Hi Philipp,
On Wed, May 17, 2023 at 01:50:46PM +0200, Philipp Rudo wrote:
Hi Coiby,
all in all looks good. Some questions though.
On Tue, 16 May 2023 10:18:08 +0800
Coiby Xu <coxu(a)redhat.com> wrote:
> Currently, kdump doesn't work on many FIPS-enabled systems including
> Azure, ESXI, Hyper, POWER and etc. When FIPS is enabled, it needs to
> access /boot//.vmlinuz-xxx.hmac to verify the integrity of the kernel.
> However, on those systems, /boot fails to be mounted due to a lack of
> fs and block device drivers and the system just halted after failing to
> verify the integrity of the kernel. For example, on Hyper-V, sd_mod, sg,
> scsi_transport_fc, hv_storvsc and hv_vmbus need to be installed in order
> for /boot to be mounted.
>
> mkdumprd calls dracut with the --no-hostonly-default-device. Following
> the documentation (man dracut),
> --no-hostonly-default-device
> Do not generate implicit host devices like root, swap, fstab, etc.
> Use "--mount" or "--add-device" to explicitly add devices
as needed
>
> this patch uses "--add-device" to explicitly add the device of /boot.
>
> Note there is already an attempt to fix it in dracut's 01fips module
> i.e. via the commit 83651776 ("fips: ensure fs module for /boot is
> installed"). Unfortunately it only installs the file system driver e.g.
> xfs.
>
> Signed-off-by: Coiby Xu <coxu(a)redhat.com>
> ---
> mkdumprd | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/mkdumprd b/mkdumprd
> index 63a37a74..1b6ffbfd 100644
> --- a/mkdumprd
> +++ b/mkdumprd
> @@ -463,6 +463,10 @@ if ! is_fadump_capable; then
> is_dump_to_rootfs && add_mount "$(to_dev_name
"$(get_root_fs_device)")"
>
> add_dracut_arg "--no-hostonly-default-device"
> +
> + if fips-mode-setup --is-enabled; then
fips-mode-setup isn't defined in kexec-tools. Where is it from? dracut?
When was it introduced and do we need to update the minimal dracut
version in the spec file?
This command is provided by crypto-policies-scripts. According to my
experience, this command seems to always available. I'll redirect the
stderr to /dev/null in case the command doesn't exist. Thanks for
raising this concern.
> + add_dracut_arg --add-device "$(findmnt -n -o SOURCE --target /boot)"
Just for my understanding. The difference between --add-device and
--mount is that --mount adds all required drivers _and_ mounts
the device in initramfs while --add-device only adds the drivers in
case they need to be mounted. Is that correct?
Yes, that's one of the two reasons. Since the FIPS module will mount the
/boot partition itself there is no need for us to mount it. The other
reason is in practice, I find "--mount /boot" doesn't work as expected
because the required drivers are still missing. For example, on PowerVM,
the kdump initrd still misses t10-pi, /ata_piix, scsci_transport_srp,
ibmvscsi and etc. And it seems "--mount" is not supported as well as
"--add-device" judging from "git log --grep=--mount".
Thanks
Philipp
--
Best regards,
Coiby