should
be used, so there's no need to disable the AUTO_VLAN feature.
References: bsc#995019
Signed-off-by: Hannes Reinecke <hare@suse.com>
Old code did not work for two most common use-cases.
On most machines BOOT_IMAGE is set to something like
/vmlinuz-4.11.3-202.fc25.x86_64. So if we just add prefix "/boot/."
it won't work. Also on machines without /boot on separate partition
BOOT_IMAGE already has the /boot/ prefix (/boot/vmlinuz-3.10.0-799.el7.x86_64).
So let's strip it in such case.
https://bugzilla.redhat.com/show_bug.cgi?id=1415032
The needle argument in this specific case is a pattern, which cannot be
matched by the "literal" string matcher strstr.
This can result in fsck calls like:
e2fsck -a -y /dev/sda1
Which will then exit with an error like:
e2fsck: Only one of the options -p/-a, -n or -y may be specified.
Hence, it is necessary to use the strglobin function to correctly match
the pattern.
The "host" command may also print something else than
"asdf.local.lan has address 1.2.3.4", like:
"rootserver.local.net is an alias for rainbow.local.net.".
So "head -n1" is not enough.
Fixes boo#955592
References: boo#965477
fcoe-uefi gets included by default on EFI systems,
as it does not do the same check that fcoe does,
therefore needlessly pulling in network modules.
This patch copies the check from fcoe to fcoe-uefi.
We're now parsing the 'rd.dasd' parameter from 95dasd_rules, so
setting the 'dasd_mod' module parameter should be dropped here.
Signed-off-by: Hannes Reinecke <hare@suse.de>
There is no point trying to delete partitions; dmraid works
happily even with them. On the contrary trying to delete partitions
can even be harmful when eg dmraid should _not_ be started.
References: bsc#998860
Signed-off-by: Hannes Reinecke <hare@suse.com>
DM devices might be located on top of MD devices, so we need to
call the DM shutdown script before MD shutdown. The exception
here are multipath devices, which are below MD devices.
So skip removing multipath devices here to avoid spurious errors.
References: bsc#994860
Signed-off-by: Hannes Reinecke <hare@suse.com>
When calling the shutdown script we need to take care of traversing
the device-mapper tables, otherwise we might end up trying to remove
a device-mapper device which still has another one stacked on top
and the removal will fail.
References: bsc#994860
Signed-off-by: Hannes Reinecke <hare@suse.com>
local-fs-pre.target serves as a separator between the code for
detecting block devices and systemd's fsck/mount logic. This
patch ensures that multipathd is started before local-fs-pre.target
in the initrd. By adding a "Wants=" line for local-fs-pre.target,
it makes sure that this target is started at all.
References: bsc#1006118
Signed-off-by: Martin Wilck <mwilck@suse.de>
===================================================================
SLES11 provided a kernel commandline option 'multipath=off',
so dracut should be parsing the option, too.
References: bsc#1001691
Signed-off-by: Hannes Reinecke <hare@suse.com>
As the device-mapper module is removing all device-mapper tables
during shutdown we need to make sure to disable queuing on the
multipath devices; otherwise there might still be I/O pending
and the removal will fail.
References: bsc#994860
Signed-off-by: Hannes Reinecke <hare@suse.com>
We need to wait until udev has processed all events, otherwise we'll
risk of misdetecting devices. This might cause a temporary interruption
during which multipath removes a device-mapper device, which then
causes a booting failure.
References: bsc#986734
Signed-off-by: Hannes Reinecke <hare@suse.com>
References: bsc#930019
If rootfs is on multipath, but platform does not have an /etc/multipath.conf
file which is not urgently needed, they system will not boot, due to:
multipathd is not started and rootfs and swap are not found:
systemctl status multipathd.service
* multipathd.service - Device-Mapper Multipath Device Controller
Loaded: loaded (/usr/lib/systemd/system/multipathd.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Condition: start condition failed at Thu 2015-05-07 11:49:11 CEST; 7min ago
ConditionPathExists=/etc/multipath.conf was not met
and exit to dracut shell.
With hostonly enabled, only modules that are currently
loaded are included in the initrd. Modules which are
explicitly listed in modules-load.d do not need to
be filtered that way. Fix for boo#962224.
FCoE can run in Fabric (ie FCF) or VN2VN mode, so we should allowing
to set this parameter from the commandline, too.
Signed-off-by: Hannes Reinecke <hare@suse.com>
When lldpad is not running, any calls to 'dcbtool' will be printing
out a warning. As it perfectly legit to have FCoE running without
DCB we should not be printing out the error.
Signed-off-by: Hannes Reinecke <hare@suse.com>
If the installation already has a FCoE configuration we should
not attempt to overwrite it but rather use the pre-defined
configuration.
References: bsc#993861
Signed-off-by: Hannes Reinecke <hare@suse.com>
Check first if we're running off an bnx2x device and start FCoE on it
via fipvlan, then go the normal/Intel way of starting DCB.
Also the SUSE version of fcoemon needs the yes parameter for the
--syslog option
References: bsc#982588
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.com>
The recently upstreamed virtualbox video driver (vboxvideo) is shipped
in the staging directory. We need to probe it before Xorg is loaded to
avoid a corrupted X.
In general it is a good practice to look also in the staging directory
for DRM drivers.
Signed-off-by: Carlo Caione <carlo@endlessm.com>
This was removed from systemd almost two years ago in
c550f7a9b89d017215af084288bc44f736f774fe, so dracut should drop support
as well.
Reference: bsc#1067279
The caller of "for_each_host_xx func" needs to tell three cases:
func success/ fail / not be called.
E.g, in kdump case, host_devs can be empty, and we want to know it.
Signed-off-by: Pingfan Liu <piliu@redhat.com>
Although no device uses multipath, the module checks
for presence of the multipath binary first, printing a
warning if not present. This patch fixes the wrong ordering.
Fix issue #279 supercede PR #299
Fix bug https://issues.openmandriva.org/show_bug.cgi?id=2219
Replace Bashisms in the boot message for a missing overlay.
Verify presence of plymouth before calling it.
(Rework of commit f1b65e92af5e3f9df79f99e55d5aa936c9bca940.)
Previously, dracut would only copy the first one found. However,
with legacy maps for some locales around, there is a chance we
pick the wrong one. Pick all matching keymaps instead
Reference: boo#1065058
If no iscsi session information can be retrieved from the firmware
then skip the iscsi attachment and allow the boot process to continue.
Ensure the timeout scripts don't hit their timeout waiting for
/tmp/iscsistarted-firmware to be created.
This will allow a common image to be used for servers with both a
local and iscsi root with rd.iscsi.firmware set.
Some of the more complex devices now need rpmsg and hwspinlock in the early boot
process to start, and these to the initrd, and pull in usb/misc because
apparently non standard usb hubs are a thing.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Type=oneshot, as currently set in dracut's emergency service file,
causes an awkward situation if emergency mode is entered e.g. because
of a root device timeout, and the root device appears later because it
just has taken longer than the timeout. In that situation, my
expectation (backed by past positive experience) is that the user should
be able to simply exit the emergency shell and resume normal boot.
:/# systemctl status sysroot.mount
● sysroot.mount - /sysroot
Loaded: loaded (/proc/cmdline; bad; vendor preset: enabled)
Active: active (mounted) since Mon 2017-10-09 14:32:15 CEST; 16s ago
Where: /sysroot
What: /dev/mapper/3600601600a30200024fbbaf3f500e411-part5
Docs: man:fstab(5)
man:systemd-fstab-generator(8)
Process: 1873 ExecMount=/usr/bin/mount /dev/disk/by-uuid/63751805-6abc-46a3-a66f-427920dece4d /sysroot -o ro (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 512)
:/# systemctl list-jobs
JOB UNIT TYPE STATE
56 emergency.target start waiting
57 emergency.service start running
2 jobs listed.
:/# exit
logout
Failed to start default.target: Transaction is destructive.
(system keeps idling from this point on, user has no chance to
do anything).
This results from the combination of two effects:
1) initrd-root-fs.target sets "OnFailureJobMode=replace-irreversibly",
2) emergency.service's Type=oneshot causes the start jobs for both
emergency.service and emergency.target to persist while the user is in
the emergency shell.
When the shell is exited, systemd tries to isolate "initrd.target"
again, but this fails with "the transaction is destructive" error
because of the still pending jobs.
This patch fixes this by changing the Type of "emergency.service" from
"oneshot" to "idle".
JobRunningTimeoutSec now affects how long can start jobs for device
units stay in the "running" state. Disabling default job timeout via
JobTimeoutSec=0 doesn't disable running state timeout. We need to set
running state timeout as well.
Note that doing this the other way around has effect on generic timeout,
i.e. disabling running state timeout disables generic timeout. But doing
it this way we would create implicit dependency on fairly new
systemd-234. However, by setting both options we don't create dependency
on specific systemd version.
A LUKS root volume with a detached header on a device without partitioning will not have a UUID and will not have an attribute ENV{ID_FS_TYPE}=="crypto_LUKS".
Therefore, several areas need to be addressed: identification of the LUKS device, inclusion of entries within crypttab, and provision of the detached header file.
- Added support for an option (4th column: "force") in /etc/crypttab to force the inclusion of the entry in the initramfs version (avoiding the fs type test).
- Added support for an option (4th column: "header=/path/to/file") in /etc/crypttab to provide a path to a detached header file embedded within the initramfs.
- Added ID and PARTUUID support to the device (2nd column) in /etc/crypttab (complementing the existing UUID functionality).
- Added cmdline support to indicate LUKS device ("rd.luks.serial=") that refers to the attribute ENV{ID_SERIAL_SHORT}.
Tested successfully on Void Linux (x86_64 musl) (no systemd) with a LUKS root volume accessed with a keyfile and using a detached header.
Not tested on systemd, or on a LUKS root volume with a passphrase rather than a keyfile.
Some Combined Network Adapters(CNAs) implement DCB protocol
in firmware, it is recommended that do not run software-based
DCB or LLDP on CNAs that implement DCB, but we have to start
the lldpad service anyway(there might be other software DCB).
If the network interface provides hardware DCB/DCBX capabilities,
the field DCB_REQUIRED in "/etc/fcoe/cfg-xxx" is expected to
be set to "no".
We met an issue on "QLogic BCM57810" with DCB firmware support,
and found dracut still generated "fcoe=<mac>:dcb" which caused
kdump boot failure when using that fcoe dump target.
This patch parses /etc/fcoe/cfg-xxx to detect DCB_REQUIRED="no",
and force "nodcb" if it is the case.
Also improved some coding style in passing.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
The MTU is only being set on the slave devices and the MTU of the
bonding master is not being updated. This updates the bonding master and
also changes the MTU on the slaves as expected.
Signed-Off-By: Robert LeBlanc <robert@leblancnet.us>
kerneldirlen is used to modify absolute path returned by
kmod_module_get_path() while it is calculated on user-supplied
--kerneldir argument which can be a relative path.
Use kmod_get_dirname() to convert user-supplied path to the same format
as used by kmod_module_get_path().
This also allows to get rid of now useless strcmp checks that seem to
imply that /lib and /usr/lib are linked which is not always true.
Prior to this commit, the MTU setting was applied to a bond slave
interface. In older versions of the Linux kernel, this setting
propagated to the bond master and the other bond slaves associated with
the master. In recent versions of the kernel (observed in Linux 4.12),
increasing the MTU of a slave does not automatically increase the MTU of
the master. This allows for more flexibility but requires the MTU of
the master to be changed manually.
Ideally, the MTU setting should be applied to the bond master and the
setting will propagate to the bond slaves, since the slaves are required
to have a MTU that is greater than or equal to the bond master.
systemd sets /proc/sys/kernel/core_pattern to use systemd-coredump.
However, systemd-coredump is missing from initrd, making dumping
the core in initrd impossible by default.
Reference: bsc#1054809
Currently in Fedora/RedHat dracut installs its fedora.conf.example
as the default config file, in which sysloglvl is set 5. This leads
to maxloglvl=5 in dracut calls, making unnecessary lsinitrd calls
during initramfs builds by kdump.
This patch disables lsinitrd logging when --quiet option is given,
which is controlled by maxloglvl only before. This will speed up
dracut image building as the following if --quiet is used in kdump:
1) Before this patch
$ kdumpctl stop; touch /etc/kdump.conf; time kdumpctl start
kexec: unloaded kdump kernel
Stopping kdump: [OK]
Detected change(s) in the following file(s):
/etc/kdump.conf
Rebuilding /boot/initramfs-4.13.0-0.rc1.git4.1.fc27.x86_64kdump.img
kexec: loaded kdump kernel
Starting kdump: [OK]
real 0m26.824s
user 0m9.958s
sys 0m15.106s
2) After this patch
$ kdumpctl stop; touch /etc/kdump.conf; time kdumpctl start
kexec: unloaded kdump kernel
Stopping kdump: [OK]
Detected change(s) in the following file(s):
/etc/kdump.conf
Rebuilding /boot/initramfs-4.13.0-0.rc1.git4.1.fc27.x86_64kdump.img
kexec: loaded kdump kernel
Starting kdump: [OK]
real 0m20.420s
user 0m8.385s
sys 0m10.468s
Signed-off-by: Ziyue Yang <ziyang@redhat.com>
In case of "--no-hostonly-default-device", we do not need
the root device, thus add this check.
Also fixed the stale "root_dev" export.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
Kdump doesn't need default host devices like root, swap, fstab, etc,
we only care about the dump target which can be added via "--mount"
or "--add-device". We met several issues that kdump kernel failed
due to one of those host devices added by dracut, additionally, the
needless devices(e.g. LVM) consume some appreciable amount of memory
which is more likely to cause OOM under memory-limited kdump.
So this patch introduced "--no-hostonly-default-device" to avoid
adding those default devices as host_devs.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
SSH uses passwd database and thus need various NSS plugin libraries,
depending upon setting in nsswitch.conf.
SSH binary fails within the dracut environment without the libraries:
#:/ ssh
No user exist for uid 0
In the module-build-service, we have pieces of dracut provided by different
modules ("base-runtime" provides most functionality, but we need
dracut-network in "installer". Since these two modules build with separate
dist-tags, we need to reduce this strict requirement to ignore the dist-tag.
The dracut network module is only supposed to be used for wired interfaces
but if driver modules for wireless devices are wrongly copied, these will
be loaded and the available interfaces brought up.
If the rd.neednet=1 command line parameter is used, dhclient will attempt
to request an IP address for the interfaces and these requests will fail.
But other dracut modules that depend on the network to be settled, will
have to wait for the DHCP requests to timeout. Which can be a lot of time
since the dhclient default timeout value is 60 seconds.
Instead of trying to blacklist all possible kernel modules for wireless
devices, only bring up network interfaces if these are for wired devices.
Suggested-by: Harald Hoyer <harald@redhat.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
If we trigger crash just after creating initramfs, sometimes it is
observed that initramfs is not written to disk causing the subsequent
boot to fail. A sync should resolve this.
Signed-off-by: Ankit Kumar <ankit@linux.vnet.ibm.com>
If we trigger crash just after creating initramfs, sometimes it is
observed that initramfs is not written to disk causing the subsequent
boot to fail. A sync should resolve this.
Signed-off-by: Ankit Kumar <ankit@linux.vnet.ibm.com>
We tell dhclient to name 121 option "classless-routes",
but in dhclient-script we parse classless_static_routes.
So either have to change the configuration or the script.
And since dhclient uses by default classless_static_routes,
let's change the configuration
hardcoding the wwid of the drives in the initramfs causes problems
when the drives are cloned to a system with the same hardware, but
different disk wwid's
https://bugzilla.redhat.com/show_bug.cgi?id=1457311
Support booting from USB media with NTFS filesystem (optionally),
which removes the FAT32 related 4 GB file size limit for LiveOS/
squashfs.img (and any other file on the same USB media).
On s390 BOOT_IMAGE only denotes the number of the boot record that
was selected in the bootloader and not the path to the kernel image.
Also only bail out, if the kernel hmac checking relies on that path.
blkid is not available when this function is called, so block_uuid.map is put into
the initrd, mapping block devices from /etc/crypttab to UUIDs.
This fixes a bug where udev rules were created by mistake as crypttab_contains()
returned false for devices specified by path in /etc/crypttab which resulted in
error messages during boot.
Signed-off-by: Julian Wolf <juwolf@suse.de>
Previously our dhclient-script expected that $new_classless_static_routes
will have all values separated by a whitespace. But at least on F25
dhclient will put there the destination descriptor in the same format
as it is used by ISC dhcp-server.
For example:
new_classless_static_routes=32.10.198.122.47 192.168.78.4
while our current code expects
new_classless_static_routes=32 10 198 122 47 192 168 78 4
So let's just accept both of these formats by adding "." to IFS.
For details plesse see https://tools.ietf.org/html/rfc3442
"Classless Route Option Format"
When NPIV is enabled and the allow_lun_scan parameter is set to 'Y'
the HBA will initiate a LUN scan automatically, so there is no need
to specify the WWPN and LUN number manually.
References: bsc#964456
Signed-off-by: Hannes Reinecke <hare@suse.com>
module_setup.sh has a typo preventing it from saving the correct
dracut commandline.
References: bnc#887582
Signed-off-by: Hannes Reinecke <hare@suse.de>
For creating dynamic udev rules parse-dasd.sh look for the device
type in sysfs, which of course does not exist if cio_ignore is
active. So first enable the device before checking.
Signed-off-by: Hannes Reinecke <hare@suse.de>
'for_each_host_dev_and_slaves' would stop at the first found
device, so the cmdline() call would never list all required
devices. Use 'for_each_host_dev_and_slaves_all' instead and
filter out duplicates.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Setting and unsetting the IFS variable is tricky. To be on the
safe side we should always reset the IFS variable to its original
value after parsing.
Signed-off-by: Hannes Reinecke <hare@suse.de>
For creating dynamic udev rules parse-dasd.sh look for the device
type in sysfs, which of course does not exist if cio_ignore is
active. So first enable the device before checking.
Signed-off-by: Hannes Reinecke <hare@suse.de>
'for_each_host_dev_and_slaves' would stop at the first found
device, so the cmdline() call would never list all required
devices. Use 'for_each_host_dev_and_slaves_all' instead and
filter out duplicates.
Signed-off-by: Hannes Reinecke <hare@suse.de>
When a DASD is found to be required for the rootfs we should
be printing out a 'rd.dasd' commandline parameter. This not
only enables us to correctly enable the device with cio_ignore,
we can also inspect the resulting initrd to figure out which
devices are required to mount the rootfs.
Signed-off-by: Hannes Reinecke <hare@suse.de>
There were some errors when rd.dasd parsing, resulting in the
device never to be activated. And we should check for
cio_ignore even if a udev rules has been found.
Signed-off-by: Hannes Reinecke <hare@suse.de>
When converting 'rd.zfcp' and 'rd.dasd' into udev rules we
need to make sure the enable those device ids via cio_ignore,
otherwise the rules might never be called.
Signed-off-by: Hannes Reinecke <hare@suse.de>
With the new s390x configuration tool the naming of the udev
rules files have changed. So add these to the existing ones
to be compatible with existing and new installations.
References: bnc#856585
Signed-off-by: Hannes Reinecke <hare@suse.de>
When converting 'rd.zfcp' and 'rd.dasd' into udev rules we
need to make sure the enable those device ids via cio_ignore,
otherwise the rules might never be called.
Signed-off-by: Hannes Reinecke <hare@suse.de>
This used to work only when specified via the command line
or if systemd was not being used. However, the exisistence of
20_force_driver.conf also requires dracut-pre-udev.service
to be run.
Reference: bsc#986216
removed copy&paste artifact "modify_routes add"
there is no modify_routes() function, and we simply want the output
of the parse function.
(cherry picked from commit 33710dfbfc)
If a hisi_sas storage device is used as / during system install, the
resulting installation will not boot because the hisi_sas driver is not
included in the initramfs.
The Hisilicon storage driver needs to be added to the initramfs image for
aarch64 kernels.
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Cc: dzickus@redhat.com
Cc: dmarlin@redhat.com
Cc: wefu@redhat.com
Cc: harald@redhat.com
From systemd-234, kernel-install plugins are called even if /etc/machine-id
is missing or empty, and in that case BOOT_DIR_ABS is a fake directory.
So, let's skip to create initrd in that case.
This patch uses wait_for_dev "/dev/disk/by-id/md-uuid-${uuid}" for the
specified uuids.
On timeout only md devices are force started which are specified by
uuid, or all, if rd.auto was specified.
Fixes https://github.com/dracutdevs/dracut/issues/227
At least on x86 on Bay and Cherry Trail devices the pmw-lpss modules must
be in the initrd too, otherwise the i915 driver will still load, but
it will report the following error:
[drm:pwm_setup_backlight [i915]] *ERROR* Failed to own the pwm chip
And not register /sys/class/backlight/intel_backlight and users will
not be able to control their backlight.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
curl in Fedora recently changed its default CA trust store. The
Fedora package no longer specifies an OpenSSL-format bundle file
during build, and curl itself has been patched to use an NSS
plugin called libnssckbi.so when no bundle file or directory is
specified. There are (at present) two possible providers of the
libnssckbi.so module: the original NSS implementation, which
uses a trust bundle built in at build time, and a compatible
implementation from the p11-kit project, which reads a trust
bundle at run time. So if we find a string in libcurl.so that
suggests libnssckbi might be in use, we must both install it and
make an effort to install any trust bundle files it may use.
The p11-kit libnssckbi implementation does include a string that
lists the top-level trust directories it will use, so we try to
find that string, though the best effort I can come up with will
also find many false positives too. To weed out the false
positives, we check whether the matches actually exist as dirs,
and if so, whether they contain some specific subdirectories we
know p11-kit trust dirs must have (thanks, @kaie). For the NSS
libnssckbi implementation, we will likely wind up not finding any
dirs that match the requirements, so we will simply install the
libnssckbi.so file itself, which is the correct action.
This fixes TLS transactions in the initramfs environment when
using a curl that's built this new way; it's significant for
use of kickstarts and update images with the Fedora / RHEL
installer, as these are retrieved in the initramfs environment,
and are frequently retrieved via HTTPS.
The --ignoreactivationskip/-K switch was added to LVM2 in 2.02.99
(July 2013) and is used to control the activation of volumes with
the activation skip flag set: without -K these volumes will be
ignored when 'lvchange -ay $LV' is issued.
This prevents an LVM2 thin-privisioned snapshot from being used
as the root device when booting with rd.lvm.lv=vg/lv since the
activation skip flag is set for these snapshots by default (the
legacy non-thinp snapshots do not set this flag and can already
be activated and used as a root device by specifying appropriate
values for rd.lvm.lv).
This is only used in the rd.lvm.lv case since in that situation
we are activating one or more named LVs specified by the user:
the flag is not given when calling 'vgchange' since this may
cause many unwanted volumes to be activated during early user
space. Users wishing to use a specific snapshot volume should
specify it with 'rd.lvm.lv'.
The previous algorithm was incorrect and would return
incorrect results e.g. for a /20 mask. Also gets rid
of an undocumented depencency on bc(1).
Reference: bsc#1035743
This is intended for minimum host OSes where 36 MB used by binutils
are deemed too expensive. We only need "strip", which exists as eu-strip
in elfutils, which in turn is < 1 MB in size.
Note that the tests (TEST-04-FULL-SYSTEMD/test.sh) still depend on
strip from binutils. It could use sstrip in the future.
The newer mount utilities are more strict about directly shared
devices. For OverlayFS boots, which mount $BASE_LOOPDEV directly,
avoid a mount error by indirectly sharing the read-only base
filesystem through a second, over-attached $BASE_LOOPDEV for
the DM live-base target.
Install ifcfg-* files with team configuration in the initramfs.
Improve the slave configuration of the team interface, by looking up
ifcfg files in the initramfs.
Create a default loadbalance team config, if none present in the
initramfs.
forward port of
4c88c2859e
This adds the same list of drivers we use for arm platforms for
aarch64 too, also add the DMA drivers there too as they can add
sigficant performance for some storage/usb and often need to be
present when the storage drivers load.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Provide a more prominent alert to the user if an overlay is
missing or the overlay module is not available and a temporary
overlay will be provided. This, to avoid losing data intended to
persist.
Integrate the option to use an OverlayFS as the root filesystem
into the 90dmsquash-live module for testing purposes.
The rd.live.overlay.overlayfs option allows one to request an
OverlayFS overlay. If a persistent overlay is detected at the
standard LiveOS path, the overlay & type detected will be used.
Tested primarily with transient, in-RAM overlay boots on vfat-
formatted Live USB devices, with persistent overlay directories
on ext4-formatted Live USB devices, and with embedded, persistent
overlay directories on vfat-formatted devices. (Persistent overlay
directories on a vfat-formatted device must be in an embedded
filesystem that supports the creation of trusted.* extended
attributes, and must provide valid d_type in readdir responses.)
The rd.live.overlay.readonly option, which allows a persistent
overlayfs to be mounted read only through a higher level transient
overlay directory, has been implemented through the multiple lower
layers feature of OverlayFS.
The default transient DM overlay size has been adjusted up to 32 GiB.
This change supports comparison of transient Device-mapper vs.
transient OverlayFS overlay performance. A transient DM overlay
is a sparse file in memory, so this setting does not consume more
RAM for legacy applications. It does permit a user to use all of
the available root filesystem storage, and fails gently when it is
consumed, as the available free root filesystem storage on a typical
LiveOS build is only a few GiB. Thus, when booted on other-
than-small RAM systems, the transient DM overlay should not overflow.
OverlayFS offers the potential to use all of the available free RAM
or all of the available free disc storage (on non-vfat-devices)
in its overlay, even beyond the root filesystem available space,
because the OverlayFS root filesystem is a union of directories on
two different partitions.
This patch also cleans up some message spew at shutdown, shortens
the execution path in a couple of places, and uses persistent
DM targets where required.
Documentation is updated for these changes.
Commit cf376023e6 moved writing .resolv.conf and .override
after dhcp_do, because dhcp_do was overwriting .resolv.conf. But .override does not have
such problem and on the contrary dhcp_do reads .override file if it is present. So let\'s
move it back.
https://bugzilla.redhat.com/show_bug.cgi?id=1415004
There's a number of usb controllers that are common yet aren't
contained in the host directory. Include these for generic host.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
The phy and power modules are needed by some of the recent ARM
devices that have appeared like CHIP and some exynos devices.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Specifying a different kernel module directory with --kmoddir would
result in the same directory being the destination directory.
Strip everything before the "/lib/modules" for the destination dir.
https://github.com/dracutdevs/dracut/issues/194
The default output filename for --uefi is
<EFI>/EFI/Linux/linux-$kernel$-<MACHINE_ID>-<BUILD_ID>.efi.
<EFI> might be /efi, /boot or /boot/efi depending on where the ESP partition
is mounted. The <BUILD_ID> is taken from BUILD_ID in /usr/lib/os-release or
if it exists /etc/os-release and is left out, if BUILD_ID is non-existant or
empty.
Also a new option --no-machineid was added, which affects the default output
filename of --uefi and will discard the <MACHINE_ID> part.
Some docs claimed that values in certain config files would be
overwritten, when they would actually be overridden.
Override: a file is not modified but its contents are superseded by
something else. (configurations set in
/etc/dracut.conf.d/*.conf override configurations set in
/etc/dracut.conf)
Overwrite: a file is modified or its contents replaced by an action
(use dracut --force to overwrite the existing initramfs)
For example under x86, someone maybe missunderstand that the vmlinuz
is the link /boot/vmlinuz points to a specific kernel image and use
the following command directly.
mkinitrd -k vmlinuz
Bug related to this issue: https://bugzilla.redhat.com/show_bug.cgi?id=1360131
Now dracut only attempts to copy GlobalKnownHostsFile while generating kdump's
initramfs. This method will cause kdump's failure if users set customized
UserKnownHostsFile in /etc/ssh/ssh_config. This patch simply attempts to copy
those files too while going through /etc/ssh/ssh_config. Note that we need to
make sure ~/foo will be copied as /root/foo in kdump's initramfs.
Extend "rd.memdebug" to "4", and "make_trace_mem" to "4+:komem".
Add new "cleanup_trace_mem" to cleanup the trace if active.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
The current method for memory debug is to use "rd.memdebug=[0-3]",
it is not enough for debugging kernel modules. For example, when we
want to find out which kernel module consumes a large amount of memory,
"rd.memdebug=[0-3]" won't help too much.
A better way is needed to achieve this requirement, this is useful for
kdump OOM debugging.
The principle of this patch is to use kernel trace to track slab and
buddy allocation calls during kernel module loading(module_init), thus
we can analyze all the trace data and get the total memory consumption.
As for large slab allocation, it will probably fall into buddy allocation,
thus tracing "mm_page_alloc" alone should be enough for the purpose(this
saves quite some trace buffer memory, also large free is quite unlikey
during module loading, we neglect those memory free events).
The trace events include memory calls under "tracing/events/":
kmem/mm_page_alloc
We also inpect the following events to detect the module loading:
module/module_load
module/module_put
Since we use filters to trace events, the final trace data size won't
be too big. Users can adjust the trace buffer size via "trace_buf_size"
kernel boot command line as needed.
We can get the module name and task pid from "module_load" event which
also mark the beginning of the loading, and module_put called by the
same task pid implies the end of the loading. So the memory events
recorded in between by the same task pid are consumed by this module
during loading(i.e. modprobe or module_init()).
With these information, we can record the rough total memory(the larger,
the more precise the result will be) consumption involved by each kernel
module loading.
Thus we introduce this shell script to find out which kernel module
consumes a large amount of memory during loading. Use "rd.memdebug=4"
as the tigger.
After applying this patch and specifying "rd.memdebug=4", during booting
it will print out something extra like below:
0 pages consumed by "pata_acpi"
0 pages consumed by "ata_generic"
1 pages consumed by "drm"
0 pages consumed by "ttm"
0 pages consumed by "drm_kms_helper"
835 pages consumed by "qxl"
0 pages consumed by "mii"
6 pages consumed by "8139cp"
0 pages consumed by "virtio"
0 pages consumed by "virtio_ring"
9 pages consumed by "virtio_pci"
1 pages consumed by "8139too"
0 pages consumed by "serio_raw"
0 pages consumed by "crc32c_intel"
199 pages consumed by "virtio_console"
0 pages consumed by "libcrc32c"
9 pages consumed by "xfs"
From the print, we see clearly that "qxl" consumed the most memory.
This file will be installed as a separate executable named "tracekomem"
in the following patch.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
Some crashkernel targets still use legacy NTLM auth, which
require those (bsc#869496). This patch enumerates all dependent
hash algorithems, because even though most of them are probably
compiled in, older ones (e.g. md4 and arc4) usually aren't.
Contrary to previous intel pinctrl drivers, the cherryview driver can be
and usually is built as a module. However, it sets up the SDIO pinout
so sdhci can make use of the SD card reader, which may subsequently
hold a root file system on a card (bsc#998440).
Also change <= N to < N+1. For example, dracut-029-1 > dracut-029, so would not
get obsoleted properly. This all applies to old versions, so doesn't make much
difference in practice, so just fix it to avoid c&p duplication of the bad
pattern in the future.
Preserve extended attributes when copying files using dracut-install.
The copying of extended attributes avoids file execution denials when
the Linux Integrity Measurement's Appraisal mode is active. In that mode
executables need their file signatures copied. In particular, this patch
solves the problem that dependent libaries are not included in the
initramfs since the copied programs could not be executed due to missing
signatures. The following audit record shows the type of failure that
is now prevented:
type=INTEGRITY_DATA msg=audit(1477409025.492:30065): pid=922 uid=0
auid=4294967295 ses=4294967295
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
op="appraise_data" cause="IMA-signature-required"
comm="ld-linux-x86-64"
name="/var/tmp/dracut.R6ySa4/initramfs/usr/bin/journalctl"
dev="dm-0" ino=37136 res=0
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
IMA validates file signatures based on the security.ima xattr. As of
Linux-4.7, instead of cat'ing the IMA policy into the securityfs policy,
the IMA policy pathname can be written, allowing the IMA policy file
signature to be validated.
This patch first attempts to write the pathname, but on failure falls
back to cat'ing the IMA policy contents .
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
bnx2x can take no longer than 3 seconds to initialize the link in some setups
which can cause fipvlan to fail and thus the fcoe interface(s) won't be
created.
Add another 10 seconds to give the link enough time to initialize.
Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com>
Dracut changes working directory before attempting to output files under
$DRACUT_TMPDIR , resulting in an IO failure if $DRACUT_TMPDIR is a path
relative to the working directory when dracut was started.
Fixes: https://github.com/dracutdevs/dracut/issues/156
Signed-off-by: David Disseldorp <ddiss@suse.de>
This is a further improvement on PR #105 which re-adds support for nfs:// urls to root=live:nfs://... Symptoms prior to applying this patch are that sysroot.mount times out when following the nfs:// syntax for the path to the live image. An additional case is added to livenet-generator to support the nfs protocol.
ip=2620:0052:0000:2220:0226:b9ff:fe81:cde4::[2620:0052:0000:2220:0000:0000:0000:03fe]:64::ibft0:none
should be
ip=[2620:0052:0000:2220:0226:b9ff:fe81:cde4]::[2620:0052:0000:2220:0000:0000:0000:03fe]:64::ibft0:none
https://bugzilla.redhat.com/show_bug.cgi?id=1322592#c19
(cherry picked from commit b8e6c051c6)
use inst() instead of inst_simple()
/etc/pki/tls/certs/ca-bundle.crt is a symlink to
../../ca-trust/extracted/pem/tls-ca-bundle.pem
with inst() we install the original file also.
https://bugzilla.redhat.com/show_bug.cgi?id=1341280
(cherry picked from commit 1b23c6c65c)
add check_vol_slaves_all to be used in check_block_and_slaves_all
otherwise only the first lvm VG member would be processed
(cherry picked from commit 7a7b8c1740)
The phy and power modules are needed by some of the recent ARM
devices that have appeared like CHIP and some exynos devices.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
IPv6 addresses should be specified in brackets so that the
ip= scanning code doesn't get confused.
References: bnc#887542
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Thomas Renninger <trenn@suse.com>
If emergency and shutdown-emergency hooks are called, the systemd should
poweroff the testsuite, therefore "rd.shell=0" is given on the test
suite kernel command lines.
"rd.shell=0" has to be parsed correctly by the test suite real root init
also.
Both 'utmp' and 'root' groups are mentioned in tmpfiles.d/systemd.conf
and as such should be included.
It's probably better to have something equiv to inst_rule_group_owner()
for udev rules which parses out users and groups and adds them to the
passwd/group db respectively.
Could also rely on sysusers but as the initramfs is static in this
sense, it's more efficient to pre-define the users IMO.
This will bundle clock drivers into the initramfs on arm
Tested on ti dm8148-t410 where adpll is needed on 4.6+ kernel
This will avoid to rely on (maybe broken) bootloader clocks.
Theses modules are also usually loaded early. Having them bundled into
the initramfs will avoid lot of deferred probes and others delay.
Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>
If journald.conf already contains Storage=persistent, journald will
write to /var/log/journal/, which ends up at /run/initramfs/log/journal/
after switching root. We want to make sure early boot logs are written
to /run/log/journal/ so they can be flushed to /var/log/journal/ after
switching root.
Users can pass the DNS information throught "nameserver=" cmdline,
there maybe duplicated inputs.
"/etc/resolv.conf" have some restrictions on the number of DNS items
effective, so make sure that this file contains no duplicated items.
We achieve this by simply making the file have no duplicated lines.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
I met a problem when passing kdump dns to dracut via "nameserver=x.x.x.x",
the dns I provided didn't appear in the "/etc/resolv.conf".
After some debugging, found that when setup dhcp DNS, in setup_interface()
and setup_interface6(), it has:
echo "search $search $domain" > /tmp/net.$netif.resolv.conf
So if "$search $domain" isn't NULL(this is ture in my kdump environment),
the dns contents(that is, dns1, dns2, nameserver) in "ifup" before dhcp
will be discarded.
This patch addresses it by handling dhcp first. In fact this is also the
way the NetworkManager in 1st kernel works.
Signed-off-by: Xunlei Pang <xlpang@redhat.com>
Avoid keymap/font not found error when loadkeys/setfont
are compiled with the default data directory path.
Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
If a module is renamed or another module takes care of the old one,
all of the alias strings have to be checked against the current set of
loaded modules.
This is still incomplete, because to be absolutely correct, all the
/sys/*...*/modalias files would have to be checked, if they match the
modules alias strings.
- use local variables with _
- use associative array for the kernel modules
- install emergency hook even in the systemd case
- follow device path until /sys is reached
- set kernel version for modprobe checking
If the initramfs was built with prefix=/run/... /run can't be mounted
with noexec, otherwise no binary can be run.
Guard against it by looking where /bin/sh is really located.
Trigger the acpi subsystem. This will ensure hv_vmbus gets loaded before
plymouth is started, which will make the graphics device become
available before plymouth is started too (and the keyboard ! which might
also be important for plymouth in some setups).
https://bugzilla.redhat.com/show_bug.cgi?id=1218130
(cherry picked from commit d2846fdcce)
It is expected that a watchdog module will disable an active watchdog when
its probe is called ie, when it is loaded. So an early load of the module
will help to disable it earlier.
This can be helpful in some corner cases where kdump and watchdog daemon
both are active.
Testing:
-- When watchdog kernel modules were added
# dracut --no-hostonly initramfs-test.img -a watchdog
# lsinitrd initramfs-test.img -f etc/cmdline.d/00-watchdog.conf
rd.driver.pre=iTCO_wdt,lpc_ich,
Signed-off-by: Pratyush Anand <panand@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Harald Hoyer <harald@redhat.com>
Recently following patches have been added in upstream Linux kernel, which
(1) fixes parent of watchdog_device so that
/sys/class/watchdog/watchdogn/device is populated. (2) adds some sysfs
device attributes so that different watchdog status can be read.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6551881c86c791237a3bebf11eb3bd70b60ea782http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=906d7a5cfeda508e7361f021605579a00cd82815http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=33b711269ade3f6bc9d9d15e4343e6fa922d999b
With the above support, now we can find out whether a watchdog is active or
not. We can also find out the driver/module responsible for that watchdog
device.
Proposed patch uses above support and then adds module of active watchdog
in initramfs generated by dracut for hostonly mode. Kernel module for
inactive watchdog will be added as well for none hostonly mode.
When an user does not want to add kernel module, then one should exclude
complete dracut watchdog module with --omit.
Testing:
-- When watchdog is active watchdog modules were added
# cat /sys/class/watchdog/watchdog0/identity
iTCO_wdt
# cat /sys/class/watchdog/watchdog0/state
active
# dracut --hostonly initramfs-test.img -a watchdog
# lsinitrd initramfs-test.img | grep iTCO
-rw-r--r-- 1 root root 9100 Feb 24 09:19 usr/lib/modules/.../kernel/drivers/watchdog/iTCO_vendor_support.ko
-rw-r--r-- 1 root root 19252 Feb 24 09:19 usr/lib/modules/.../kernel/drivers/watchdog/iTCO_wdt.ko
-- When watchdog is inactive then watchdog modules were not added
# cat /sys/class/watchdog/watchdog0/state
inactive
# dracut --hostonly initramfs-test.img -a watchdog
# lsinitrd initramfs-test.img | grep iTCO
-- When watchdog is inactive, but no hostonly mode, watchdog modules were added
# cat /sys/class/watchdog/watchdog0/state
inactive
# dracut --no-hostonly initramfs-test.img -a watchdog
# lsinitrd initramfs-test.img | grep iTCO
-rw-r--r-- 1 root root 9100 Feb 24 09:19 usr/lib/modules/.../kernel/drivers/watchdog/iTCO_vendor_support.ko
-rw-r--r-- 1 root root 19252 Feb 24 09:19 usr/lib/modules/.../kernel/drivers/watchdog/iTCO_wdt.ko
Signed-off-by: Pratyush Anand <panand@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Harald Hoyer <harald@redhat.com>
How to reproduce:
host# ./dracut.sh -o 'dracut-systemd systemd systemd-initrd' --local -f ./initramfs.img
host# qemu-system-x86_64 -initrd ./initramfs.img \
-append 'root=/dev/sda1 rd.cmdline=ask rd.hostonly=0' \
...
Enter additional kernel command line parameter (end with ctrl-d or .)
> rd.break
> .
...
There is no "Break before switch_root"
...
Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
Handle module aliases correctly to not generate unbootable
initrds with different kernel versions when modules were renamed
or replaced.
Signed-off-by: Fabian Vogt <fvogt@suse.com>
* Multipath device names only start with the mpath-prefix if the option
use_userfriendly_names is set true in /etc/multipath.conf and if user
has not set any aliases in the said file. Thus the for-loop should go
through all files in /dev/mapper/, not just ones starting with 'mpath'
* Bash is perfectly capable to extend `/dev/mapper/*` notation without a
need to pass it to an external ls
* Changed the function to use a local variable $_dev instead of the
global $dev, which seemed to be the original intention as the local
_dev was defined but not used
crypt/parse-crypt.sh generate initqueue job which always call
dev_unit_name() with an argument beginning with "-". This results
in the following error:
dracut-initqueue[307]: + systemd-escape -p -cfb4aa43-2f02-4c6b-a313-60ea99288087
dracut-initqueue[307]: systemd-escape: invalid option -- 'c'
Add a systemd generator for root=nbd:.. so that systemd has a correct
sysroot.mount unit.
Use export names instead of port numbers, because port number based
exports are deprecated and were removed.
rename iface_has_link() to iface_has_carrier() to clarify usage
Only assign static "wildcard interface" settings, if the interface has a
carrier.
If the interface name was specified with a name, do not do carrier
checking for static configurations.
8b5ee88ff6 removed the check for SQUASHED,
assuming, that the if clause above was the only place, where SQUASHED is
set.
This patch reverts to the old logic, because SQUASHED can be set
earlier.
for i in $(manpages) dracut.html dracut-version.sh;do["$${i%/*}" !="$$i"]&& mkdir -p "dracut-$(VERSION)/$${i%/*}"; cp "$$i""dracut-$(VERSION)/$$i";done
tar --owner=root --group=root -rf dracut-$(VERSION).tar $$(find dracut-$(VERSION) -type f)
for i in $(manpages) dracut.html dracut-version.sh;do["$${i%/*}" !="$$i"]&& mkdir -p "dracut-$(DRACUT_MAIN_VERSION)/$${i%/*}"; cp "$$i""dracut-$(DRACUT_MAIN_VERSION)/$$i";done
tar --owner=root --group=root -rf dracut-$(DRACUT_MAIN_VERSION).tar $$(find dracut-$(DRACUT_MAIN_VERSION) -type f)
for _p11item in $(find "$dracutsysrootdir$_p11root");do
if ! inst "${_p11item#$dracutsysrootdir}";then
dwarn "Couldn't install '${_p11item#$dracutsysrootdir}' from p11-kit trust dir '${_p11root#$dracutsysrootdir}'; HTTPS might not work."
continue
fi
done
done
done
done
fi
[[$_found]]|| dwarn "Couldn't find SSL CA cert bundle or libnssckbi.so; HTTPS won't work."
}
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
