Lichen Liu [Wed, 7 Aug 2024 02:13:37 +0000 (10:13 +0800)]
feat(dracut.sh): add --add-confdir option
When generating kdump's initrd, we want to keep [omit_]dracutmodules
empty and let kdump to handle the modules. And we don't want to
affect the first kernel's initrd, so we cannot place our conf file
to /etc/dracut.conf.d or /usr/lib/dracut/dracut.conf.d.
This patch adds a new option to allow user to add an extra configuration
directory to use *.conf files from. If the dir not exists, will look for
confdir's subdir.
After that, kdump can use "--add-confdir kdump" if
/usr/lib/dracut/dracut.conf.d/kdump exists, to apply its own dracut conf.
See also:
https://github.com/rhkdump/kdump-utils/issues/11
https://github.com/rhkdump/kdump-utils/pull/31
Suggested-by: Dave Young <dyoung@redhat.com> Signed-off-by: Lichen Liu <lichliu@redhat.com>
Kernel integrity check in FIPS module is incompatible with UKIs as neither
/boot/vmlinuz-`uname-r` nor /boot/.vmlinuz-`uname-r`.hmac are present. UKI
is placed to $ESP\EFI\Linux\<install-tag>-<uname-r>.efi and if a .hmac file
is present next to it, it is possible to do similar check.
Note, UKIs have a 'one size fits all' command line and 'boot=' is not expected
to be set. Luckily, if the UKI is systemd-stub based then we can expect
'LoaderDevicePartUUID' variable containing PARTUUID of the ESP to be set. Mount
it to /boot using the existing logic.
Martin Wilck [Mon, 9 Sep 2024 07:43:01 +0000 (09:43 +0200)]
fix(nvmf): install (only) required nvmf modules
nvme_rdma was not installed, even if it was required, whereas
nvme_tcp was installed in non-TCP setups. nvme_fabrics will be
pulled in automatically by any transport module and doesn't
need to be installed explicitly.
Mike Schwarz [Tue, 10 Sep 2024 13:51:04 +0000 (15:51 +0200)]
fix(dracut): do not add all lib subdirs to `LD_LIBRARY_PATH` with `--sysroot`
On systems with too many library subdirectories, the current approach causes
`Argument list too long` errors, and the initrd also fails to build.
This patch does not fix the original issue by itself (i.e., libsystemd libs not
found), so all the dracut modules that require libraries stored in
subdirectories must explicitly install them using `inst_libdir_file`, which
already successfully handles the `--sysroot` prefix.
Ondrej Kubik [Fri, 26 Jul 2024 21:40:51 +0000 (21:40 +0000)]
fix(dracut-install): do not assume handled path starts with sysrootdir
When using --sysrootdir argument, we cannot assume fulldstpath and
fullsrcpath always start with sysrootdir. When dracut_install is
called on destination directory, this results in passing pointer which
is often beyond valid buffer.
Signed-off-by: Ondrej Kubik <ondrej.kubik@canonical.com>
Jo Zzsi [Sat, 7 Sep 2024 03:15:07 +0000 (23:15 -0400)]
test(BASIC): add support for XFS
XFS filesystem labels can be at most 12 characters long,
so move the test case for the ' rdinit=/bin/sh' label
to TEST-02 instead and keep TEST-01 simple.
Fabian Henze [Mon, 26 Aug 2024 20:05:35 +0000 (20:05 +0000)]
fix(systemd-networkd): remove basename dependency
The basename tool was not listed in the requirements and is also not needed.
Also see https://github.com/dracutdevs/dracut/commit/4c216b1db6a86373549e13b60250a7fcf94417b9
Jo Zzsi [Fri, 30 Aug 2024 00:53:30 +0000 (20:53 -0400)]
ci: add more packages to Debian and Ubuntu containers
Increase test coverage. Some of the newly added packages
are needed to to install some dracut modules and are already
installed for other CI containers.
Explicitly verify that dracut systemd services are not included in this
test.
Separate systemd-based initrd out from the rest of the test
infrastructure to make it easier to check (e.g. by passing -v)
what is included in this minimal initrd.
This test produces initrd that is comparable design to the systemd
based initrd produced by mkosi or mkinitcpio.
Copy some additional tests steps from FULL-SYSTEMD and include it
in this test as well.
Clemens Lang [Thu, 8 Aug 2024 14:43:31 +0000 (16:43 +0200)]
feat(fips-crypto-policies): make c-p follow FIPS mode automatically
For a system that uses crypto-policies to be switched to FIPS mode
correctly, it needs to be
- booted with `fips=1` on the kernel command line
- switched to the FIPS crypto-policy (or a policy derived from it)
- have the fips dracut module enabled
On older systems, there were additional steps, for example, creating
`/etc/system-fips`.
We have repeatedly seen inconsistencies between those different toggles,
either because the user space tooling to switch between those does not
(for reliability, maintainability, and compliance reasons) undo some of
the steps it does when disabling FIPS mode, or because other
installation methods (bootc, containers, image builder) independently do
some of those steps. Eventually, all of these ended with user confusion.
We can avoid this situation by eliminating the difference by treating
the `fips=1` kernel command line switch as a single source of truth, and
making all others follow automatically. This module provides this for
crypto-policies, by adding bind-mounts before pivot if the system has
not already been switched to a FIPS-based crypto-policy.
This requires some support from the crypto-policies package (because it
needs to deal with the bind mounts when a user calls
`update-crypto-policies --set`), so make it a no-op unless
- `fips=1` is on the kernel command line
- crypto-policies is installed
- crypto-policies supports the bind-mounts (indicated by the presence
of the `default-fips-config` file)
- the policy isn't already FIPS
These checks should make this safe to add to the initramfs on all
current systems.
The bind-mounts also need to happen in the initramfs already, because
systemd links against OpenSSL, and doing them later means that systemd
will start with an OpenSSL configuration that isn't tailored for FIPS.
See also [1], which adds the user space support to crypto-policies,
along with a systemd service that does the same steps in case dracut
hasn't already done them (which is useful for environments that don't
use an initramfs like containers).
Philipp Rudo [Mon, 26 Aug 2024 13:29:01 +0000 (15:29 +0200)]
fix(squash-lib): harden against empty $initdir
The postinstall phase of 99squash-lib has the potential to delete the
whole rootfs if $initdir is empty. This should(tm) never happen.
Nevertheless as the consequences are so devastating it is better to
double check.
Philipp Rudo [Tue, 27 Aug 2024 10:14:40 +0000 (12:14 +0200)]
fix(dracut.sh): exit when installing the squash loader fails
The postinstall phase in 99squash-lib can fail, e.g. when 99squash-lib
is added without one of the required back ends. Usually this isn't fatal
and simply results in a "normal" initrd, i.e. one without squashed
image, being created. Nevertheless, a user needs to explicitly add one
of the required modules for the code to be triggered. So it is better
to fail with an error rather than giving the user something he didn't
ask for.
Philipp Rudo [Mon, 26 Aug 2024 13:23:41 +0000 (15:23 +0200)]
fix(squash): remove cyclic dependency
With commit d0f8fde5 ("fix(dracut-init.sh): add module to mods_to_load
before checking dependencies") reverted 99squash can no longer rely on
dracut_module_included working as expected in its check() and depends()
function. Solve this problem by breaking up the cyclic dependency
between 99squash and 95squash-{squashfs,erofs} as the commit was
originally introduced to allow this cyclic dependency.
This requires to move all code shared by 95squash-{squashfs,erofs} from
99squash to a new 99squash-lib module and update the dependencies
accordingly. In addition update the checks in dracut.sh to check for
99squash-lib as 99squash is no longer guaranteed to be included.
Finally make sure that 99squash-lib isn't included without a back
end.
While at it improve and align the error messages in 99squash and
99squash-lib.
Philipp Rudo [Mon, 26 Aug 2024 13:58:54 +0000 (15:58 +0200)]
revert(dracut-init.sh): add module to mods_to_load before checking dependencies
Commit d0f8fde5 ("fix(dracut-init.sh): add module to mods_to_load before
checking dependencies") introduced a regression. When dracut is in
"auto" mode, i.e. '--modules auto' or no --modules is provided, the
expected behavior is that all modules that return 0 in their check()
function are included. Except for the ones where the dependencies cannot
be installed. The commit however, caused those modules to be included
without their dependencies. Thus revert the commit.
Pavel Valena [Wed, 12 Jun 2024 04:06:32 +0000 (06:06 +0200)]
feat(systemd*): include systemd config files from /usr/lib/systemd
and also use proper variables for the paths.
--
The new systemd reads from both /etc and /usr/, so to accomodate this,
I've added new paths to install configs from (I probably haven't covered
all). This changes only hostonly behaviour; uses global variables:
Philipp Rudo [Wed, 14 Aug 2024 14:33:23 +0000 (16:33 +0200)]
fix(squash-erofs): properly exclude $squashdir
Option --exclude-path from mkfs.erofs requires a path relative to the
source of the image. Otherwise the path won't be excluded resulting in a
slightly larger (~1M) initrd.
Fixes: ebc9e84d ("feat(squash): add module 95squash-erofs") Signed-off-by: Philipp Rudo <prudo@redhat.com>
projects / thirdparty / dracut-ng.git / log
