dracut: add EFI kernel hook #22484

ericonr · 2020-06-01T00:41:06Z

Also made some small formatting changes.

@ahesford

ahesford

Looks good to me

ericonr · 2020-07-20T03:58:47Z

@sgn could you take a look at this one?

Duncaen · 2020-07-20T16:03:50Z

srcpkgs/dracut/files/kernel-uefi-hook-postinst

+	fi
+
+if [ -z "${KERNEL_CMDLINE}" ] && [ "x${SKIP_KERNEL_CMDLINE}" != x1 ]; then
+	echo "ERROR: You need to set the kernel command line in /etc/default/dracut-uefi-hook"


Is this logic necessary?

It's solving the issue that if dracut doesn't find a kernel_cmdline entry in a dracut.conf file and isn't passed a cmdline in the command line argumets, it will prompt the user for a cmdline.

I couldn't think of another way of solving this particular issue.

The other way of solving this would be always passing at least an empty string to the command line parameter. But it doesn't protect the user from dumb mistakes.

That seems like a good option, provided it has no unanticipated side effects.

I would still prefer erroring out, but if you think it's fine.

Hmm there's also the use case without secure boot that allows the bundle to use the cmdline from refind/grub, so the command line could be empty.

Just write a warning in the configuration file, and let the user see the boot failure 🤷
Don't bother with it, I would say.

srcpkgs/dracut/files/kernel-uefi-hook-postinst

srcpkgs/dracut/files/dracut-uefi-hook.confd

sgn · 2020-07-20T15:42:23Z

srcpkgs/dracut/files/kernel-uefi-hook-postinst

+	exit 1
+fi
+
+OPTIONS="${OPTIONS} --force --uefi ${UEFI_BUNDLE_DIR:=boot/efi/EFI/Void}/linux-${VERSION}.efi ${VERSION}"


mkdir -p "$UEFI_BUNDLE_DIR"

Maybe void lowercase v is better.

And I'm thinking about supporting this in sbsigntool and refind hooks.

And I'm thinking about supporting this in sbsigntool and refind hooks.

How would this look?

Force them read this hooks if exists, maybe.
Rather messy but I don't like different parts of system refusing co-operating with each others. Just make sure variable introduced by this change doesn't overlap with them, I can make it works.
I like this idea, (so I can sign the whole efi, my initrd is unsigned, now) but I don't use gummiboot, for example.

Something like this to prepare for it
sgn@9bbcb81

Cool! I like the idea.

srcpkgs/dracut/files/kernel-uefi-hook-postinst

sgn · 2020-07-21T00:09:46Z

srcpkgs/dracut/files/kernel-uefi-hook-postinst

+DRACUT_OPTIONS="${DRACUT_OPTIONS} --force --uefi ${UEFI_BUNDLE_DIR:=boot/efi/EFI/void}/linux-${VERSION}.efi ${VERSION}"
+mkdir -p "${UEFI_BUNDLE_DIR}"
+
+dracut -q --kernel-cmdline="${KERNEL_CMDLINE}" ${DRACUT_OPTIONS}


dracut -q ${KERNEL_CMDLINE:+--kernel-cmdline="${KERNEL_CMDLINE}"} ${DRACUT_OPTIONS}

looks better?

I think the issue is that, if you don't set kernel_cmdline in the config file or the dracut command line, the user will be prompted for a value, which will stall the hook. @ericonr, is this correct?

Gah I hadn't seen @ahesford's comment.

So, that one does look better, and if I add the -q argument to dracut it simply plows ahead and gets an empty cmdline. So it should be fine.

sgn · 2020-07-21T00:11:33Z

srcpkgs/dracut/files/kernel-uefi-hook-postinst

+	fi
+
+if [ -z "${KERNEL_CMDLINE}" ] && [ "x${SKIP_KERNEL_CMDLINE}" != x1 ]; then
+	echo "ERROR: You need to set the kernel command line in /etc/default/dracut-uefi-hook"


Just write a warning in the configuration file, and let the user see the boot failure 🤷
Don't bother with it, I would say.

Also made some small formatting changes. Close: void-linux#22484

ericonr · 2020-07-21T01:24:46Z

Updated again.

Also made some small formatting changes. Close: void-linux#22484

sgn · 2020-07-27T11:56:01Z

Is this ready?

Or are we better to split the uefi bundle hook and gummiboot?

If this is ready, I'll merge this in, without worrying about other option.

ericonr · 2020-07-27T12:39:31Z

I don't think it's fully ready, the post remove hook isn't using -z to detect if it should do anything. Btw, how do we deal with

if [ ! -x bin/dracut ]; then
	exit 0
fi

? Should it exit with 1 and show an error, since having the hook installed but not dracut is an issue?

srcpkgs/dracut/files/kernel-uefi-hook-postrm

sgn · 2020-07-27T12:49:45Z

srcpkgs/dracut/files/kernel-uefi-hook-postrm

+	exit 0
+fi
+
+: "${UEFI_BUNDLE_DIR:=boot/efi/EFI/Void}"


Lowercase V in Void.
Since grub will create this very same directory with lowercase void.
I'm not sure what they will do if they're conflicting now.
And I couldn't say about their future.

sgn · 2020-07-27T12:53:34Z

I don't think it's fully ready, the post remove hook isn't using -z to detect if it should do anything.
Btw, how do we deal with
if [ ! -x bin/dracut ]; then
	exit 0
fi

If this hook is included with dracut, this check is likely unnecessary.
Albeit, we should use usr/bin/dracut instead?

But, this hook depends on both dracut and an efi file provided by gummiboot.
I'm not sure if it's better to split it out and explicitly depends on gummiboot?

? Should it exit with 1 and show an error, since having the hook installed but not dracut is an issue?

I, myself, don't care about the broken system if their owners choose to break it

ericonr · 2020-07-27T12:58:53Z

If this hook is included with dracut, this check is likely unnecessary.

I agree. It is mostly following the style of the other hook, that's why it has the check.

I'm not sure if it's better to split it out and explicitly depends on gummiboot?

Hmm that might be a better way of doing it. We mention the dependency in the config file, at least. Would it be okay to have a subpackage only for the hook and the conf file?

sgn · 2020-07-27T13:04:58Z

On 2020-07-27 05:59:09-0700, Érico Nogueira Rolim ***@***.***> wrote: > If this hook is included with dracut, this check is likely unnecessary. I agree. It is mostly following the style of the other hook, that's why it has the check. > I'm not sure if it's better to split it out and explicitly depends on gummiboot? Hmm that might be a better way of doing it. We mention the dependency in the config file, at least. Would it be okay to have a subpackage only for the hook and the conf file?

I support for subpackage, don't know about other. We have a ton of meta package already, and despite this package is a single POSIX script and a config, it must be installed in system level. Still better than `sx` which is single 4x line bash script, which I want to remove badly.

…

-- Danh

ericonr · 2020-07-27T13:09:53Z

Heh, ok! Will split it off.

ericonr · 2020-07-27T13:19:29Z

Done.

sgn · 2020-07-27T13:25:11Z

Looks good. I hope you don't mind to wait for few days to let other people complain :D

ericonr · 2020-07-27T13:28:09Z

No worries, I'm not even using it any more :p

Thanks!

Edit: I am not using on my main device, I am indeed using it on my old one.

srcpkgs/dracut/template

ericonr · 2020-08-02T20:18:44Z

Added binutils to dracut-uefi, it needs it for the objcopy step.

sgn · 2020-08-02T23:34:38Z

srcpkgs/dracut/template

+	i686*|x86_64*|aarch64*) # EFI bundle config and hooks
+		_efi_bundle=1
+		subpackages+=" dracut-uefi"


uefi-bundle is not supported in aarch64. (/usr/bin/dracut:1140)

Oh, good find. Wonder if they forgot to add aarch64 or if it doesn't work.

I guess it's ready, I'll pull this patch in dracutdevs/dracut@6184c7a

It seems like it's already there? But, somehow wasn't pulled in

Restricted to i686* and x86_64* for now. Other changes: - small formatting changes - use relative path in kernel-hook-postrm

ahesford · 2021-07-07T21:55:37Z

srcpkgs/dracut/template

 			vmove usr/lib/dracut/modules.d/${f}
 		done
 	}
 }
+
+dracut-uefi_package() {
+	depends="binutils gummiboot dracut-${version}_${revision}"


The dracut UEFI bundle requires a separate UEFI stub provided (in our case) by gummiboot.

ericonr force-pushed the dracut branch 5 times, most recently from 298ab48 to 51d137a Compare June 1, 2020 07:32

ahesford approved these changes Jun 1, 2020

View reviewed changes

ericonr mentioned this pull request Jun 26, 2020

installation/guides: add EFI Boot Stub guide void-linux/void-docs#311

Closed

sgn assigned sgn and unassigned sgn Jul 20, 2020

ericonr force-pushed the dracut branch from 51d137a to 2b95638 Compare July 20, 2020 14:41

Duncaen requested changes Jul 20, 2020

View reviewed changes

sgn reviewed Jul 20, 2020

View reviewed changes

srcpkgs/dracut/files/kernel-uefi-hook-postinst Outdated Show resolved Hide resolved

ericonr force-pushed the dracut branch from 2b95638 to 81c34c2 Compare July 20, 2020 18:28

sgn reviewed Jul 21, 2020

View reviewed changes

sgn pushed a commit to sgn/void-packages that referenced this pull request Jul 21, 2020

dracut: add EFI kernel hook

33ddd99

Also made some small formatting changes. Close: void-linux#22484

ericonr force-pushed the dracut branch from 81c34c2 to a86d75a Compare July 21, 2020 01:23

sgn pushed a commit to sgn/void-packages that referenced this pull request Jul 22, 2020

dracut: add EFI kernel hook

94d13f4

Also made some small formatting changes. Close: void-linux#22484

sgn pushed a commit to sgn/void-packages that referenced this pull request Jul 22, 2020

dracut: add EFI kernel hook

c90dd76

Also made some small formatting changes. Close: void-linux#22484

sgn pushed a commit to sgn/void-packages that referenced this pull request Jul 23, 2020

dracut: add EFI kernel hook

606fbca

Also made some small formatting changes. Close: void-linux#22484

sgn pushed a commit to sgn/void-packages that referenced this pull request Jul 23, 2020

dracut: add EFI kernel hook

1505996

Also made some small formatting changes. Close: void-linux#22484

ericonr mentioned this pull request Jul 23, 2020

sbsigntool: rewrite post-install kernel hook #23688

Closed

sgn reviewed Jul 27, 2020

View reviewed changes

ericonr force-pushed the dracut branch 2 times, most recently from 53da9d8 to fb548b7 Compare July 27, 2020 12:52

ericonr force-pushed the dracut branch from fb548b7 to eec3911 Compare July 27, 2020 13:18

ericonr force-pushed the dracut branch from eec3911 to 9e3e7cb Compare July 27, 2020 13:20

ahesford reviewed Jul 27, 2020

View reviewed changes

srcpkgs/dracut/template Show resolved Hide resolved

ericonr mentioned this pull request Jul 28, 2020

EFI Secure Boot Build Support #12495

Closed

ericonr force-pushed the dracut branch from 9e3e7cb to 1be1e31 Compare August 2, 2020 20:18

sgn reviewed Aug 2, 2020

View reviewed changes

dracut: add UEFI bundle hook in dracut-uefi subpkg

b01ac15

Restricted to i686* and x86_64* for now. Other changes: - small formatting changes - use relative path in kernel-hook-postrm

ericonr force-pushed the dracut branch from 1be1e31 to b01ac15 Compare August 2, 2020 23:56

sgn merged commit 77489be into void-linux:master Aug 3, 2020

ericonr deleted the dracut branch August 3, 2020 04:15

ahesford reviewed Jul 7, 2021

View reviewed changes

github-actions bot locked as resolved and limited conversation to collaborators Oct 6, 2021

dracut: add EFI kernel hook #22484

dracut: add EFI kernel hook #22484

Conversation

ericonr commented Jun 1, 2020

ahesford left a comment

Choose a reason for hiding this comment

ericonr commented Jul 20, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericonr Jul 20, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericonr commented Jul 21, 2020

sgn commented Jul 27, 2020

ericonr commented Jul 27, 2020

Choose a reason for hiding this comment

sgn commented Jul 27, 2020 • edited Loading

ericonr commented Jul 27, 2020

sgn commented Jul 27, 2020 via email

ericonr commented Jul 27, 2020

ericonr commented Jul 27, 2020

sgn commented Jul 27, 2020

ericonr commented Jul 27, 2020 • edited Loading

ericonr commented Aug 2, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sgn Aug 3, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericonr Jul 20, 2020 •

edited

Loading

sgn commented Jul 27, 2020 •

edited

Loading

ericonr commented Jul 27, 2020 •

edited

Loading

sgn Aug 3, 2020 •

edited

Loading