slashbeast / better-initramfs

Small and reliable initramfs solution supporting (remote) rescue shell, lvm, dmcrypt luks, software raid, tuxonice, uswsusp and more.

(∩ ͡° ͜ʖ ͡°)⊃━☆ﾟ. * ･ ｡ﾟ. *

better-initramfs's Issues

/dev/console missing with embedded initramfs

Following my issue related to missing nodes when initramfs is embedded into kernel.
I tried on my laptop, it is easier with a display.
My laptop (like my headless system) uses LUKS with askpass to unlock drive as usual.
Both are running kernel 5.10.74.

I added "sshd sshd_wait=10 sshd_port=43222 binit_net_if=eth0 binit_net_addr=192.168.1.14/24' to replicate what it is used on my headless system.

So, I tried with initramfs embedded into kernel and then, with initramfs passed to the bootloader. (grub)
Both examples uses freshly built better-initramfs (with the commit that removed mknod calls) so dev/ is empty in sourceroot.

With initramfs embedded into kernel :

Enter passphrase for /dev/sda1: rescueshelll / # sh: k: not found
#(typing ls blindly)
rescueshell / # VERSION functions.sh [..] root sys
#(typing cat /init.log blindly)
Executed: 'mkdir -m 700 -p /newroot'
Executed: 'mkdir -m 700 -p /sbin'
Executed: 'mkdir -m 700 -p /proc'
Executed: 'mkdir -m 700 -p /sys'
Executed: 'mkdir -m 700 -p /etc'
Executed: 'mkdir -m 700 -p /var/log'
Executed: 'mkdir -m 700 -p /var/run'
Executed: 'mkdir -m 700 -p /run'
Executed: 'mkdir -m 700 -p /run/cryptsetup'
Executed: 'dodir /dev /newroot /sbin /proc /sys /etc /var/log /var/run /run /run/cryptsetup'
Executed: 'mknod /dev/console c 5 1'
Executed: 'mknod /dev/null c 1 3'
Executed: 'mknod /dev/tty c 5 0'
Executed: 'mknod /dev/urandom c 1 9'
Executed: 'mknod /dev/random c 1 8'
Executed: 'mknod /dev/zero c 1 5'
Executed: 'mount -t proc proc /proc'
Executed: 'mount -t sysfs sysfs /sys'
Executed: '/bin/busybox --install -s'
Executed: 'mount -t devtmpfs -o nosuid,relatime,size=10240k,mode=755 devtmpfs /dev'
Executed: 'ip link set up dev lo'
Executed: 'ip link set up dev eth0'
Executed: 'ip addr add 192.168.1.14/24 dev eth0'
Executed: 'mkdir /dev/pts'
Executed: 'mount -t devpts none /dev/pts'
Executed: 'mkdir -m 700 -p /etc/dropbear'
Executed: 'mkdir -m 700 -p /var/log'
Executed: 'mkdir -m 700 -p /var/run'
Executed: 'mkdir -m 700 -p /root/.ssh'
Executed: 'dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key'
Executed: 'dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key'
Executed: 'echo root:x:0:0:root:/root:/bin/sh'
Executed: 'cp /authorized_keys /root/.ssh/authorized_keys'
Executed: 'dropbear -s -p 192.168.1.14:43222'
Executed: 'lvm vgchange -a y'
Executed: 'echo -e #!/bin/sh\nexit 0'
Executed: 'chmod 755 /sbin/udevadm'

As you can see, 'mkdir -m 700 -p /dev' is missing and it tries to create nodes after (???)

Executed: 'mknod /dev/console c 5 1'
Executed: 'mknod /dev/null c 1 3'
Executed: 'mknod /dev/tty c 5 0'
Executed: 'mknod /dev/urandom c 1 9'
Executed: 'mknod /dev/random c 1 8'
Executed: 'mknod /dev/zero c 1 5'

If the initramfs is not embedded then it works fine :

Executed: 'mkdir -m 700 -p /dev'
Executed: 'mkdir -m 700 -p /newroot'
Executed: 'mkdir -m 700 -p /sbin'
Executed: 'mkdir -m 700 -p /proc'
Executed: 'mkdir -m 700 -p /sys'
Executed: 'mkdir -m 700 -p /etc'
Executed: 'mkdir -m 700 -p /var/log'
Executed: 'mkdir -m 700 -p /var/run'
Executed: 'mkdir -m 700 -p /run'
Executed: 'mkdir -m 700 -p /run/cryptsetup'
Executed: 'dodir /dev /newroot /sbin /proc /sys /etc /var/log /var/run /run /run/cryptsetup'
Executed: 'mount -t proc proc /proc'
Executed: 'mount -t sysfs sysfs /sys'
Executed: '/bin/busybox --install -s'
Executed: 'mount -t devtmpfs -o nosuid,relatime,size=10240k,mode=755 devtmpfs /dev'
Executed: 'ip link set up dev lo'
Executed: 'ip link set up dev eth0'
Executed: 'ip addr add 192.168.1.14/24 dev eth0'
Executed: 'mkdir /dev/pts'
Executed: 'mount -t devpts none /dev/pts'
Executed: 'mkdir -m 700 -p /etc/dropbear'
Executed: 'mkdir -m 700 -p /var/log'
Executed: 'mkdir -m 700 -p /var/run'
Executed: 'mkdir -m 700 -p /root/.ssh'
Executed: 'dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key'
Executed: 'dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key'
Executed: 'echo root:x:0:0:root:/root:/bin/sh'
Executed: 'cp /authorized_keys /root/.ssh/authorized_keys'
Executed: 'dropbear -s -p 192.168.1.14:43222'
Executed: 'lvm vgchange -a y'
Executed: 'echo -e #!/bin/sh\nexit 0'
Executed: 'chmod 755 /sbin/udevadm'

As you can see, "Executed: 'mkdir -m 700 -p /dev'' is present this time, and I can unlock the drive by typing my password on the laptop or connecting remotely via ssh, unlock & resume-boot works fine.

For now, I solved it using your "old" function to generate the nodes in /usr/src/better-initramfs/dev before building the kernel in the embedded scenario.

INIT='/usr/src/better-initramfs'

relaxed_mknod() {
if ! [ -e "${INIT}/dev/$1" ]; then
  mknod "${INIT}/dev/$1" "$2" "$3" "$4" || exit
fi
}

relaxed_mknod console c 5 1
relaxed_mknod null c 1 3
relaxed_mknod tty c 5 0
relaxed_mknod urandom c 1 9
relaxed_mknod random c 1 8
relaxed_mknod zero c 1 5

I guess, console would be enough here but whatever.

Resume from Swap w/ BCACHE/LUKS/LVM

It doesn't work for me. I pointed the initramfs toward my swap partition via "resume=/dev/mapper/vg-swap". I can hibernate successfully but when I try resuming it just ends up rebooting everything.

serial terminals not supported in rescueshell

Hi.

Thanks for this package. Really nice start for making your own rescue minimal shell.

There are few gliteches though. First, most major, in my opinion is that you assume /dev/tty1 is the device that should be used for rescue shell. You forgot about headless server with serial terminal, where you pass to kernel for example console=ttyS1,115200. Without respecting that option, it's impossible to use rescue shell.

Those two fixes should do the trick:

in process_commandline_options():
            console\=*)
                console=$(get_opt $i)
                console="${console%,*}"
            ;;

and in rescueshell() before if [ -c '/dev/tty1' ]:

if [ "$console" -a -c "/dev/$console" ]; then
        setsid sh -c 'exec sh --login </dev/'$console' >/dev/'$console' 2>&1'
else
    ....

luks/lvm for /usr but not /

Is it possible to support /usr being stored in luks encrypted lvm2 pv but / being a plain partition or md raid1?

I tried specifying an enc_root= for the pv but without the root= being part of that there doesn't appear to be any attempt to open the luks.

At the rescueshell I can luksopen and pvscan then my /usr is mountable.

avahi/zeroconf support

I tried to get a static build of avahi working in the initramfs, but gave up about a year ago. How hard do you think it would be to add?

It doesn't have to be avahi, but I'd really like to be able to advertize an ssh unlock service being available.

Right now when I want to find locked machines on my local subnet, I do:

nmap -p2222 10.0.0.1-255 --open -oG - | awk '/2222\/open/{print $2}'

TuxOnIce and swapfile

Hello,

is it somehow possible to use better-initramfs with a swapfile and tuxonice?
The line of resume looks liks this :
tuxonice resume=file:UUID=xxx-xxx-xx:offsetxxx
The file is in /root/swapfile, but i get the information, that is not there with the following error:

resume: could not stat the resume device file

also tried

resume=file:/root/swapfile

Could i be, that i make some kind of error?
root is fully encrypted, i use the following grub line:

linux /kernel-4.4.8 enc_root=/dev/gnr/root lvm luks root=/dev/mapper/enc_root rootfstype=ext4 toi_initramfs_resume_only=1 tuxonice resume=file:UUID=xxx-xxx:offsetxxx

xxx =for short ;)

When i don't use tuxonice and everything else, it works like a charm.

It seems, that it's trying to encrypt the partition after everything else was parsed?

vlan 1.9 download fails / gone

See

Fetching vlan.1.9.tar.gz ...
--2015-04-02 02:23:08-- http://fossies.org/linux/misc/vlan.1.9.tar.gz
Auflösen des Hostnamen »fossies.org«... 78.46.58.28
Verbindungsaufbau zu fossies.org|78.46.58.28|:80... verbunden.
HTTP-Anforderung gesendet, warte auf Antwort... 410 Gone
2015-04-02 02:23:09 FEHLER 410: Gone.

Command 'wget http://fossies.org/linux/misc/vlan.1.9.tar.gz -O /usr/src/better-initramfs/bootstrap/distfiles/vlan.1.9.tar.gz.tmp' failed.
Build failed: 'vconfig'.

luks for multiple devices and ZFS support

hi,

it would be great if multiple luks devices were supported like decrypting /dev/sda2 and /dev/sdb2 with a keyfile on usb or /dev/sda1 and after that import the zfs volume (using both or more partitions)

any plans on this?

feature request: make `reboot` on rescue shell work

It would be great if reboot on the rescue shell worked, so I can, for example, reboot a failed boot attempt remotely, where I can't physically type ctrl-alt-del.

Right now, typing reboot fails with:

reboot: can't execute '/sbin/telinit': No such file or directory

I assume this is known, hence the message to press ctrl-alt-del?

zlib-1.2.6 no longer available

It seams that zlib version 1.2.6 is not longer available for download. Changing version to 1.2.7 works for me.

diff --git a/bootstrap/lebuilds/zlib.lebuild b/bootstrap/lebuilds/zlib.lebuild
index e4e668e..dd21c43 100755
--- a/bootstrap/lebuilds/zlib.lebuild
+++ b/bootstrap/lebuilds/zlib.lebuild
@@ -1,6 +1,6 @@
#!/bin/sh
name='zlib'
-version='1.2.6'
+version='1.2.7'
sources=( "http://zlib.net/${name}-${version}.tar.bz2" )
homepage="http://www.zlib.net/"
license='ZLIB'

Lvm on Luks on Bcache

Bcache devices don't get registered and I get dropped to rescue shell. Looking at your code, whatever is in /sys/block/* is NOT in the root of /dev. It only picks up "/dev/sdc", which is a thumb drive, while my backing volume is "/dev/sda2" and my caching volume is "/dev/sdb".

for i in $(ls /dev/sd*); do echo $i > /sys/fs/bcache/register_quiet; done

seems to work just fine so i'll try plugging that in for now and see what happens

A very cool project - PPA for ubuntu?

It's a really cool useful project, are you planning PPA for ubuntu by any chance?

CVE-2016-4484

Need to be fixed

Dropbear download failed

Command 'wget http://matt.ucc.asn.au/dropbear/releases/dropbear-2015.71.tar.bz2 -O /root/better-initramfs/bootstrap/distfiles/dropbear-2015.71.tar.bz2.tmp' failed.
Build failed: 'dropbear'.

Besides this, this is a very old Version...

feature request: dhcp timeout

Would be nice if I could configure a timeout for dhcp, so that it continues onwards even if I don't have an ethernet cable connected at the moment.

I just ran into this on my laptop, and as workaround, had to reboot and modify the parameters in grub. I guess as a semi-permanent workaround, I now need to add a second grub entry, but I'd prefer if I could just set a timeout to 60s or something.

need armv6 or Raspberry Pi support.

[root@mindcat-pi better-initramfs (master)]$ bootstrap/bootstrap-all 
>>> No arch specified. using 'armv6l'.
Looks like 'armv6l' is not supported. If the arch is valid consider reporting it upstream.
>>> init need arch argument, x86 or x86_64!
>>> No build_dir, forgot to /var/abs/local/better-initramfs/better-initramfs/bootstrap/lebuild init <arch>?

[root@mindcat-pi better-initramfs (master)]$ /var/abs/local/better-initramfs/better-initramfs/bootstrap/lebuild init armv6h
>>> init need arch argument, x86 or x86_64!
[root@mindcat-pi better-initramfs (master)]$ /var/abs/local/better-initramfs/better-initramfs/bootstrap/lebuild init armv6l
>>> init need arch argument, x86 or x86_64!

Wrong keyname in Readme

Hi Piotr,
You write in the Readme:

In order to use remote rescue shell you need to place your authorized_hosts file into sourceroot/ dir before you run make image.

But in the functions.sh script you are using "authorized_keys"; this name OpenSSH also uses. So the name "authorized_hosts" in readme is wrong.

Best regards,
Judge

Fail to build (/dev/null: Permission denied)

I type sudo make bootstrap-all, and this fails because of /dev/null: Permission denied. Any idea of what I am doing wrong?

https://gist.github.com/travankor/07f8bcaab21fbe17f852ab7b64e5ac8f

I'm not sure if it is permissions related.

[Travankor build_dir]$ ls -ld dev
drwxr-xr-x 2 travankor users 4096 Aug  3 20:35 dev
[Travankor build_dir]$ cd dev
[Travankor dev]$ ls -l 
total 0
crw-rw-rw- 1 root root 1, 3 Aug  3 20:35 null
crw-rw-rw- 1 root root 1, 8 Aug  3 20:35 random
crw-rw-rw- 1 root root 1, 9 Aug  3 20:35 urandom
crw-rw-rw- 1 root root 1, 5 Aug  3 20:35 zero

Can not connect to dropbear with OpenSSH 8.0p1

It might very well be my specific version of ssh on my laptop, but I can not connect to the version of dropbear that it is currently being built with.

ssh [email protected] -p 2222 -vv
	OpenSSH_8.0p1-PKIXSSH-12.1-hpn14v16, OpenSSL 1.0.2t  10 Sep 2019
	debug1: Can't process default engine config file: No such file or directory
	debug1: Reading configuration data /home/dequeued/.ssh/config
	debug1: /home/dequeued/.ssh/config line 18: Applying options for *
	debug1: Reading configuration data /etc/ssh/ssh_config
	debug1: ssh_set_validator: ignore responder url
	debug1: Connecting to 192.168.1.8 [192.168.1.8] port 2222.
	debug1: Connection established.
	debug1: Local version string SSH-2.0-OpenSSH_8.0p1-PKIXSSH-12.1-hpn14v16 PKIX[12.1]
	debug1: Remote protocol version 2.0, remote software version dropbear_2015.71
	debug1: no match: dropbear_2015.71
	debug1: x.509 compatibility rfc6187_missing_key_identifier=no: pattern '*' match 'dropbear_2015.71'
	debug1: x.509 compatibility rfc6187_asn1_opaque_ecdsa_signature=no: pattern '*' match 'dropbear_2015.71'
	debug1: x.509 compatibility broken list with accepted publickey algorithms=no: pattern '*' match 'dropbear_2015.71'
	debug1: Authenticating to 192.168.1.8:2222 as 'root'
	debug1: SSH2_MSG_KEXINIT sent
	debug1: SSH2_MSG_KEXINIT received
	debug1: AUTH STATE IS 0
	debug1: kex: algorithm: [email protected]
	debug1: kex: host key algorithm: ssh-rsa
	debug1: REQUESTED ENC.NAME is 'aes128-ctr'
	debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
	debug1: REQUESTED ENC.NAME is 'aes128-ctr'
	debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
	debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
	Connection closed by 192.168.1.8 port 2222

I have seen some suggestions, like changing the MTU or KexAlgorithm, but nothing has worked so far.

I did get it working by dropping in an updated dropbear version in https://github.com/unqueued/better-initramfs/blob/devel/bootstrap/lebuilds/dropbear.lebuild

With a newer release from here:
https://matt.ucc.asn.au/dropbear/releases/

Am still figuring out what exactly the problem is caused by, but maybe dropbear should be updated anyway?

luks_trim problems

Hi,

Whenever I try to boot better-initramfs with the luks_trim parameter enabled in my grub.conf, the better-initramfs cannot boot. The problem is that I get the following error:

cryptsetup --allow-discards luksOpen /dev/sda3 enc_root failed

cryptsetup unknown action

But if I run the same command in a rescue console, it works. I've even noticed that luksOpen doesn't asks me for a password, so I guess it's not waiting for the password but continuing nevertheless. But this only happes when I use luks_trim option. If I boot without that option, everything is OK.

luks-dmcrypt with (internal) keyfile not documented

With grub2 supporting luks-dmcrypt it is nowadays possible to have the linux kernel and initramfs inside the encrypted filesystem using a minimal boot partition without kernel and initramfs. This protects against certain attack vectors.

To prevent having to enter the password twice it then makes sense to include an internal keyfile inside the initramfs (remember: which resides safely on the encrypted volume). There is no documentation of how to do this with better-initramfs or which parameters to use for pointing it to the keyfile.

Btrfs support only partial

The initramfs supports mounting single-device btrfs partitions, however both /sbin/btrfs and /sbin/btrfsck are missing. Therefore it is not possible to do a "btrfs device scan" which is necessary for mounting multi-device (e.g. raid1 or any other more fancy configs) btrfs filesystems. So if your root does use btrfs' internal raid it cannot be mounted.
And in case anything has to be repaired there is no fsck for this filesystem. Dangerous...

Add support for DHCP configuration

Hello,

It would be nice if the binit_net_* network configuration supported DHCP configuration as an alternative to a static address.

I have a headless server configured with a static DHCP config, but currently I have to set the IP statically in better-initramfs to get the SSH console (for LUKS-unlocking).

Seems like busybox already has a built-in dhcp client, and a script (https://git.busybox.net/busybox/plain/examples/udhcp/simple.script) to react to events + some functions.sh code could do it.

Willing to contribute that, if you're interested in pulling it in.

ftp.kernel.org

Hello slash ! How you doing!? Hope very well !

util-linux-2.21.2.tar.bz2 is no longer available through ftp.kernel.org and the script need to be updated to

https://www.kernel.org/pub/linux/utils/util-linux/v2.21/util-linux-2.21.2.tar.bz2

Thanks

Multiple luks under one lvm

Not sure whether this a bug or feature request. I have a system with 3 partitions, each encrypted with LUKS, which are combined into a root with LVM, this allows me to resize my root and still have good encryption. I tried several methods, but as far as I can figure, I only can specify one enc_root, and LVM can't activate the volume group with only one third of the necessary partitions, so init chokes, and I had to manually run cryptsetup &etc. I ended up modifying InitializeLUKS() to open all three (hard coded values, atm).

Can't get rootflags to parse/be used

Hello,

I'm sure this is something silly i am doing or not doing but i can't seem to get the rootflags to work. I just over the weekend moved my root partition inside my luks encrypted btrfs partition but when i try to pass the subvol to mount it using rootflags it still only mounts the root of the btrfs partition and so it stops and i have to manually unmount /newroot and mount it again with the proper subvol.

Here is my kernel append line. I use syslinux as a boot loader

APPEND video=uvesafb:1280x1024-32,mtrr:3,ywrap sshd sshd_port=6969 binit_net_if=eth0 binit_net_addr=192.168.2.2/24 binit_net_gw=192.168.2.1 sshd_wait=20 luks enc_root=/dev/sda3 root=/dev/mapper/enc_root rootflags=subvol=/@rootfs,compress=lzo rw

is it an order thing? I've tried putting rootflags before the root declaration with same results. I've also tried using sobvolid instead of subvol. I've tried the name with the / and without.

GPG support ? (root_key & root_keydev)

Hi,
Would it be possible to add root_key & root_keydev parameter + GPG support ?
To be able to boot a vmlinuz kernel (with better-initramfs embedded into it) stored on an (unencrypted) USB key alongside a keyfile.gpg, which then unlocks the main drive. (LUKS)
At boot, better-initramfs would provide a prompt to decrypt the gpg key, similar to what it does with askpass & cryptsetup. (using something like : gpg --decrypt /mnt/usb/keyfile.gpg | run cryptsetup --keyfile=- luksOpen [...] )
Of course, the USB key would be need to be mounted on /mnt/usb before that, using root_keydev to grab the UUID and root_key to avoid hardcoding "keyfile.gpg" in the init file and allow to pass the keyfile name as a parameter.

Similar to what sakaki achieved here : https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Preparing_the_LUKS-LVM_Filesystem_and_Boot_USB_Key#Creating_a_Password-Protected_Keyfile_for_LUKS

sakaki recommends gnupg 1.4.x ("latest" being 1.4.23, which compiles fine on musl for information, I tried with sakaki's staticgpg ebuild bumped to 1.4.23 on a gentoo musl vm) :
"Unfortunately, the version of gpg that is emerged by Portage by default is the 2.x variant. This requires a (rather convoluted) service known as pinentry to ask you for your password (even when compiled statically), and currently genkernel's initramfs builder (and init script) does not work correctly with it. Instead, genkernel expects to be using a version 1.x gpg which can query for passphrases itself, without invoking an outside agent."

(this might be old info, maybe it is possible to use latest gnupg instead now, I don't know)

https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Building_the_Gentoo_Base_System_Minus_Kernel
https://github.com/sakaki-/sakaki-tools/blob/master/app-crypt/staticgpg/staticgpg-1.4.16-r1.ebuild

Thanks. (using better-initramfs for more than a year now, really nice!)

better-initramfs update ?

Hello,
Are you planning to update better-initramfs? There are a couple of updates available since last release.
Only one without update being vconfig if I'm correct.

alpine 3.14.2 > 3.17.2

busybox 1.33.1 > 1.34.1
cryptsetup 2.4.0 > 2.4.3
dropbear 2020.81 > 2022.83
json-c 0.15 > 0.16
libaio 0.3.112 > 0.3.113
libblkid 2.37 > 2.38.1
libgcrypt 1.8.8 > 1.10.1
libgpg-error 1.42 > 1.46
libuuid 2.37 > 2.38.1
lvm2 2.02.188 > 2.03.19
mdadm 4.1 > 4.2
popt 1.18 > 1.19
zlib 1.2.11 > 1.2.13

Thanks!
Cheers

Support for fsck of separate /usr

Apparently some (maybe all) distros that are now requiring an initramfs to provide /usr before init loads expect the initramfs to handle the fsck of /usr. In fact unlike / e2fsck will refuse to fsck a read only mounted /usr

So, essentially, anyone using this initramfs to get /usr pre-mounted can't fsck their /usr without booting from some live environment.

Personally, I would like to see e2fsprogs get modified to allow the fsck of a read only mounted /usr but they appear to have taken down their bug report/feature request link so I am asking here :(

lvm can't find my volumes

I have a simple lvm structure on my disk: one pm, one vg, some lv's, no raid, no luks.
I'm on gentoo (funtoo, actually). When booting with the initrd automatically built with genkernel, everything is fine, but with better-initramfs, I get the "Unable to mount '/newroot'" error.
From the rescue shell, "lvm vgscan" doesn't find anything, neither "pmscan" nor "lvscan".
I realize I'm not giving you much info, but I don't know what else to check.

Support thin-provisioning lvm volumes

I think it required thin-provisioning-tools, for vgchange -ay success.

Splash support

It would be good to have the ability to use splash with better-initramfs.

[Q] Include additional kernel modules

How can i include additional kernel modules? For example the nvidia module.
All monitors are connect to one nvidia graphic card. So it would be nice to include this module in my initramfs image.