Bug 9213 - dracut won't mount encrypted root filesystem after install from live iso
Summary: dracut won't mount encrypted root filesystem after install from live iso
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: release_blocker normal
Target Milestone: ---
Assignee: Thierry Vignaud
QA Contact:
URL:
Whiteboard: 3beta4
Keywords: PATCH
Depends on:
Blocks: 8337
  Show dependency treegraph
 
Reported: 2013-03-01 06:05 CET by Dave Hodgins
Modified: 2013-04-08 06:39 CEST (History)
3 users (show)

See Also:
Source RPM: drakxtools-15.33-1.mga3.src.rpm
CVE:
Status comment:


Attachments
sosreport.txt from failed boot (61.26 KB, text/plain)
2013-03-01 06:08 CET, Dave Hodgins
Details
dracut.log (16.75 KB, text/plain)
2013-03-01 06:09 CET, Dave Hodgins
Details
Output of dracut --debug while chrooted into /mnt/install from live (336.87 KB, application/octet-stream)
2013-04-06 02:22 CEST, Dave Hodgins
Details
Patch to bind mount /run in the chroot (967 bytes, patch)
2013-04-06 04:56 CEST, Dave Hodgins
Details | Diff

Description Dave Hodgins 2013-03-01 06:05:21 CET
After installing using Mageia-3-beta3-LiveCD-GNOME-en-i586-CD.iso, booting into the installed systems fails
to mount the root filesystem.

In the emergency shell, after manually running
modprobe dm-crypt
cryptsetup luksOpen /dev/sda6 crypt_sda6
and then pressing ctrl+d, booting works.


Reproducible: 

Steps to Reproduce:
Dave Hodgins 2013-03-01 06:06:57 CET

CC: (none) => thomas.backlund
Whiteboard: (none) => 3beta3

Comment 1 Dave Hodgins 2013-03-01 06:08:03 CET
Created attachment 3564 [details]
sosreport.txt from failed boot
Comment 2 Dave Hodgins 2013-03-01 06:09:37 CET
Created attachment 3565 [details]
dracut.log

/boot is on sda1, / is on the encrypted sda6.
Comment 3 Colin Guthrie 2013-03-01 10:26:36 CET
In your initrd do you have a /etc/cmdline.d/90crypt.conf file?

If so what are it's contents?

If no such file exists (and from the SOS report it looks like it does not), does passing "rd.luks.uuid=luks-a093707c-e7f4-47e9-baf9-ead5614b487c" on the kernel command line allow a smooth boot?

Does running dracut on the booted system create a working initrd? (basically an "lsinitrd foo.img | grep cmdline.d" on the resulting file should show you the /etc/cmdline.d/90crypt.conf file)

If not then the error is likely in the file: modules.d/90crypt/module-setup.sh

Assuming it doesn't work, can you change the line:
  for_each_host_dev_fs check_crypt || return 1
to instead read:
  for_each_host_dev_and_slaves_all check_crypt || return 1

And see if that helps?

Cheers

Col
Thomas Backlund 2013-03-01 10:41:13 CET

CC: thomas.backlund => tmb

Comment 4 Dave Hodgins 2013-03-01 19:29:42 CET
(In reply to Colin Guthrie from comment #3)
> In your initrd do you have a /etc/cmdline.d/90crypt.conf file?
> 
> If so what are it's contents?

File is not included in the initrd.
 
> If no such file exists (and from the SOS report it looks like it does not),
> does passing "rd.luks.uuid=luks-a093707c-e7f4-47e9-baf9-ead5614b487c" on the
> kernel command line allow a smooth boot?

Yes.

> Does running dracut on the booted system create a working initrd? (basically
> an "lsinitrd foo.img | grep cmdline.d" on the resulting file should show you
> the /etc/cmdline.d/90crypt.conf file)

It does include it, but it fails to boot.  First it asks for the
passphrase, and opens the encrypted block device. Then it asks
for the passprhase again, and no matter what you enter, reports
back that /dev/sda6 already exists, so you have to press enter
5 times, after which it reports "Wrong password"

Then when it tries to mount the root filesystem, it fails with
dracut Warning: "/dev/mapper/luks-a09..." does not exist

The /dev/mapper directory only contains the control character
device and the symlink crypt_sda6 -> ../dm-0.

> If not then the error is likely in the file:
> modules.d/90crypt/module-setup.sh
> 
> Assuming it doesn't work, can you change the line:
>   for_each_host_dev_fs check_crypt || return 1
> to instead read:
>   for_each_host_dev_and_slaves_all check_crypt || return 1

Not sure if you still want this test, as it does include the
90crypt.conf file, when run from the installed system.
Comment 5 Dave Hodgins 2013-03-05 00:38:18 CET
Still present in latest Live iso images.

[dave@x2s Mageia-3-beta3-LiveDVD-GNOME-i586-DVD]$ cat DATE.txt
Mon Mar  4 22:30:00 CET 2013

Priority: Normal => release_blocker

Dave Hodgins 2013-03-10 19:32:28 CET

Blocks: (none) => 8337

Dave Hodgins 2013-03-13 21:40:53 CET

Summary: dracut won't mount encrypted root filesystem. => dracut won't mount encrypted root filesystem after install from live iso

Glen Ogilvie 2013-03-17 00:19:56 CET

CC: (none) => nelg

Dave Hodgins 2013-03-25 03:29:09 CET

Whiteboard: 3beta3 => 3beta4

Comment 6 Dave Hodgins 2013-04-06 00:32:14 CEST
Still present.
[dave@x2s Mageia-3-beta4-LiveCD-GNOME-en-i586-CD]$ cat DATE.txt
Fri Apr  5 14:00:00 CEST 2013

Making the change suggested in comment 3 before installing to
the hard drive has no effect.
Comment 7 Dave Hodgins 2013-04-06 02:22:17 CEST
Created attachment 3698 [details]
Output of dracut --debug while chrooted into /mnt/install from live
Comment 8 Dave Hodgins 2013-04-06 03:14:54 CEST
Output from udevadm info --query=property --name=/dev/mapper/crypt_sda5
while in a chroot from the live iso ...

DEVNAME=/dev/dm-0
DEVPATH=/devices/virtual/block/dm-0
DEVTYPE=disk
MAJOR=252
MINOR=0
SUBSYSTEM=block

The following additional lines are output if run while booted into the
installed system ...
DM_NAME=crypt_sda5
DM_SUSPENDED=0
DM_UDEV_PRIMARY_SOURCE_FLAG=1
DM_UDEV_RULES_VSN=2
DM_UUID=CRYPT-LUKS1-2a92bc9840ea41088d577c734f4076af-crypt_sda5
ID_FS_LABEL=crypt_sda5
ID_FS_LABEL_ENC=crypt_sda5
ID_FS_TYPE=ext4
ID_FS_USAGE=filesystem
ID_FS_UUID=49fba05c-9d3d-4987-95a5-d974fba09379
ID_FS_UUID_ENC=49fba05c-9d3d-4987-95a5-d974fba09379
ID_FS_VERSION=1.0
TAGS=:systemd:
UDISKS_PRESENTATION_NOPOLICY=1
USEC_INITIALIZED=9574624

So the problem is clear, in that udev is not returning the needed info
when in a chroot environment.
Comment 9 Dave Hodgins 2013-04-06 03:24:25 CEST
Running dracut -f from the booted system does fix the problem now.
Dave Hodgins 2013-04-06 04:54:16 CEST

CC: (none) => mageia
Assignee: mageia => thierry.vignaud
Source RPM: dracut-025-5.mga3.src.rpm => drakxtools-15.33-1.mga3.src.rpm

Comment 10 Dave Hodgins 2013-04-06 04:56:22 CEST
Created attachment 3701 [details]
Patch to bind mount /run in the chroot

Figured it out. /run must be bind mounted in the chroot, for
udev to get all of the information.

With the attached patch applied, it works.
Dave Hodgins 2013-04-06 04:59:37 CEST

Keywords: (none) => PATCH

Comment 11 Thierry Vignaud 2013-04-06 05:17:05 CEST
Colin, do you agree?
Comment 12 Colin Guthrie 2013-04-07 22:27:41 CEST
Depending on the context, it might make sense just to mount /run as tmpfs and then bindmount /run/udev and /run/initramfs (or simply mkdir the later). This should be sufficient and won't clobber things like pidfiles for any services which may have been started on the live media itself. I think you do pretty much this same trick in drakx-in-chroot Theirry, so might make sense to mirror the behaviour?
Comment 13 Dave Hodgins 2013-04-08 00:58:34 CEST
(In reply to Colin Guthrie from comment #12)
> Depending on the context, it might make sense just to mount /run as tmpfs
> and then bindmount /run/udev and /run/initramfs (or simply mkdir the later).
> This should be sufficient and won't clobber things like pidfiles for any
> services which may have been started on the live media itself. I think you
> do pretty much this same trick in drakx-in-chroot Theirry, so might make
> sense to mirror the behaviour?

Since /run is a tmpfs, it doesn't survive
reboot anyway.

In the install I did with the patch applied,
the /run directory is empty.
Comment 14 Thierry Vignaud 2013-04-08 06:39:01 CEST
Fixed

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.