Always ensure /dev/{u,random} are in initramfs #2331

cgwalters · 2023-05-09T22:09:45Z

In some scenarios, such as running dracut inside a podman/docker container, we may not have the capabilities necessary to create devices.

But we don't need the ability to make devices; instead, just carry a static copy of a small cpio archive with that content pre-created, and ensure it's the first thing in the generated initramfs image.

EDIT: Downstream in RHEL this is https://bugzilla.redhat.com/show_bug.cgi?id=2208040

In some scenarios, such as running `dracut` inside a podman/docker container, we may not have the capabilities necessary to create devices. But we don't need the ability to make devices; instead, just carry a static copy of a small cpio archive with that content pre-created, and ensure it's the first thing in the generated initramfs image.

cgwalters · 2023-05-09T22:10:01Z

(draft since this could use a bit more testing)

LaszloGombos · 2023-05-10T01:40:21Z

I hope to learn more about the use cases for dracut used (not just installed) inside a podman/docker container.

Is this any way related - https://bugzilla.redhat.com/show_bug.cgi?id=1906633 ?

cgwalters · 2023-05-10T10:42:25Z

The originating bug here is https://issues.redhat.com/browse/OCPBUGS-13207
But we shipped prior workarounds like coreos/rpm-ostree#4058 in our wrapper for dracut.

The rationale for this is basically "server side" initramfs image builds in derived images.

LaszloGombos · 2023-05-15T13:16:28Z

The rationale for this is basically "server side" initramfs image builds in derived images.

Do you mean that the goal is to generate initramfs inside a container and then use that generated initramfs elsewhere outside of the container that was generated in ?

cgwalters · 2023-05-15T13:41:26Z

Yes. For more information, see https://fedoraproject.org/wiki/Changes/OstreeNativeContainer and https://coreos.github.io/rpm-ostree/container/ - we use containers as a build tool to generate bootable host systems. (As of recently there's also https://github.com/containers/bootc which streamlines this)

LaszloGombos · 2023-05-25T13:13:43Z

Perhaps to move this forward try to keep dracut-random.cpio.gz out of upstream and make only the necessary changes that would allow you to carry dracut-random.cpio.gz for your own needs. Would you see this as a good compromise ?

Just trying to find a way to avoid this issue being stalled.

cgwalters · 2023-05-30T13:37:38Z

Perhaps to move this forward try to keep dracut-random.cpio.gz out of upstream and make only the necessary changes that would allow you to carry dracut-random.cpio.gz for your own needs. Would you see this as a good compromise ?

It'd help for sure, but I wouldn't call it a good compromise. What is the compromise here - i.e. what do you see as bad? Just having additional code? The opacity of the pre-generated file (that's definitely fixable)? Something else?

stale · 2023-07-14T23:50:02Z

This issue is being marked as stale because it has not had any recent activity. It will be closed if no further activity occurs. If this is still an issue in the latest release of Dracut and you would like to keep it open please comment on this issue within the next 7 days. Thank you for your contributions.

cgwalters · 2023-07-15T13:46:50Z

This keeps coming up (e.g. coreos/rpm-ostree#4499 ), and if we don't agree to merge this, what I'll probably end up doing is adding a wrapper around dracut that does it anyways. We actually already have infrastructure for this. It's just much less sustainable than fixing the initramfs to just have the devices by default.

LaszloGombos · 2023-07-15T15:21:40Z

I am glad there is still interest in this PR. I personally support this use-case.

What do you see as bad? The opacity of the pre-generated file (that's definitely fixable)?

This - the opacity of the pre-generated file.

Also, if this PR is up for review, then please remove the "Draft" as that indicates that this PR is still work in progress and review comments are not yet welcome. Thanks @cgwalters .

cgwalters · 2023-07-18T19:23:10Z

We could try making the cpio file at build time, but that's going to have a potentially larger blast radius - it's quite likely some build systems may actually be using container runtimes with similar device cgroup restrictions.

Another possibility is to try to land a patch in upstream cpio to allow it to synthesize these devices directly.

Yet another possibility is to generate a cpio blob in dracut-install in C code.

LaszloGombos · 2023-07-18T20:05:45Z

Is this "cpio blob" portable across architectures (x86, x86_64, arm, arm64, etc) or they they need to be generated separate for each architecture ?

As I understand cpio format can be easily concatenated (outside of dracut), so perhaps as first step we could focus on the changes that needs to be made inside dracut and can not be easily maintained (e.g. the change in the fips module).

FWIW, dracut projects has its own implementation of cpio - https://github.com/dracutdevs/dracut/tree/master/src/dracut-cpio.

CC @pvalena @ddiss

pvalena · 2023-07-24T17:50:50Z

Hello,

yes, I did a brief investigation into this PR & the cpio archive is the main obstackle in bringing this to RHEL-9 as well.

Unfortunately, I didn't have spare cycles yet to look into what's the archive content and whether it can be recreated at dracut runtime (apart from copied from the system).

ddiss · 2023-07-31T12:42:36Z

Is this "cpio blob" portable across architectures (x86, x86_64, arm, arm64, etc) or they they need to be generated separate for each architecture ?

If the archive blob is just the /dev/{u,}random nodes, then it shouldn't be arch specific.

I agree that it'd be nice to avoid carrying the blob in dracut. There are a couple of other options which could be considered here:
If the use-case assumes full control over the kernel, then the payload could easily be nested in the kernel via CONFIG_INITRAMFS_SOURCE, or a minor change to default_cpio_list:

--- a/usr/default_cpio_list
+++ b/usr/default_cpio_list
@@ -4,3 +4,5 @@
 dir /dev 0755 0 0
 nod /dev/console 0600 0 0 c 5 1
 dir /root 0700 0 0
+nod /dev/random 0666 0 0 c 1 8
+nod /dev/urandom 0666 0 0 c 1 9

Still, the underlying problem here is the source-directory-tree-defines-archive-contents interface for GNU cpio (copied for dracut-cpio), which breaks unprivileged archive creation. My plan is to address this with #1662 , which will add a Linux gen_init_cpio like interface to dracut-cpio.

ddiss · 2023-07-31T13:02:03Z

Makefile

@@ -207,6 +207,7 @@ endif
 	if [ -f dracut-util ]; then \
 		install -m 0755 dracut-util $(DESTDIR)$(pkglibdir)/dracut-util; \
 	fi
+	install -m 0644 -Dt $(DESTDIR)$(pkglibdir) dracut-random.cpio.gz


I don't think compression makes much sense for a two (or three with /dev) item cpio archive.

One thing I forgot to mention: GNU cpio unnecessarily zero-pads archives out to the next "block-size" (default=512) alignment, while the newc / SVR4 spec only requires 4-byte alignment, so any bundled archive with GNU cpio padding could be trimmed down.
In matching GNU cpio quirks, dracut-cpio does the same:
https://github.com/dracutdevs/dracut/blob/master/src/dracut-cpio/src/main.rs#L644

ddiss · 2023-07-31T13:50:23Z

dracut.sh

+        # Next, in order to avoid requiring privilege at initramfs generation time, which we may not have
+        # in a container image, append a pre-generated cpio blob with /dev/{u,random}.
+        zcat ${dracutsysrootdir}/${dracutbasedir}/dracut-random.cpio.gz > ${DRACUT_TMPDIR}/random.fifo
+        wait


Asynchronous append here also seems like overkill given the size of the trailing archive.

ddiss · 2023-07-31T13:54:47Z

modules.d/01fips/module-setup.sh

@@ -70,16 +70,4 @@ install() {
    inst_multiple sha512hmac rmmod insmod mount uname umount grep sed cut find sort

    inst_simple /etc/system-fips


Given the simplicity of cpio and what's needed here, it's tempting to propose just using printf to generate the trailing archive entries... That said, my preference would still be to embed those nodes in the kernel archive, or wait for #1662 to be implemented.

Hmm yes, I think the cpio format may be sufficiently simple that we could do it via printf in a not terribly ugly way.

cgwalters · 2023-08-02T19:08:40Z

If the use-case assumes full control over the kernel,

Oh wow, I was unaware of this. Yes...let me try sending a kernel patch!

cgwalters · 2023-10-12T12:09:53Z

Closing since we're in agreement this exact patch isn't the way to go

ericcurtin · 2023-11-02T13:53:26Z

Is this "cpio blob" portable across architectures (x86, x86_64, arm, arm64, etc) or they they need to be generated separate for each architecture ?

Note, it's important that the solution is also portable across compressors/decompressors (gzip, lz4, zstd, etc.) Encountered an issue where part of the initramfs was lz4 and another part gzip and the kernel decompressor got confused and panicked on boot.

github-actions bot added fips Issues related to the fips module modules Issue tracker for all modules labels May 9, 2023

stale bot added the stale communication is stuck label Jul 14, 2023

LaszloGombos added enhancement Issue adding new functionality and removed stale communication is stuck labels Jul 15, 2023

ddiss suggested changes Jul 31, 2023

View reviewed changes

cgwalters closed this Oct 12, 2023

cgwalters mentioned this pull request Nov 2, 2023

Support multiple initrd compression formats (non-gzip compression formats currently cause kernel crashes in worst case scenario) coreos/rpm-ostree#4683

Closed

LaszloGombos mentioned this pull request May 23, 2024

fix(fips): Remove /dev/{random,urandom} pre-creation dracut-ng/dracut-ng#311

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Always ensure /dev/{u,random} are in initramfs #2331

Always ensure /dev/{u,random} are in initramfs #2331

cgwalters commented May 9, 2023 •

edited

Loading

cgwalters commented May 9, 2023

LaszloGombos commented May 10, 2023 •

edited

Loading

cgwalters commented May 10, 2023

LaszloGombos commented May 15, 2023 •

edited

Loading

cgwalters commented May 15, 2023

LaszloGombos commented May 25, 2023

cgwalters commented May 30, 2023

stale bot commented Jul 14, 2023

cgwalters commented Jul 15, 2023

LaszloGombos commented Jul 15, 2023 •

edited

Loading

cgwalters commented Jul 18, 2023

LaszloGombos commented Jul 18, 2023 •

edited

Loading

pvalena commented Jul 24, 2023 •

edited

Loading

ddiss commented Jul 31, 2023 •

edited

Loading

ddiss Jul 31, 2023

ddiss Aug 3, 2023

ddiss Jul 31, 2023

ddiss Jul 31, 2023

cgwalters Aug 2, 2023

cgwalters commented Aug 2, 2023

cgwalters commented Oct 12, 2023

ericcurtin commented Nov 2, 2023

		@@ -70,16 +70,4 @@ install() {
		inst_multiple sha512hmac rmmod insmod mount uname umount grep sed cut find sort

		inst_simple /etc/system-fips

Always ensure /dev/{u,random} are in initramfs #2331

Always ensure /dev/{u,random} are in initramfs #2331

Conversation

cgwalters commented May 9, 2023 • edited Loading

cgwalters commented May 9, 2023

LaszloGombos commented May 10, 2023 • edited Loading

cgwalters commented May 10, 2023

LaszloGombos commented May 15, 2023 • edited Loading

cgwalters commented May 15, 2023

LaszloGombos commented May 25, 2023

cgwalters commented May 30, 2023

stale bot commented Jul 14, 2023

cgwalters commented Jul 15, 2023

LaszloGombos commented Jul 15, 2023 • edited Loading

cgwalters commented Jul 18, 2023

LaszloGombos commented Jul 18, 2023 • edited Loading

pvalena commented Jul 24, 2023 • edited Loading

ddiss commented Jul 31, 2023 • edited Loading

ddiss Jul 31, 2023

Choose a reason for hiding this comment

ddiss Aug 3, 2023

Choose a reason for hiding this comment

ddiss Jul 31, 2023

Choose a reason for hiding this comment

ddiss Jul 31, 2023

Choose a reason for hiding this comment

cgwalters Aug 2, 2023

Choose a reason for hiding this comment

cgwalters commented Aug 2, 2023

cgwalters commented Oct 12, 2023

ericcurtin commented Nov 2, 2023

cgwalters commented May 9, 2023 •

edited

Loading

LaszloGombos commented May 10, 2023 •

edited

Loading

LaszloGombos commented May 15, 2023 •

edited

Loading

LaszloGombos commented Jul 15, 2023 •

edited

Loading

LaszloGombos commented Jul 18, 2023 •

edited

Loading

pvalena commented Jul 24, 2023 •

edited

Loading

ddiss commented Jul 31, 2023 •

edited

Loading