This series make kdump support LUKS targets with a lower memory usage and allow second kernel to decrypt the target automatically without password or keyfile.
Current the problem with LUKS is master key decryption from key slot consume massive memory and require keyfile or password prompt, make it not very usable for kdump. This series improve it by passing master key directly.
When there is a LUKS crypt target, and key is stored in dm-crypt, kdump will try to retrive the key automatically. If it success, second kernel will just work without any manual input.
Output of kdumpctl restart in such case: # kdumpctl restart kdump: kexec: unloaded kdump kernel kdump: Stopping kdump: [OK] kdump: kexec: loaded kdump kernel kdump: Starting kdump: [OK] <second kernel works with normal crashkernel and no password prompt>
If LUKS key is stored in kernel keyring, then kdump can't retrive the key. kdump will still work but kdumpctl will print a warning message, warn the user second kernel have some extra requirement:
Output of kdumpctl restart in such case: # kdumpctl restart kdump: kexec: unloaded kdump kernel kdump: Stopping kdump: [OK] kdump: Can't get key of LUKS device /dev/vda3 kdump: Can't retrive LUKS key, crashkernel value should be large enough for LUKS key decryption, and kdump kernel will prompt for password. kdump: kexec: loaded kdump kernel kdump: Starting kdump: [OK] <second kernel need a large crashkernel and need password prompt>
If LUKS key is stored in kernel keyring, and a --askpass param is passed to kdumpctl, kdumpctl will prompt for password for the LUKS device. This way it can also get the LUKS key and pass it to second kernel, bypass key decryption in second kernel, and avoids the extra memory requirement and password promption.
Output of kdumpctl restart in such case: # kdumpctl restart --askpass kdump: kexec: unloaded kdump kernel kdump: Stopping kdump: [OK] Enter passphrase for /dev/vda3: <user input password here> kdump: kexec: loaded kdump kernel kdump: Starting kdump: [OK] <second kernel works with normal crashkernel and no password prompt>
There is no need to rebuild initramfs for key location or LUKS config change, just need a kdumpctl restart or reload.
And this only works for kdump, not for fadump as fadump reuse the initramfs and we can't append the key to the default initramfs which is too dangerous.
Useful commands for testing the patch: To check LUKS key status: # cryptsetup status luks-a0d62a54-6b2f-4667-ae33-65751343e212
Output of a LUKS config with key in keyring: type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/vda3 sector size: 512 offset: 32768 sectors size: 38580224 sectors mode: read/write flags: discards
Output of a LUKS config with key in dm-crypt: type: LUKS1 cipher: aes-xts-plain64 keysize: 512 bits key location: dm-crypt device: /dev/nvme0n1p2 sector size: 512 offset: 4096 sectors size: 1997780992 sectors mode: read/write flags: discards
To change the key location at runtime for LUKS2 (LUKS1 is always stored in dm-crypt):
Change the key location to keyring: # cryptsetup refresh luks-a0d62a54-6b2f-4667-ae33-65751343e212
Change the key location to dm-crypt: # cryptsetup refresh luks-a0d62a54-6b2f-4667-ae33-65751343e212 --disable-keyring
Kairui Song (8): kdump-lib: add support to get dev name from dev ID kdump-lib: add a helper to append files into existing initramfs kdump-lib.sh: introduce a helper to get underlying crypt device mkdumprd: make use of the new get_luks_crypt_dev helper Add helper to get LUKS key of a crypted target Add master key based crypt target support kdumpctl: accept a --askpass param for loading kdump resource mkdumprd: remove LUKS target warning for non-fadump case
dracut-module-setup.sh | 13 +++++ kdump-lib.sh | 126 +++++++++++++++++++++++++++++++++++++++++ kdumpctl | 124 +++++++++++++++++++++++++++++++++++----- kexec-crypt-init.sh | 18 ++++++ kexec-crypt-setup.sh | 18 ++++++ kexec-tools.spec | 4 ++ mkdumprd | 34 +++-------- 7 files changed, 296 insertions(+), 41 deletions(-) create mode 100644 kexec-crypt-init.sh create mode 100644 kexec-crypt-setup.sh
Signed-off-by: Kairui Song kasong@redhat.com --- kdump-lib.sh | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kdump-lib.sh b/kdump-lib.sh index 5f53a8a..7245899 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -107,6 +107,9 @@ to_dev_name() { LABEL=*) dev=`blkid -L "${dev#LABEL=}"` ;; + ID=*) + dev=`readlink -f /dev/disk/by-id/"${dev#ID=}"` + ;; esac echo $dev }
Do some format check of the initramfs and append files into it. CPIO will keep extracting untill there is no valid data, so two concated CPIO file will still be valid, which is a feature of CPIO.
Signed-off-by: Kairui Song kasong@redhat.com --- kdump-lib.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
diff --git a/kdump-lib.sh b/kdump-lib.sh index 7245899..a7b9cba 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -913,3 +913,23 @@ kdump_get_arch_recommend_size() echo $result return 0 } + +# Append files to an existing initramfs +# $1: initramfs to be appended to +# $2: root directory of files to be appended +append_initramfs() +{ + # For security, everything owned by root by default + local cpio_owner="0:0" + local dracut_params + + dracut_params=$(lsinitrd "$1" '*/lib/dracut/build-parameter.txt') + if [[ -z "$dracut_params" ]]; then + dwarn "initramfs seems not generated with dracut." + elif [[ " $dracut_params " == *" --uefi"* ]]; then + derror "initrd packed in UEFI is not supported." + return 1 + fi + + (cd "$2"; find . -print0 | cpio -R $cpio_owner --null -H newc -o --quiet >> "$1") +}
Signed-off-by: Kairui Song kasong@redhat.com --- kdump-lib.sh | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
diff --git a/kdump-lib.sh b/kdump-lib.sh index a7b9cba..5a37f4c 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -933,3 +933,20 @@ append_initramfs()
(cd "$2"; find . -print0 | cpio -R $cpio_owner --null -H newc -o --quiet >> "$1") } + +# Print all underlying crypt devices of a block device +# print nothing if device is not on top of a crypt device +# $1: the block device to be checked in maj:min format +get_luks_crypt_dev() +{ + [[ -b /dev/block/$1 ]] || return 1 + + local _type=$(eval "$(blkid -u filesystem,crypto -o export -- /dev/block/$1); echo $TYPE") + [[ $_type == "crypto_LUKS" ]] && echo $1 + + for _x in /sys/dev/block/$1/slaves/*; do + [[ -f $_x/dev ]] || continue + [[ $_x/subsystem -ef /sys/class/block ]] || continue + get_luks_crypt_dev "$(< "$_x/dev")" + done +}
Simplfy the code and also improve the performance. udevadm call is heavy.
Signed-off-by: Kairui Song kasong@redhat.com --- mkdumprd | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-)
diff --git a/mkdumprd b/mkdumprd index baf53fc..177a722 100644 --- a/mkdumprd +++ b/mkdumprd @@ -328,7 +328,6 @@ get_override_resettable() fi }
- # $1: function name for_each_block_target() { @@ -343,8 +342,6 @@ for_each_block_target() return 0 }
- - #judge if a specific device with $1 is unresettable #return false if unresettable. is_unresettable() @@ -381,32 +378,15 @@ check_resettable() return 1 }
-# $1: maj:min -is_crypt() -{ - local majmin=$1 dev line ID_FS_TYPE="" - - line=$(udevadm info --query=property --path=/sys/dev/block/$majmin \ - | grep "^ID_FS_TYPE") - eval "$line" - [[ "$ID_FS_TYPE" = "crypto_LUKS" ]] && { - dev=$(udevadm info --query=all --path=/sys/dev/block/$majmin | awk -F= '/DEVNAME/{print $2}') - derror "Device $dev is encrypted." - return 0 - } - return 1 -} - check_crypt() { - local _ret _target - - for_each_block_target is_crypt - _ret=$? - - [ $_ret -eq 0 ] && return + local _dev
- return 1 + for _dev in $(get_kdump_targets); do + if [[ -n $(get_luks_crypt_dev "$(get_maj_min "$_dev")") ]]; then + derror "Device $_dev is encrypted." && return 1 + fi + done }
if ! check_resettable; then
If the LUKS key is loaded in userspace memory, just get it with dmsetup. Else ask password and get is using cryptsetup.
Signed-off-by: Kairui Song kasong@redhat.com --- kdump-lib.sh | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+)
diff --git a/kdump-lib.sh b/kdump-lib.sh index 5a37f4c..03129c5 100755 --- a/kdump-lib.sh +++ b/kdump-lib.sh @@ -114,6 +114,13 @@ to_dev_name() { echo $dev }
+# get uuid from block device +# $1: block device +get_block_uuid() { + [[ -b /dev/block/$1 ]] || return 1 + echo $(eval "$(blkid -o export -- /dev/block/$1); echo $UUID") +} + is_user_configured_dump_target() { grep -E -q "^ext[234]|^xfs|^btrfs|^minix|^raw|^nfs|^ssh" /etc/kdump.conf || is_mount_in_dracut_args; @@ -914,6 +921,17 @@ kdump_get_arch_recommend_size() return 0 }
+# get_maj_min <device> +# Prints the major and minor of a device node. +# Example: +# $ get_maj_min /dev/sda2 +# 8:2 +kdump_get_maj_min() { + local _majmin + _majmin="$(stat -L -c '%t:%T' "$1" 2> /dev/null)" + printf "%s" "$((0x${_majmin%:*})):$((0x${_majmin#*:}))" +} + # Append files to an existing initramfs # $1: initramfs to be appended to # $2: root directory of files to be appended @@ -950,3 +968,71 @@ get_luks_crypt_dev() get_luks_crypt_dev "$(< "$_x/dev")" done } + +# Get the master key of a luks device and dump to a file +# May prompt for password. +# $1: the crypted block device in maj:min format +# $2: file to dump into +# $3: if non-empty, password prompt is allowed +# Return 1 if failed to get the key, else return 0 +get_luks_dev_master_key() +{ + local _dev=$1 _file=$2 _askpass=$3 _mapper _info _key _x + + [[ -b /dev/block/$1 ]] || return 1 + + for _x in /sys/dev/block/$1/holders/*; do + if [[ -z "$_mapper" ]]; then + _mapper=$_x + else + dwarn "Can't handle LUKS device having multiple holders" + return 1 + fi + done + + if [[ -n "$_mapper" ]]; then + (set +x; + _mapper=$(< $_mapper/dev) + _info=$(dmsetup --showkeys table --major ${_mapper%:*} --minor ${_mapper#*:}) + _key=$(echo $_info | cut -d ' ' -f 5) + # If it's in kernel keyring, it's not useable in userspace + [[ $_key == :* ]] && _key="" + + if [[ -n "$_key" ]]; then + echo $_key | xxd -ps -g1 -r > $_file + exit 0 + fi + exit 1 + ) && return 0 + fi + + if [[ "$_askpass" ]]; then + (set +x; + echo -n "Enter passphrase for $(readlink -f /dev/block/$_dev): " + read -s _key && echo "" + + _key=$(echo "$_key" | cryptsetup luksDump --dump-master-key /dev/block/$_dev) + _key=${_key#*MK dump:} + _key=${_key//[[:space:]]/} + + if [[ -n "$_key" ]]; then + echo $_key | xxd -ps -g1 -r > $_file + exit 0 + fi + exit 1 + ) && return 0 + fi + + dwarn "Can't get key of LUKS device $(readlink -f /dev/block/$_dev)" + return 1 +} + +get_all_kdump_crypt_dev() +{ + local _dev _crypt + + for _dev in $(get_kdump_targets); do + _crypt=$(get_luks_crypt_dev $(kdump_get_maj_min "$_dev")) + [[ -n "$_crypt" ]] && echo $_crypt + done +}
This bypass decrypt LUKS target in second kernel, so memory usage is reduced by a lot, and no longer need to input password in second kernel.
Signed-off-by: Kairui Song kasong@redhat.com --- dracut-module-setup.sh | 16 +++++++++++ kdumpctl | 60 ++++++++++++++++++++++++++++++++++++++++++ kexec-crypt-init.sh | 18 +++++++++++++ kexec-crypt-setup.sh | 18 +++++++++++++ kexec-tools.spec | 4 +++ 5 files changed, 116 insertions(+) create mode 100644 kexec-crypt-init.sh create mode 100644 kexec-crypt-setup.sh
diff --git a/dracut-module-setup.sh b/dracut-module-setup.sh index b4efc46..88764e0 100755 --- a/dracut-module-setup.sh +++ b/dracut-module-setup.sh @@ -826,6 +826,20 @@ kdump_install_systemd_conf() { echo "ForwardToConsole=yes" >> ${initdir}/etc/systemd/journald.conf.d/kdump.conf }
+kdump_check_crypt_targets() +{ + # This overrides behaviour of 90crypt + inst_hook cmdline 20 "/usr/lib/kdump/kexec-crypt-setup.sh" + + inst cryptsetup + instmods dm_crypt + + echo > "$initdir/etc/cmdline.d/90crypt.conf" + echo > "$initdir/etc/crypttab" + + dracut_need_initqueue +} + install() { kdump_module_init kdump_install_conf @@ -868,6 +882,8 @@ install() { # at some point of time. kdump_check_iscsi_targets
+ kdump_check_crypt_targets + kdump_install_systemd_conf
# nfs/ssh dump will need to get host ip in second kernel and need to call 'ip' tool, see get_host_ip for more detail diff --git a/kdumpctl b/kdumpctl index 009d259..c6acfdb 100755 --- a/kdumpctl +++ b/kdumpctl @@ -4,6 +4,7 @@ KEXEC=/sbin/kexec KDUMP_KERNELVER="" KDUMP_KERNEL="" KDUMP_COMMANDLINE="" +KEXEC_CRYPTO_TMPDIR="" KEXEC_ARGS="" KDUMP_CONFIG_FILE="/etc/kdump.conf" KDUMP_LOG_PATH="/var/log" @@ -670,6 +671,60 @@ function remove_kdump_kernel_key() keyctl unlink $KDUMP_KEY_ID %:.ima }
+# Load the kdump kernel specified in /etc/sysconfig/kdump +# If none is specified, try to load a kdump kernel with the same version +prepare_luks_initramfs() +{ + local _crypt_devices + + _crypt_devices="$(get_all_kdump_crypt_dev)" + [[ -z "$_crypt_devices" ]] && return + + trap ' + ret=$?; + if [[ -d "$KEXEC_CRYPTO_TMPDIR" ]]; then + clean_luks_initramfs + fi + exit $ret; + ' EXIT + + KEXEC_CRYPTO_TMPDIR="$(mktemp -d -t kexec-crypt.XXXXXX)" + [ -d "$KEXEC_CRYPTO_TMPDIR" ] || perror_exit "kdumpctl: mktemp -p -d -t kexec-crypt.XXXXXX failed." + mkdir -p "$KEXEC_CRYPTO_TMPDIR/rootfs" + chmod -R 0600 "$KEXEC_CRYPTO_TMPDIR/rootfs" + + # clean up after ourselves no matter how we die. + trap 'exit 1;' SIGINT + + local _dev _uuid + for _dev in $_crypt_devices; do + _uuid=$(get_block_uuid "$_dev") + if ! get_luks_dev_master_key "$_dev" "$KEXEC_CRYPTO_TMPDIR/rootfs/.kexec-luks-key.$_uuid"; + then + dwarn "Can't retrive LUKS key, crashkernel value should be large enough for LUKS key decryption, and kdump kernel will prompt for password." + clean_luks_initramfs + return 1 + fi + done + + lsinitrd "$TARGET_INITRD" -f /init > "$KEXEC_CRYPTO_TMPDIR/rootfs/init.kexec.orig" + cp /usr/lib/kdump/kexec-crypt-init.sh "$KEXEC_CRYPTO_TMPDIR/rootfs/init" + chmod -R 0700 "$KEXEC_CRYPTO_TMPDIR/rootfs/init" + chmod -R 0700 "$KEXEC_CRYPTO_TMPDIR/rootfs/init.kexec.orig" + + cp "$TARGET_INITRD" "$KEXEC_CRYPTO_TMPDIR/crypt-initramfs" + append_initramfs "$KEXEC_CRYPTO_TMPDIR/crypt-initramfs" "$KEXEC_CRYPTO_TMPDIR/rootfs" + + TARGET_INITRD=$KEXEC_CRYPTO_TMPDIR/crypt-initramfs +} + +clean_luks_initramfs() +{ + [[ -d "$KEXEC_CRYPTO_TMPDIR" ]] || return 0 + find "$KEXEC_CRYPTO_TMPDIR" -type f -exec shred {} ; + rm --one-file-system -rf -- "$KEXEC_CRYPTO_TMPDIR"; +} + # Load the kdump kernel specified in /etc/sysconfig/kdump # If none is specified, try to load a kdump kernel with the same version # as the currently running kernel. @@ -690,6 +745,7 @@ load_kdump() fi
ddebug "$KEXEC $KEXEC_ARGS $standard_kexec_args --command-line=$KDUMP_COMMANDLINE --initrd=$TARGET_INITRD $KDUMP_KERNEL" + [[ $(get_all_kdump_crypt_dev) ]] && prepare_luks_initramfs
# The '12' represents an intermediate temporary file descriptor # to store the standard error file descriptor '2', and later @@ -708,6 +764,10 @@ load_kdump() set +x exec 2>&12 12>&-
+ # unset here to avoid any misuse + unset TARGET_INITRD + + clean_luks_initramfs remove_kdump_kernel_key
if [ $ret == 0 ]; then diff --git a/kexec-crypt-init.sh b/kexec-crypt-init.sh new file mode 100644 index 0000000..cec1977 --- /dev/null +++ b/kexec-crypt-init.sh @@ -0,0 +1,18 @@ +#!/usr/bin/sh +PATH=/bin:/sbin:/usr/bin:/usr/sbin + +for _bin in grep mkdir mount mv; do + [ -n "$(command -v $_bin)" ] && continue + [ -n "$(command -v busybox)" ] && eval 'alias $_bin="busybox $_bin"' && continue + + echo "$_bin is missing!" +done + +[ -e /proc/self/mounts ] || \ + ( mkdir -p /proc && mount -t proc -o nosuid,noexec,nodev proc /proc ) + +grep -q '^devtmpfs /dev devtmpfs' < /proc/self/mounts || \ + ( mkdir -p /dev && mount -t devtmpfs -o mode=755,noexec,nosuid,strictatime devtmpfs /dev ) + +mv /.kexec-luks-key.* /dev/ +exec /init.kexec.orig diff --git a/kexec-crypt-setup.sh b/kexec-crypt-setup.sh new file mode 100644 index 0000000..021bedc --- /dev/null +++ b/kexec-crypt-setup.sh @@ -0,0 +1,18 @@ +#!/bin/sh + +_kexec_crypt_setup() { + for _mk in /dev/.kexec-luks-key.*; do + _devuuid=${_mk#/dev/.kexec-luks-key.} + + printf -- '[ -e /dev/disk/by-id/dm-uuid-CRYPT-LUKS?-*-luks-%s ] || exit 1\n' "$_devuuid" >> "$hookdir/initqueue/finished/99-kdumpbase-crypt.sh" + + { + printf -- 'ENV{ID_FS_UUID}=="%s", ' "$_devuuid" + printf -- 'RUN+="%s --settled --unique --onetime ' "$(command -v initqueue)" + printf -- '--name kdump-crypt-target-%%k %s ' "$(command -v cryptsetup)" + printf -- 'luksOpen --master-key-file %s $env{DEVNAME} %s"\n' "$_mk" "luks-$_devuuid" + } >> /etc/udev/rules.d/70-luks-kdump.rules + done +} + +_kexec_crypt_setup diff --git a/kexec-tools.spec b/kexec-tools.spec index 598f238..43e19c5 100644 --- a/kexec-tools.spec +++ b/kexec-tools.spec @@ -39,6 +39,8 @@ Source28: kdump-udev-throttler Source29: kdump.sysconfig.aarch64 Source30: 60-kdump.install Source31: kdump-logger.sh +Source32: kexec-crypt-init.sh +Source33: kexec-crypt-setup.sh
####################################### # These are sources for mkdumpramfs @@ -191,6 +193,8 @@ install -m 644 %{SOURCE25} $RPM_BUILD_ROOT%{_mandir}/man8/kdumpctl.8 install -m 755 %{SOURCE20} $RPM_BUILD_ROOT%{_prefix}/lib/kdump/kdump-lib.sh install -m 755 %{SOURCE23} $RPM_BUILD_ROOT%{_prefix}/lib/kdump/kdump-lib-initramfs.sh install -m 755 %{SOURCE31} $RPM_BUILD_ROOT%{_prefix}/lib/kdump/kdump-logger.sh +install -m 755 %{SOURCE32} $RPM_BUILD_ROOT%{_prefix}/lib/kdump/kexec-crypt-init.sh +install -m 755 %{SOURCE33} $RPM_BUILD_ROOT%{_prefix}/lib/kdump/kexec-crypt-setup.sh %ifnarch s390x install -m 755 %{SOURCE28} $RPM_BUILD_ROOT%{_udevrulesdir}/../kdump-udev-throttler %endif
Is --askpass is specified and kdumpctl is invoked via terminal, then kdumpctl may ask password for crypt target.
Signed-off-by: Kairui Song kasong@redhat.com --- dracut-module-setup.sh | 3 -- kdumpctl | 66 ++++++++++++++++++++++++++++++++---------- 2 files changed, 51 insertions(+), 18 deletions(-)
diff --git a/dracut-module-setup.sh b/dracut-module-setup.sh index 88764e0..54094bf 100755 --- a/dracut-module-setup.sh +++ b/dracut-module-setup.sh @@ -834,9 +834,6 @@ kdump_check_crypt_targets() inst cryptsetup instmods dm_crypt
- echo > "$initdir/etc/cmdline.d/90crypt.conf" - echo > "$initdir/etc/crypttab" - dracut_need_initqueue }
diff --git a/kdumpctl b/kdumpctl index c6acfdb..d9b6d4d 100755 --- a/kdumpctl +++ b/kdumpctl @@ -21,6 +21,7 @@ TARGET_INITRD="" FADUMP_REGISTER_SYS_NODE="/sys/kernel/fadump_registered" #kdump shall be the default dump mode DEFAULT_DUMP_MODE="kdump" +KDUMP_DECRYPT_ASKPASS="" image_time=0
standard_kexec_args="-d -p" @@ -699,7 +700,7 @@ prepare_luks_initramfs() local _dev _uuid for _dev in $_crypt_devices; do _uuid=$(get_block_uuid "$_dev") - if ! get_luks_dev_master_key "$_dev" "$KEXEC_CRYPTO_TMPDIR/rootfs/.kexec-luks-key.$_uuid"; + if ! get_luks_dev_master_key "$_dev" "$KEXEC_CRYPTO_TMPDIR/rootfs/.kexec-luks-key.$_uuid" "$KDUMP_DECRYPT_ASKPASS"; then dwarn "Can't retrive LUKS key, crashkernel value should be large enough for LUKS key decryption, and kdump kernel will prompt for password." clean_luks_initramfs @@ -709,6 +710,10 @@ prepare_luks_initramfs()
lsinitrd "$TARGET_INITRD" -f /init > "$KEXEC_CRYPTO_TMPDIR/rootfs/init.kexec.orig" cp /usr/lib/kdump/kexec-crypt-init.sh "$KEXEC_CRYPTO_TMPDIR/rootfs/init" + + echo > "$KEXEC_CRYPTO_TMPDIR/etc/cmdline.d/90crypt.conf" + echo > "$KEXEC_CRYPTO_TMPDIR/etc/crypttab" + chmod -R 0700 "$KEXEC_CRYPTO_TMPDIR/rootfs/init" chmod -R 0700 "$KEXEC_CRYPTO_TMPDIR/rootfs/init.kexec.orig"
@@ -1314,13 +1319,47 @@ if [ ! -f "$KDUMP_CONFIG_FILE" ]; then exit 1 fi
-main () +usage() +{ + dinfo $"Usage: $0 {start|stop|status|restart|reload|rebuild|propagate|showmem} [--askpass]" + exit 1 +} + +main() { # Determine if the dump mode is kdump or fadump determine_dump_mode
+ local cmd + case "$1" in - start) + condrestart|start|stop|status|restart|reload|rebuild|propagate|showmem) + cmd=$1 + ;; + *) + usage + ;; + esac + shift + + while [ $# -ge 1 ]; do + case "$1" in + --askpass) + if [[ -t 1 ]]; then + KDUMP_DECRYPT_ASKPASS="true" + else + derror "Ignoring --askpass, kdumpctl not invoked via console" + fi + ;; + *) + usage + ;; + esac + shift + done + + case "$cmd" in + start) if [ -s /proc/vmcore ]; then save_core reboot @@ -1328,10 +1367,10 @@ main () start fi ;; - stop) + stop) stop ;; - status) + status) EXIT_CODE=0 check_current_status case "$?" in @@ -1346,27 +1385,24 @@ main () esac exit $EXIT_CODE ;; - reload) + reload) reload ;; - restart) + restart) stop start ;; - rebuild) + rebuild) rebuild ;; - condrestart) + condrestart) ;; - propagate) + propagate) propagate_ssh_key ;; - showmem) + showmem) show_reserved_mem ;; - *) - dinfo $"Usage: $0 {start|stop|status|restart|reload|rebuild|propagate|showmem}" - exit 1 esac }
@@ -1375,6 +1411,6 @@ single_instance_lock
# To avoid fd 9 leaking, we invoke a subshell, close fd 9 and call main. # So that fd isn't leaking when main is invoking a subshell. -(exec 9<&-; main $1) +(exec 9<&-; main "$@")
exit $?
Now LUKS related warning for non-fadump case is moved to kdumpctl, and only warn the user if kdump failed to auto-decrypt the LUKS target.
Signed-off-by: Kairui Song kasong@redhat.com --- mkdumprd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mkdumprd b/mkdumprd index 177a722..33c0b28 100644 --- a/mkdumprd +++ b/mkdumprd @@ -393,7 +393,7 @@ if ! check_resettable; then exit 1 fi
-if ! check_crypt; then +if is_fadump_capable && ! check_crypt; then dwarn "Warning: Encrypted device is in dump path, which is not recommended, see kexec-kdump-howto.txt for more details." fi
-
Kairui Song