Dracut strangeness
by Dogmatix from LinuxQuestions.org on (#5F096)
So, I've been beating my head against this for too long. I found a fix, but I don't like it because it requires modifying scripts that probably will get updated. Maybe someone can tell me what I can't see. This is a long post, but the solution is complicated.
I've scoured the 'net for information on dracut and how to deal with a luks-crypt partition that holds the LVM that contains root, swap, and home, and little of it has been useful.
I have several computers running Leap 15.2 with different hard disk configurations, and only one has a dracut problem when it creates the new initrd after a kernel update. I have two computers with the exact same hard disk partitioning below, but only one has the dracut problem, and I can't figure out why.
After a kernel update and YaST runs dracut, there is no crypt module in any initrd on /boot, so the computer won't boot. My solution has been to boot off the distro DVD into the installation section, then after it asks for the decryption password, run through these steps from a console (Ctrl-Alt-F2):
Code:1. mkdir ttt
2. mount /dev/mapper/ZuleSys-root /ttt
3. mount --bind /proc /ttt/proc
4. mount --bind /dev /ttt/dev
5. mount --bind /sys /ttt/sys
6. mount /dev/sda1 /ttt/boot
7. chroot /ttt
8. dracut --regenerate-all --force
9. exit
10. rebootThat process works every time - dracut properly includes what's needed for my luks crypt partition, and I'm prompted for the password at boot time.
Here's my lsblk:
Code:NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 298.1G 0 disk
sda1 8:1 0 250M 0 part /boot
sda2 8:2 0 297.9G 0 part
cr_ZuleSysLVM 254:0 0 297.9G 0 crypt
ZuleSys-Root 254:1 0 30G 0 lvm /
ZuleSys-Home 254:2 0 259.9G 0 lvm /home
ZuleSys-Swap 254:3 0 8G 0 lvm [SWAP]
sr0 11:0 1 1024M 0 romHere's the blkid:
Code:/dev/sda1: LABEL="ZuleBoot" UUID="480bf83c-0505-4405-adbb-a9be37f32baf" TYPE="ext2" PTTYPE="dos" PARTUUID="000057e4-01"
/dev/sda2: UUID="f820119e-0e89-4743-ba34-e0d0172b2251" TYPE="crypto_LUKS" PARTUUID="000057e4-02"
/dev/mapper/cr_ZuleSysLVM: UUID="yGxlJr-wBM7-sth8-zxFj-7m1t-GhHO-3KLdcD" TYPE="LVM2_member"
/dev/mapper/ZuleSys-Root: LABEL="ZuleRoot" UUID="0bf2b9fc-d734-49c5-b682-628b7af9e7d4" TYPE="ext4"
/dev/mapper/ZuleSys-Home: LABEL="ZuleHome" UUID="435dd7fa-b73f-434a-b4f3-8c06404db37a" TYPE="ext4"
/dev/mapper/ZuleSys-Swap: UUID="717c0dd2-2032-4286-a908-296726be6f01" TYPE="swap"Here's the /etc/crypttab:
Code:cr_ZuleSysLVM /dev/disk/by-uuid/f820119e-0e89-4743-ba34-e0d0172b2251 none luksHere's the relevant section of fstab:
Code:/dev/ZuleSys/Root / ext4 acl,user_xattr 1 1
LABEL=ZuleBoot /boot ext2 acl,user_xattr 1 2
/dev/ZuleSys/Home /home ext4 acl,user_xattr 1 2
/dev/ZuleSys/Swap swap swap defaults 0 0
/dev/dvd /mnt/dvd iso9660 ro,users,nofail,noatime,utf8 0 0My "fix" involves making a new file /etc/dracut.conf.d/myconf.conf with these contents:
Code:add_dracutmodules+=" crypt "
install_items+=" /etc/crypttab /etc/cmdline.d/90crypt.conf "Then, I edit /usr/lib/dracut/modules.d/90crypt/module-setup.sh as described here.
The line numbers don't match up with that link, but the idea is the same. The snippet of my module-setup.sh is this:
Code: if [ "${forceentry}" = "yes" ]; then
echo "$_mapper $_dev $_luksfile $_luksoptions"
else
for _hdev in "${!host_fs_types[@]}"; do
# [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue
# if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then
echo "$_mapper $_dev $_luksfile $_luksoptions"
break
# fi
done
fiThe first commented line is line 109 in Leap 15.2.
Best I can figure from dracut's debug output, dracut only looks at the swap partition inside the LVM. It never looks at ZuleSys-Root. With the default setup, dracut decides that there are no luks-crypt partitions so it does not include anything related to decrypting it at boot time. The modification to module-setup.sh and myconf.conf force it to include the crypt stuff and create etc/crypttab and etc/cmdline.d/90crypt.conf in the initrd.
I have tried different versions for /etc/crypttab with no effect. I've tried forcing dracut to include the crypt module and include crypttab and 90crypt.conf, but it makes its own crypttab unless 90crypt/module-setup.sh is modified as shown.
Can anyone see what's wrong with this setup? Why does it not work right when others do?
Thanks for your help.
I've scoured the 'net for information on dracut and how to deal with a luks-crypt partition that holds the LVM that contains root, swap, and home, and little of it has been useful.
I have several computers running Leap 15.2 with different hard disk configurations, and only one has a dracut problem when it creates the new initrd after a kernel update. I have two computers with the exact same hard disk partitioning below, but only one has the dracut problem, and I can't figure out why.
After a kernel update and YaST runs dracut, there is no crypt module in any initrd on /boot, so the computer won't boot. My solution has been to boot off the distro DVD into the installation section, then after it asks for the decryption password, run through these steps from a console (Ctrl-Alt-F2):
Code:1. mkdir ttt
2. mount /dev/mapper/ZuleSys-root /ttt
3. mount --bind /proc /ttt/proc
4. mount --bind /dev /ttt/dev
5. mount --bind /sys /ttt/sys
6. mount /dev/sda1 /ttt/boot
7. chroot /ttt
8. dracut --regenerate-all --force
9. exit
10. rebootThat process works every time - dracut properly includes what's needed for my luks crypt partition, and I'm prompted for the password at boot time.
Here's my lsblk:
Code:NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 298.1G 0 disk
sda1 8:1 0 250M 0 part /boot
sda2 8:2 0 297.9G 0 part
cr_ZuleSysLVM 254:0 0 297.9G 0 crypt
ZuleSys-Root 254:1 0 30G 0 lvm /
ZuleSys-Home 254:2 0 259.9G 0 lvm /home
ZuleSys-Swap 254:3 0 8G 0 lvm [SWAP]
sr0 11:0 1 1024M 0 romHere's the blkid:
Code:/dev/sda1: LABEL="ZuleBoot" UUID="480bf83c-0505-4405-adbb-a9be37f32baf" TYPE="ext2" PTTYPE="dos" PARTUUID="000057e4-01"
/dev/sda2: UUID="f820119e-0e89-4743-ba34-e0d0172b2251" TYPE="crypto_LUKS" PARTUUID="000057e4-02"
/dev/mapper/cr_ZuleSysLVM: UUID="yGxlJr-wBM7-sth8-zxFj-7m1t-GhHO-3KLdcD" TYPE="LVM2_member"
/dev/mapper/ZuleSys-Root: LABEL="ZuleRoot" UUID="0bf2b9fc-d734-49c5-b682-628b7af9e7d4" TYPE="ext4"
/dev/mapper/ZuleSys-Home: LABEL="ZuleHome" UUID="435dd7fa-b73f-434a-b4f3-8c06404db37a" TYPE="ext4"
/dev/mapper/ZuleSys-Swap: UUID="717c0dd2-2032-4286-a908-296726be6f01" TYPE="swap"Here's the /etc/crypttab:
Code:cr_ZuleSysLVM /dev/disk/by-uuid/f820119e-0e89-4743-ba34-e0d0172b2251 none luksHere's the relevant section of fstab:
Code:/dev/ZuleSys/Root / ext4 acl,user_xattr 1 1
LABEL=ZuleBoot /boot ext2 acl,user_xattr 1 2
/dev/ZuleSys/Home /home ext4 acl,user_xattr 1 2
/dev/ZuleSys/Swap swap swap defaults 0 0
/dev/dvd /mnt/dvd iso9660 ro,users,nofail,noatime,utf8 0 0My "fix" involves making a new file /etc/dracut.conf.d/myconf.conf with these contents:
Code:add_dracutmodules+=" crypt "
install_items+=" /etc/crypttab /etc/cmdline.d/90crypt.conf "Then, I edit /usr/lib/dracut/modules.d/90crypt/module-setup.sh as described here.
The line numbers don't match up with that link, but the idea is the same. The snippet of my module-setup.sh is this:
Code: if [ "${forceentry}" = "yes" ]; then
echo "$_mapper $_dev $_luksfile $_luksoptions"
else
for _hdev in "${!host_fs_types[@]}"; do
# [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue
# if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then
echo "$_mapper $_dev $_luksfile $_luksoptions"
break
# fi
done
fiThe first commented line is line 109 in Leap 15.2.
Best I can figure from dracut's debug output, dracut only looks at the swap partition inside the LVM. It never looks at ZuleSys-Root. With the default setup, dracut decides that there are no luks-crypt partitions so it does not include anything related to decrypting it at boot time. The modification to module-setup.sh and myconf.conf force it to include the crypt stuff and create etc/crypttab and etc/cmdline.d/90crypt.conf in the initrd.
I have tried different versions for /etc/crypttab with no effect. I've tried forcing dracut to include the crypt module and include crypttab and 90crypt.conf, but it makes its own crypttab unless 90crypt/module-setup.sh is modified as shown.
Can anyone see what's wrong with this setup? Why does it not work right when others do?
Thanks for your help.