libpriv/kernel: add cap_mknod to dracut run #1946
Conversation
A lot of history with this. But essentially, dracut tries to `mknod` a few character devices like `/dev/random` and `/dev/urandom` and fails. We originally blocked `cap_mknod` because, well, `%post` scripts don't really need to do that, and it would get wiped anyway. But there is a use case for dracut's CPIO: we want `/dev/*random` to be available in early boot *before* systemd even mounts `devtmpfs` because libgcrypt as part of its constructor-time selftests in FIPS mode wants to read from there. For more fun, see: https://bugzilla.redhat.com/show_bug.cgi?id=1778940 https://bugzilla.redhat.com/show_bug.cgi?id=1401444 https://bugzilla.redhat.com/show_bug.cgi?id=1380866
|
This is OK by me, but I think it would be better to have dracut instead directly write the device files to the CPIO archive. Then no additional privileges are required. |
So... I briefly considered pulling out libarchive to do just this. But yeah, would be much nicer if we could bake that into dracut itself. |
|
/approve Seems like the easiest way forward |
|
bot, retest this please |
2 similar comments
|
bot, retest this please |
|
bot, retest this please |
|
The Jenkins one is due to coreos/fedora-coreos-config#248. |
|
OK, I'm thinking... let's just override the failures and get this in? Something is up with OpenStack giving slow I/O but |
|
/override f29-compose1 |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cgwalters, jlebon, miabbott The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@cgwalters: Overrode contexts on behalf of cgwalters: f29-compose1, f29-compose2, f29-primary In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
I'm getting failing-to-boot RHCOS images built from my toolbox env running rootless because dracut still can't mknod; and neither can I do so manually. I haven't fully traced through but I'm pretty sure there's just no way to make device nodes in rootless. The only way this is working for RHCOS today is because we run with full privileges in the build. IOW I think we really do need to teach dracut to synthesize the cpio bits directly. Or we hack it in here. |
|
OK yup, let's track this in an issue: #1950 |
A lot of history with this. But essentially, dracut tries to
mknodafew character devices like
/dev/randomand/dev/urandomand fails.We originally blocked
cap_mknodbecause, well,%postscripts don'treally need to do that, and it would get wiped anyway. But there is a
use case for dracut's CPIO: we want
/dev/*randomto be available inearly boot before systemd even mounts
devtmpfsbecause libgcrypt aspart of its constructor-time selftests in FIPS mode wants to read from
there.
For more fun, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1778940
https://bugzilla.redhat.com/show_bug.cgi?id=1401444
https://bugzilla.redhat.com/show_bug.cgi?id=1380866