Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

luks: enable debugging in clevis scripts when rd.debug is set #340

Merged
merged 1 commit into from
Oct 27, 2021
Merged

luks: enable debugging in clevis scripts when rd.debug is set #340

merged 1 commit into from
Oct 27, 2021

Conversation

rmetrich
Copy link
Contributor

On Fedora/RHEL, the rd.debug kernel command line parameter controls debugging.
By implementing the functionality inside clevis, troubleshooting will be greatly eased.
See RHBZ #1980742.

@rmetrich
luks: enable debugging in clevis scripts when rd.debug is set
8fe2c19 
On Fedora/RHEL, the rd.debug kernel command line parameter controls
debugging.
By implementing the functionality inside clevis, troubleshooting will be
greatly eased.
See RHBZ #1980742 (https://bugzilla.redhat.com/show_bug.cgi?id=1980742).
@rmetrich
Copy link
Contributor Author

Verified by booting a patched RHEL8.4 initramfs with "rd.debug".
We then get debug statements:

Oct 21 16:12:45 vm-tpm84-latest clevis-luks-askpass[577]: ///usr/bin/clevis-luks-common-functions@336(clevis_luks_unlock_device_by_slot): jwe=
Oct 21 16:12:45 vm-tpm84-latest clevis-luks-askpass[577]: ///usr/bin/clevis-luks-common-functions@338(clevis_luks_unlock_device_by_slot): return 1
Oct 21 16:12:45 vm-tpm84-latest clevis-luks-askpass[577]: //usr/bin/clevis-luks-common-functions@364(clevis_luks_unlock_device): pt=
Oct 21 16:12:45 vm-tpm84-latest clevis-luks-askpass[577]: //usr/bin/clevis-luks-common-functions@366(clevis_luks_unlock_device): continue
Oct 21 16:12:45 vm-tpm84-latest clevis-luks-askpass[577]: //usr/bin/clevis-luks-common-functions@363(clevis_luks_unlock_device): for slt in ${used_slots}
...

@sergio-correia sergio-correia merged commit 8c9e020 into latchset:master Oct 27, 2021
rmetrich added a commit to rmetrich/dracut that referenced this pull request Jan 6, 2022
@rmetrich
fix(dracut): be more robust when using 'set -u'
8fda4fd 
From bash manpage, FUNCNAME exists only inside functions. When in debug
mode, make sure to use an empty default value as FUNCNAME[0] when
outside of functions.

With bash4 this wasn't an issue, but is with bash5 with hardening option
'set -u' used, as shown in the example below:

Incorrect:

$ bash -u -c 'echo -n ${FUNCNAME[0]}'
bash: line 1: FUNCNAME[0]: unbound variable
$

Correct:

$ bash -u -c 'echo -n ${FUNCNAME[0]-}'
$

This hardening enables sourcing dracut-lib.sh from external utilities
executing in the initramfs such as clevis-luks-askpass, which uses
hardening option 'set -u' internally.
(see Clevis PR latchset/clevis#340)

Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
@rmetrich rmetrich mentioned this pull request Jan 6, 2022
Merged
1 task
johannbg pushed a commit to dracutdevs/dracut that referenced this pull request Feb 4, 2022
@rmetrich @johannbg
fix(dracut): be more robust when using 'set -u'
22a8062 
From bash manpage, FUNCNAME exists only inside functions. When in debug
mode, make sure to use an empty default value as FUNCNAME[0] when
outside of functions.

With bash4 this wasn't an issue, but is with bash5 with hardening option
'set -u' used, as shown in the example below:

Incorrect:

$ bash -u -c 'echo -n ${FUNCNAME[0]}'
bash: line 1: FUNCNAME[0]: unbound variable
$

Correct:

$ bash -u -c 'echo -n ${FUNCNAME[0]-}'
$

This hardening enables sourcing dracut-lib.sh from external utilities
executing in the initramfs such as clevis-luks-askpass, which uses
hardening option 'set -u' internally.
(see Clevis PR latchset/clevis#340)

Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
systemd-rhel-bot pushed a commit to systemd-rhel-bot/dracut-rhel9 that referenced this pull request Feb 9, 2022
@rmetrich @lnykryn
fix(dracut): be more robust when using 'set -u'
bfc19ee 
From bash manpage, FUNCNAME exists only inside functions. When in debug
mode, make sure to use an empty default value as FUNCNAME[0] when
outside of functions.

With bash4 this wasn't an issue, but is with bash5 with hardening option
'set -u' used, as shown in the example below:

Incorrect:

$ bash -u -c 'echo -n ${FUNCNAME[0]}'
bash: line 1: FUNCNAME[0]: unbound variable
$

Correct:

$ bash -u -c 'echo -n ${FUNCNAME[0]-}'
$

This hardening enables sourcing dracut-lib.sh from external utilities
executing in the initramfs such as clevis-luks-askpass, which uses
hardening option 'set -u' internally.
(see Clevis PR latchset/clevis#340)

Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
(cherry picked from commit 22a8062)

Resolves: #2037897
systemd-rhel-bot pushed a commit to systemd-rhel-bot/dracut-rhel9 that referenced this pull request Feb 9, 2022
@rmetrich @lnykryn
fix(dracut): be more robust when using 'set -u'
c280583 
From bash manpage, FUNCNAME exists only inside functions. When in debug
mode, make sure to use an empty default value as FUNCNAME[0] when
outside of functions.

With bash4 this wasn't an issue, but is with bash5 with hardening option
'set -u' used, as shown in the example below:

Incorrect:

$ bash -u -c 'echo -n ${FUNCNAME[0]}'
bash: line 1: FUNCNAME[0]: unbound variable
$

Correct:

$ bash -u -c 'echo -n ${FUNCNAME[0]-}'
$

This hardening enables sourcing dracut-lib.sh from external utilities
executing in the initramfs such as clevis-luks-askpass, which uses
hardening option 'set -u' internally.
(see Clevis PR latchset/clevis#340)

Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
(cherry picked from commit 22a8062)

Resolves: #2037897
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sergio-correia sergio-correia sergio-correia approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@rmetrich @sergio-correia