Mike Schwarz [Tue, 10 Sep 2024 13:51:04 +0000 (15:51 +0200)]
fix(dracut): do not add all lib subdirs to `LD_LIBRARY_PATH` with `--sysroot`
On systems with too many library subdirectories, the current approach causes
`Argument list too long` errors, and the initrd also fails to build.
This patch does not fix the original issue by itself (i.e., libsystemd libs not
found), so all the dracut modules that require libraries stored in
subdirectories must explicitly install them using `inst_libdir_file`, which
already successfully handles the `--sysroot` prefix.
Ondrej Kubik [Fri, 26 Jul 2024 21:40:51 +0000 (21:40 +0000)]
fix(dracut-install): do not assume handled path starts with sysrootdir
When using --sysrootdir argument, we cannot assume fulldstpath and
fullsrcpath always start with sysrootdir. When dracut_install is
called on destination directory, this results in passing pointer which
is often beyond valid buffer.
Signed-off-by: Ondrej Kubik <ondrej.kubik@canonical.com>
Jo Zzsi [Sat, 7 Sep 2024 03:15:07 +0000 (23:15 -0400)]
test(BASIC): add support for XFS
XFS filesystem labels can be at most 12 characters long,
so move the test case for the ' rdinit=/bin/sh' label
to TEST-02 instead and keep TEST-01 simple.
Fabian Henze [Mon, 26 Aug 2024 20:05:35 +0000 (20:05 +0000)]
fix(systemd-networkd): remove basename dependency
The basename tool was not listed in the requirements and is also not needed.
Also see https://github.com/dracutdevs/dracut/commit/4c216b1db6a86373549e13b60250a7fcf94417b9
Jo Zzsi [Fri, 30 Aug 2024 00:53:30 +0000 (20:53 -0400)]
ci: add more packages to Debian and Ubuntu containers
Increase test coverage. Some of the newly added packages
are needed to to install some dracut modules and are already
installed for other CI containers.
Explicitly verify that dracut systemd services are not included in this
test.
Separate systemd-based initrd out from the rest of the test
infrastructure to make it easier to check (e.g. by passing -v)
what is included in this minimal initrd.
This test produces initrd that is comparable design to the systemd
based initrd produced by mkosi or mkinitcpio.
Copy some additional tests steps from FULL-SYSTEMD and include it
in this test as well.
Clemens Lang [Thu, 8 Aug 2024 14:43:31 +0000 (16:43 +0200)]
feat(fips-crypto-policies): make c-p follow FIPS mode automatically
For a system that uses crypto-policies to be switched to FIPS mode
correctly, it needs to be
- booted with `fips=1` on the kernel command line
- switched to the FIPS crypto-policy (or a policy derived from it)
- have the fips dracut module enabled
On older systems, there were additional steps, for example, creating
`/etc/system-fips`.
We have repeatedly seen inconsistencies between those different toggles,
either because the user space tooling to switch between those does not
(for reliability, maintainability, and compliance reasons) undo some of
the steps it does when disabling FIPS mode, or because other
installation methods (bootc, containers, image builder) independently do
some of those steps. Eventually, all of these ended with user confusion.
We can avoid this situation by eliminating the difference by treating
the `fips=1` kernel command line switch as a single source of truth, and
making all others follow automatically. This module provides this for
crypto-policies, by adding bind-mounts before pivot if the system has
not already been switched to a FIPS-based crypto-policy.
This requires some support from the crypto-policies package (because it
needs to deal with the bind mounts when a user calls
`update-crypto-policies --set`), so make it a no-op unless
- `fips=1` is on the kernel command line
- crypto-policies is installed
- crypto-policies supports the bind-mounts (indicated by the presence
of the `default-fips-config` file)
- the policy isn't already FIPS
These checks should make this safe to add to the initramfs on all
current systems.
The bind-mounts also need to happen in the initramfs already, because
systemd links against OpenSSL, and doing them later means that systemd
will start with an OpenSSL configuration that isn't tailored for FIPS.
See also [1], which adds the user space support to crypto-policies,
along with a systemd service that does the same steps in case dracut
hasn't already done them (which is useful for environments that don't
use an initramfs like containers).
Philipp Rudo [Mon, 26 Aug 2024 13:29:01 +0000 (15:29 +0200)]
fix(squash-lib): harden against empty $initdir
The postinstall phase of 99squash-lib has the potential to delete the
whole rootfs if $initdir is empty. This should(tm) never happen.
Nevertheless as the consequences are so devastating it is better to
double check.
Philipp Rudo [Tue, 27 Aug 2024 10:14:40 +0000 (12:14 +0200)]
fix(dracut.sh): exit when installing the squash loader fails
The postinstall phase in 99squash-lib can fail, e.g. when 99squash-lib
is added without one of the required back ends. Usually this isn't fatal
and simply results in a "normal" initrd, i.e. one without squashed
image, being created. Nevertheless, a user needs to explicitly add one
of the required modules for the code to be triggered. So it is better
to fail with an error rather than giving the user something he didn't
ask for.
Philipp Rudo [Mon, 26 Aug 2024 13:23:41 +0000 (15:23 +0200)]
fix(squash): remove cyclic dependency
With commit d0f8fde5 ("fix(dracut-init.sh): add module to mods_to_load
before checking dependencies") reverted 99squash can no longer rely on
dracut_module_included working as expected in its check() and depends()
function. Solve this problem by breaking up the cyclic dependency
between 99squash and 95squash-{squashfs,erofs} as the commit was
originally introduced to allow this cyclic dependency.
This requires to move all code shared by 95squash-{squashfs,erofs} from
99squash to a new 99squash-lib module and update the dependencies
accordingly. In addition update the checks in dracut.sh to check for
99squash-lib as 99squash is no longer guaranteed to be included.
Finally make sure that 99squash-lib isn't included without a back
end.
While at it improve and align the error messages in 99squash and
99squash-lib.
Philipp Rudo [Mon, 26 Aug 2024 13:58:54 +0000 (15:58 +0200)]
revert(dracut-init.sh): add module to mods_to_load before checking dependencies
Commit d0f8fde5 ("fix(dracut-init.sh): add module to mods_to_load before
checking dependencies") introduced a regression. When dracut is in
"auto" mode, i.e. '--modules auto' or no --modules is provided, the
expected behavior is that all modules that return 0 in their check()
function are included. Except for the ones where the dependencies cannot
be installed. The commit however, caused those modules to be included
without their dependencies. Thus revert the commit.
Pavel Valena [Wed, 12 Jun 2024 04:06:32 +0000 (06:06 +0200)]
feat(systemd*): include systemd config files from /usr/lib/systemd
and also use proper variables for the paths.
--
The new systemd reads from both /etc and /usr/, so to accomodate this,
I've added new paths to install configs from (I probably haven't covered
all). This changes only hostonly behaviour; uses global variables:
Philipp Rudo [Wed, 14 Aug 2024 14:33:23 +0000 (16:33 +0200)]
fix(squash-erofs): properly exclude $squashdir
Option --exclude-path from mkfs.erofs requires a path relative to the
source of the image. Otherwise the path won't be excluded resulting in a
slightly larger (~1M) initrd.
Fixes: ebc9e84d ("feat(squash): add module 95squash-erofs") Signed-off-by: Philipp Rudo <prudo@redhat.com>
dracut-install calls ldd to resolve dependencies, but when the `--sysroot`
option is used, ldd is not performing the search within the sysroot directory.
To fix this issue, the `LD_LIBRARY_PATH` variable needs to be properly set to
the directories containing shared libraries within the specified sysroot
directory.
E.g., running dracut with `--sysroot` produces an initrd without the required
systemd shared libraries when the version between the host system and the
sysroot directory differs:
```
localhost:~ # ldd /.snapshots/9/snapshot/usr/lib/systemd/systemd | grep libsystemd
libsystemd-core-256.so => not found
libsystemd-shared-256.so => not found
localhost:~ # export LD_LIBRARY_PATH=/.snapshots/9/snapshot/usr/lib64/systemd
localhost:~ # ldd /.snapshots/9/snapshot/usr/lib/systemd/systemd | grep libsystemd
libsystemd-core-256.so => /.snapshots/9/snapshot/usr/lib64/systemd/libsystemd-core-256.so (0x00007f817b600000)
libsystemd-shared-256.so => /.snapshots/9/snapshot/usr/lib64/systemd/libsystemd-shared-256.so (0x00007f817b000000)
```
Fabian Vogt [Mon, 5 Aug 2024 09:28:32 +0000 (11:28 +0200)]
fix(dracut-functions.sh): only return block devices from get_persistent_dev
With udev 256, there are now directories such as
/dev/disk/by-path/pci-0000:02:00.0-nvme-1-part/ which match here.
In case a nonexisting file/device was passed to get_persistent_dev, it
returned the first directory it looked at because both have maj:min 0:0.
This accidental conversion from garbage to a sensible looking path leads
to weird behaviour later.
Instead of filtering out directories explicitly switch the check to only
return block devices, which also takes care of the character special
/dev/mapper/control.
projects / thirdparty / dracut-ng.git / log
