Skip to content

Commit

Permalink
dracut: drop rd.neednet=1 injection
Browse files Browse the repository at this point in the history
By default, dracut builds generic initrds which by design shouldn't have
any configuration specific to a host baked in (as opposed to so-called
"hostonly" initrds). This property is leveraged with great success in
immutable hosts like Fedora CoreOS and its downstream RHCOS where the
initrd is created server-side.

By unconditionally injecting `rd.neednet=1`, the clevis-pin-tang dracut
module makes it impossible to be included into a truly generic initrd,
where one cannot make assumptions about the network (or lack thereof,
see latchset#54) of the target hosts.

So with a generic initrd, how can we make sure that networking is up at
initrd time on a host which has been configured with root-on-LUKS with a
Tang pin? By also configuring it with `rd.neednet=1` specified on the
kernel command-line, and possibly `ip=...` to configure the network
interfaces.

This is no different from root-on-{NFS,iSCSI,NBD,...}, where one must
use explicit kernel arguments like `root=nfs:<server>:...` or
`root=iscsi:<server>:...` or `root=nbd:<server>:...`, all of which imply
`rd.neednet=1` (one could imagine then a `root=tang:<luks2_uuid>` type
karg in the future which would be roughly equivalent to
`root=UUID=<luks2_uuid> rd.neednet=1`).

Dracut also allows one to build host-specific initrds using the
`-H`/`--hostonly` option, and further the ability to bake the
command-line arguments when `--hostonly-cmdline` is provided.

So a supplementary approach here would be for `install()` to only inject
`rd.neednet=1` if using `--hostonly-cmdline` *and* somewhere along the
root block device hierarchy, there is a Tang-pinned LUKS device. This is
also analogous to what other dracut modules like 95nfs and 95iscsi do.

However, optimizations for host-only initrds should not come before
getting correct support for generic initrds.

Closes: latchset#54
Closes: latchset#206
  • Loading branch information
jlebon committed Jul 2, 2020
1 parent 088be96 commit 8e35e69
Showing 1 changed file with 0 additions and 6 deletions.
6 changes: 0 additions & 6 deletions src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,7 @@ depends() {
return 0
}

cmdline() {
echo "rd.neednet=1"
}

install() {
cmdline > "${initdir}/etc/cmdline.d/99clevis-pin-tang.conf"

inst_multiple \
clevis-decrypt-tang \
curl
Expand Down

0 comments on commit 8e35e69

Please sign in to comment.