Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Initramfs doesn't support Luks despite flag with genkernel?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sat Mar 10, 2012 2:28 am    Post subject: Initramfs doesn't support Luks despite flag with genkernel? Reply with quote

Hi all,

I'm attempting to install a Luks-encrypted lvm system on my computer, and I'm having a bit of difficulty with booting. I compile the kernel, specifically selecting the appropriate options in the menuconfig, and then running genkernel with the --luks flag. Despite this, whenever I boot into the kernel the ramdisk complains that it doesn't support Luks, and then gives up the ghost. Shouldn't the initramfs support this if genkernel generates it (which it did)? I looked into creating an initramfs myself and it blew my socks off. I suppose I could learn it if I really put myself to it, but it'd be nice if I could fix this by adding / removing a single option with genkernel / menuconfig.[/b]
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Sat Mar 10, 2012 2:36 am    Post subject: Reply with quote

never worked properly for me either

ergo, i wrote this guide: http://whitehathouston.com/documentation/gentoo/initramfs_howto.htm
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sat Mar 10, 2012 2:38 am    Post subject: Reply with quote

So genkernel just won't do it, period?
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Sat Mar 10, 2012 4:27 am    Post subject: Reply with quote

for *me* it was epic fail trying to get genkernel to do it, when i first tried way back in the day, and my most recent attempt ~2 years ago
so i finally bashed out a way to make a very simple small one of my own

the doc says it's supported - maybe other people have had better experiences than myself, so i cant write it off completely

Code:

--luks: Includes support for Linux Unified Key Setup or LUKS. This will allow you to use a device encrypted by LUKS which contains the root filesystem. On the bootloader, you then set that encrypted device as the value of crypt_root (and real_root shall be the unencrypted device LUKS creates).


e.g.

Code:

root=/dev/ram0 crypt_root=/dev/sda3 real_root=/dev/mapper/crypt-root



either way I'd always preferred tuning the kernel myself over genkernel, and since genkernel's test failed for me, once in finally figured out an easy way to make my own initramfs, genkernel was deemed massive overkill.
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sat Mar 10, 2012 6:03 am    Post subject: Reply with quote

Seems doable. I take it that if I want LVM support I have to copy all of the lvm-related binaries as well?
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Sat Mar 10, 2012 6:25 am    Post subject: Reply with quote

jbiggs12 wrote:
Seems doable. I take it that if I want LVM support I have to copy all of the lvm-related binaries as well?


if you build lvm with USE="static" it should greatly simplify the task, as youre not having to ldd ./blah and figure out what depends on what

but yeah, basically. use lvm? copy the binaries needed to activate your lvm volumes, then add the lines needed to do so in the 'init' script. The latter will basically be the same as, "after the latest failure, whatever youre typing whenever you boot from a livecd in order to get your root partition mounted and try again - whether theyre commands for lvm, mdadm, cryptsetup, or whatever else - put in init, in the same order you typed them. once root is mount ro, switch_root"
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sat Mar 10, 2012 8:52 pm    Post subject: Reply with quote

Tried your guide, the kernel keeps insisting that init isn't there despite me using chmod +x, then trying chmod 777, then trying passing a path to the kernel with init=. I'm going to try compiling it into the kernel to see if I can get any different results.
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sat Mar 10, 2012 9:52 pm    Post subject: Reply with quote

Update: Tried compiling it in with the kernel, but it still doesn't work. I'm also noticing that before it says it couldn't find init, it complains that it was "unable to open an initial console." I double checked and I enabled in-kernel initramfs. Is there some option that I'm missing? (Once I boot onto my livecd I'll post my kernel config)

edit: Kernel config: http://paste.pocoo.org/show/563954/
menu.lst: http://paste.pocoo.org/show/563955/
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Sun Mar 11, 2012 4:36 am    Post subject: Reply with quote

in your menu.lst there is no 'initrd' line.

what did you namethe initramfs?

Your menu.lst/grub.conf should look very similar to this:

Code:

title Gentoo Linux 2.6.32.58-grsec
root (hd0,0)
kernel /vmlinuz-2.6.32.58-grsec
initrd /initramfs.cpio.gz


With the 'initrd' pointing to wherever youve put the custom initramfs youve made. The ideal place for it to go is in the same directory as the kernel.

NB: is your /boot partition /dev/sda3 ? Because that's what hd0,2 is
whereas hd0,0 is /dev/sda1 (that's not *entirely* true - there are cases where when one has two disks, what grub sees as the first disk is different from what linux sees as the first disk. hd0,2 *really* means is 'third partition on the first disk your BIOS identifies, is where i should look for the kernel and initramfs youre telling me to use')

One other thing to point out. Your uncommented, second entry in menu.lst has all of this stuff on the kernel command line

Code:

kernel /vmlinuz-2.6.32.58-grsec keymap=dvorak crypt_root=/dev/sda4 real_root=/dev/vg/root


the way this works: these entries, such as keymap, crypt_root, etc, all get stored as-is in /proc/cmdline. Some 'init' scripts will parse /proc/cmdline and store its contents within the script's own internal variables. So, for example, 'init' might be coded to do a convoluted "cut" command on /proc/cmdline, and store the output in a variable called ${REAL_ROOT}. Then later in init you'll see a 'switch_root /mnt/root ${REAL_ROOT}". It might do a cut on /proc/cmdline to grab crypt_root and store it in ${CRYPT_ROOT}, so that it can do a 'cryptsetup luksOpen ${CRYPT_ROOT} root' which will take the drive passed on the kernel command-line to the crypt_root variable, and try to luksOpenit.

(if that makes sense?)

To see what I mean, have a look at the example 'init' here - http://en.gentoo-wiki.com/wiki/Root_filesystem_over_LVM2,_DM-Crypt_and_RAID#Hierarchy

Notice how it has the "CMDLINE=`cat /proc/cmdline`" which gives it a variable that can be accessed later via ${CMDLINE}
One could, for example, run a 'cut' command against ${CMDLINE} in order to get different variables, e.g.

Code:

CRYPTROOT=`cut -d blahblahblah ${CMDLINE}`


So that they could later do an luksOpen of ${CRYPTROOT} instead of having to hard-code a volume like e.g. /dev/sda3

In other words, you have one immediate problem:
-you didnt put an 'initrd' line in your menu.lst

And one problem that may surface after you correct the above
-unless you code your 'init' to pluck through /proc/cmdline, your "keymap" "crypt_root" and "real_root" are all going to be meaningless.

So once you fix your menu.lst you will probably want to re-bundle your initramfs, and make the 'init' look something like:

Code:

#!/bin/sh

mount -t proc none /proc
mount -t sysfs none /sys
mount -t devtmpfs none /dev

#assuming youve copied the keymap into the initramfs /etc directory and named it 'dvorak'
loadkmap < /etc/dvorak

#assuming your luks volume that houses your LVM is /dev/sda4, and that you've named it such that it will be at /dev/mapper/rootlv
/bin/cryptsetup luksOpen /dev/sda4 rootlv

#doing your luksOpen should give you /dev/mapper/rootlv.
#LVM should be configured to look within /dev/mapper/rootlv for LVM data, in this case a volume group named 'vg'
/bin/vgscan
/bin/vgchange -ay vg

#the results of your vgchange above should give you a '/dev/vg/root', which is *finally* your actual root partition
#assuming your actual root is /dev/vg/root. Actual as in, has all of your data on it, as in /dev/vg/root is an ext3/ext4/whateverfs volume
mount -r /dev/vg/root /mnt/root

umount /sys
umount /proc

#now that youve done an luksOpen to get to your LV, and mounted your LV at /mnt/root, you do the switch_root
#and execute /sbin/init
exec switch_root /mnt/root /sbin/init


Notice that this 'init' has all sorts of stuff hard-coded, such as the partition with your luks volume (/dev/sda4) and the name of your root vg (/dev/vg/root)

The whole point of putting extra stuff in menu.lst after the 'kernel /somevmlinux' is so that init can access it and look for things you might have wanted to pass to init. The kernel itself has its own 'init' routine that supports different things passed on the command line, and it will parse these out in a similar fashion; however the kernel's own init doesnt look for crypto related things, ergo the need to make your own initramfs with your own init. A custom 'init' bundled into an initramfs can make use of this extra appended data just as easily, however it doesnt *have* to, if youre happy to hard-code certain bits and bobs into the init, as I've done, and as the examples I've done will show.


...so yeah, hopefully that makes it clearer and not more muddy.
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sun Mar 11, 2012 4:42 am    Post subject: Reply with quote

I left the initrd blank because I embedded the initramfs into the kernel. Do I still need to put an initrd line? Here's the init script that I used: http://paste.pocoo.org/show/564053/
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Sun Mar 11, 2012 5:07 am    Post subject: Reply with quote

your init has no line to mount anything at /dev

ergo things like urandom, console, null, sda, arent going to be accessible

I see you unmounting it, but not mounting it. You *do* have devtmpfs support in the kernel, so all your missing is a line like this below your proc/sys mounts:

Code:

mount -t devtmpfs none /dev


put that into init at line 15, before your cryptsetup call, rebundle up the initramfs, and have another go

that's actually another good reason *not* to try and use an initramfs embedded into the kernel; pain in the ass having to rebuild the kernel every time you want to change something in your initramfs. Especially when you know your kernel is fine
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sun Mar 11, 2012 3:43 pm    Post subject: Reply with quote

I went with your advice and am now passing an image to the kernel instead, and when I recompiled the kernel I got rid of devtmpfs support and just populated it manually, hence the absence of the line. It's still saying "Failed to execute init -- no init found", despite my best efforts. I'm going to get on the livecd and repost the init script, menu.lst, and the output of ls -liaR.

edit:
ls -liaR /usr/src/initramfs/: http://paste.pocoo.org/show/564235/
/init: http://paste.pocoo.org/show/564233/
menu.lst: http://paste.pocoo.org/show/564234/

edit of the edit:I noticed that lvm isn't in sbin, I'm moving it there now. I doubt that this was the cause of the problem, though, because it's not finding the init.
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sun Mar 11, 2012 9:24 pm    Post subject: Reply with quote

*d'oh* turns out I didn't emerge busybox with USE=static. It boots now, but gives me the error "cannot open device /dev/sda4 for read-only access", which, from some simple googling, appears to be the result of unsupported hardware. I'll dig through my kernel config to see if I've left anything out; here's lspci -n:

Code:
00:00.0 0600: 8086:2a00 (rev 03)
00:01.0 0604: 8086:2a01 (rev 03)
00:1a.0 0c03: 8086:2834 (rev 04)
00:1a.1 0c03: 8086:2835 (rev 04)
00:1a.7 0c03: 8086:283a (rev 04)
00:1b.0 0403: 8086:284b (rev 04)
00:1c.0 0604: 8086:283f (rev 04)
00:1c.2 0604: 8086:2843 (rev 04)
00:1c.4 0604: 8086:2847 (rev 04)
00:1c.5 0604: 8086:2849 (rev 04)
00:1d.0 0c03: 8086:2830 (rev 04)
00:1d.1 0c03: 8086:2831 (rev 04)
00:1d.2 0c03: 8086:2832 (rev 04)
00:1d.7 0c03: 8086:2836 (rev 04)
00:1e.0 0604: 8086:2448 (rev f4)
00:1f.0 0601: 8086:2815 (rev 04)
00:1f.1 0101: 8086:2850 (rev 04)
00:1f.2 0101: 8086:2828 (rev 04)
00:1f.3 0c05: 8086:283e (rev 04)
01:00.0 0300: 10de:0407 (rev a1)
0b:00.0 0280: 14e4:4328 (rev 05)
0c:00.0 0200: 11ab:436a (rev 13)
0d:03.0 0c00: 104c:8025 (rev 02)


edit: Got it to work, but USB HID isn't supported (my laptop uses a USB keyboard), so I'm not able to type anything. I tried compiling full USB HID support into the kernel, but it wouldn't let me. Is there a way to do this so that I can actually type my password in? Thanks.
Back to top
View user's profile Send private message
jbiggs12
n00b
n00b


Joined: 09 Mar 2012
Posts: 27

PostPosted: Sun Mar 11, 2012 11:15 pm    Post subject: Reply with quote

I got it to work! :D I followed the instructions of the in-kernel component of this guide: http://forums.gentoo.org/viewtopic.php?t=79. Working now, although the kernel spits out a bunch of nonsense regarding the usb devices that I can probably just suppress with quiet. Thanks for your help with the initramfs guide, I really wouldn't have made it otherwise.
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4117
Location: Houston, Republic of Texas

PostPosted: Mon Mar 12, 2012 1:20 am    Post subject: Reply with quote

wicked. good feeling isnt it?

even better if over the course of fighting with it you figured out more or less how things piece together. which should make the next time you have to do this a bit easier (knock on wood)


thing is, all of these automated tools....if they work the first time out of the box, great, that's a major time saver. But when they dont, it can be a PITA trying to dig through them and troubleshoot. For example, if there's something wrong with the 'init' that you need to change, is it easier to spot in a 2,000 line automagic init that tries to account for every single possible different setup any human on the planet might use? Or is it easier to spot in a 20 line init that you made for your own hardware?

When you do things yourself, in somewhat of a minimalist fashion, there are only so many "moving parts", so youre only looking 5 or 6 different spots for where something might be broken.
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum