On Mon, 22 May 2023 16:24:39 +0800
Coiby Xu <coxu(a)redhat.com> wrote:
Hi Philipp,
On Wed, May 17, 2023 at 01:50:46PM +0200, Philipp Rudo wrote:
>Hi Coiby,
>
>all in all looks good. Some questions though.
>
>On Tue, 16 May 2023 10:18:08 +0800
>Coiby Xu <coxu(a)redhat.com> wrote:
>
>> Currently, kdump doesn't work on many FIPS-enabled systems including
>> Azure, ESXI, Hyper, POWER and etc. When FIPS is enabled, it needs to
>> access /boot//.vmlinuz-xxx.hmac to verify the integrity of the kernel.
>> However, on those systems, /boot fails to be mounted due to a lack of
>> fs and block device drivers and the system just halted after failing to
>> verify the integrity of the kernel. For example, on Hyper-V, sd_mod, sg,
>> scsi_transport_fc, hv_storvsc and hv_vmbus need to be installed in order
>> for /boot to be mounted.
>>
>> mkdumprd calls dracut with the --no-hostonly-default-device. Following
>> the documentation (man dracut),
>> --no-hostonly-default-device
>> Do not generate implicit host devices like root, swap, fstab, etc.
>> Use "--mount" or "--add-device" to explicitly add
devices as needed
>>
>> this patch uses "--add-device" to explicitly add the device of /boot.
>>
>> Note there is already an attempt to fix it in dracut's 01fips module
>> i.e. via the commit 83651776 ("fips: ensure fs module for /boot is
>> installed"). Unfortunately it only installs the file system driver e.g.
>> xfs.
>>
>> Signed-off-by: Coiby Xu <coxu(a)redhat.com>
>> ---
>> mkdumprd | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/mkdumprd b/mkdumprd
>> index 63a37a74..1b6ffbfd 100644
>> --- a/mkdumprd
>> +++ b/mkdumprd
>> @@ -463,6 +463,10 @@ if ! is_fadump_capable; then
>> is_dump_to_rootfs && add_mount "$(to_dev_name
"$(get_root_fs_device)")"
>>
>> add_dracut_arg "--no-hostonly-default-device"
>> +
>> + if fips-mode-setup --is-enabled; then
>
>fips-mode-setup isn't defined in kexec-tools. Where is it from? dracut?
>When was it introduced and do we need to update the minimal dracut
>version in the spec file?
This command is provided by crypto-policies-scripts. According to my
experience, this command seems to always available. I'll redirect the
stderr to /dev/null in case the command doesn't exist. Thanks for
raising this concern.
Indeed, a quick 'dnf provides' would have been enough for me to find
that out. But yes, I believe that redirecting the output makes sense.
Even when it's not always present we should only add dependencies if
they are strictly necessary.
>
>> + add_dracut_arg --add-device "$(findmnt -n -o SOURCE --target
/boot)"
>
>Just for my understanding. The difference between --add-device and
>--mount is that --mount adds all required drivers _and_ mounts
>the device in initramfs while --add-device only adds the drivers in
>case they need to be mounted. Is that correct?
Yes, that's one of the two reasons. Since the FIPS module will mount the
/boot partition itself there is no need for us to mount it. The other
reason is in practice, I find "--mount /boot" doesn't work as expected
because the required drivers are still missing. For example, on PowerVM,
the kdump initrd still misses t10-pi, /ata_piix, scsci_transport_srp,
ibmvscsi and etc. And it seems "--mount" is not supported as well as
"--add-device" judging from "git log --grep=--mount".
Thanks for the explenation!
Philipp