On Fri, May 26, 2023 at 04:29:00PM +0200, Philipp Rudo wrote:
Hi Coiby,
On Wed, 24 May 2023 12:01:45 +0800
Coiby Xu <coxu(a)redhat.com> wrote:
> Currently, kdump doesn't work on many FIPS-enabled systems including
> Azure, ESXI, Hyper, POWER and etc. When FIPS is enabled, it needs to
> access /boot//.vmlinuz-xxx.hmac to verify the integrity of the kernel.
> However, on those systems, /boot fails to be mounted due to a lack of
> fs and block device drivers and the system just halted after failing to
> verify the integrity of the kernel. For example, on Hyper-V, sd_mod, sg,
> scsi_transport_fc, hv_storvsc and hv_vmbus need to be installed in order
> for /boot to be mounted.
>
> mkdumprd calls dracut with the --no-hostonly-default-device. Following
> the documentation (man dracut),
> --no-hostonly-default-device
> Do not generate implicit host devices like root, swap, fstab, etc.
> Use "--mount" or "--add-device" to explicitly add devices
as needed
>
> this patch uses "--add-device" to explicitly add the device of /boot.
>
> Note there is already an attempt to fix it in dracut's 01fips module
> i.e. via the commit 83651776 ("fips: ensure fs module for /boot is
> installed"). Unfortunately it only installs the file system driver e.g.
> xfs.
>
> Signed-off-by: Coiby Xu <coxu(a)redhat.com>
Looks good to me
Reviewed-by: Philipp Rudo <prudo(a)redhat.com>
The patch has been merged, thanks!
> ---
> v2
> - address the case where fips-mode-setup doesn't exist
> ---
> mkdumprd | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/mkdumprd b/mkdumprd
> index 63a37a74..3932a1fd 100644
> --- a/mkdumprd
> +++ b/mkdumprd
> @@ -463,6 +463,10 @@ if ! is_fadump_capable; then
> is_dump_to_rootfs && add_mount "$(to_dev_name
"$(get_root_fs_device)")"
>
> add_dracut_arg "--no-hostonly-default-device"
> +
> + if fips-mode-setup --is-enabled 2 > /dev/null; then
> + add_dracut_arg --add-device "$(findmnt -n -o SOURCE --target /boot)"
> + fi
> fi
>
> dracut "${dracut_args[@]}" "$@"
--
Best regards,
Coiby