Merge pull request #1351 from anderbubble/dracut-boot-refinement

Dracut boot refinement

CHANGELOG.md

@@ -49,6 +49,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Add `:cow` suffix to `wwctl container exec --bind` to temporarily copy files into the node image. #1365
 - Add `:copy` suffix to `wwctl container exec --bind` to temporarily copy files into the node image. #1365
 
+### Fixed
+
+- Fix dracut booting with secure mode. #1261
+
 ### Changed
 
 - Added a link to an example SELinux-enabled node image in documentation. #1305

CONTRIBUTORS.md

@@ -36,3 +36,4 @@
 * Shane Nehring <snehring@iastate.edu>
 * Tobias Ribizel <mail@ribizel.de>
 * Tobias Poschwatta <poschwatta@zib.de>
+* Josh Burks <jeburks2@asu.edu>

dracut/modules.d/90wwinit/load-wwinit.sh

@@ -8,6 +8,13 @@ do
     if [ -n "${archive}" ]
     then
         info "Loading ${archive}"
-        (curl --silent -L "${archive}" | gzip -d | cpio -im --directory="${NEWROOT}") || die "Unable to load ${archive}"
+        # Load runtime overlay from a static privledged port.
+        # Others use default settings.
+        localport=""
+        if [[ "${archive}" == "${wwinit_runtime}" ]]
+        then
+            localport="--local-port 1-1023"
+        fi
+        (curl --silent ${localport} -L "${archive}" | gzip -d | cpio -im --directory="${NEWROOT}") || die "Unable to load ${archive}"
     fi
 done

dracut/modules.d/90wwinit/module-setup.sh

@@ -14,7 +14,7 @@ depends() {
 }
 
 install() {
-    inst_multiple cpio curl
+    inst_multiple cpio curl dmidecode
     inst_hook cmdline 30 "$moddir/parse-wwinit.sh"
     inst_hook pre-mount 30 "$moddir/load-wwinit.sh"
 }

dracut/modules.d/90wwinit/parse-wwinit.sh

@@ -6,10 +6,16 @@
 if [ "${root}" = "wwinit" ]
 then
     info "root=${root}"
-    export wwinit_container=$(getarg wwinit.container=); info "wwinit.container=${wwinit_container}"
-    export wwinit_system=$(getarg wwinit.system=); info "wwinit.system=${wwinit_system}"
-    export wwinit_runtime=$(getarg wwinit.runtime=); info "wwinit.runtime=${wwinit_runtime}"
-    export wwinit_kmods=$(getarg wwinit.kmods=); info "wwinit.kmods=${wwinit_kmods}"
+    uuid=$(dmidecode -s system-uuid)
+    assetkey=$(dmidecode -s chassis-asset-tag | sed -E -e 's/(^ +| +$)//g' -e 's/^(Unknown|Not Specified)$//g' -e 's/ /_/g')
+    wwinit_uri="$(getarg wwinit.uri)?assetkey=${assetkey}&uuid=${uuid}"
+    export wwinit_container="${wwinit_uri}&stage=container&compress=gz"; info "wwinit_container=${wwinit_container}"
+    export wwinit_system="${wwinit_uri}&stage=system&compress=gz"; info "wwinit_system=${wwinit_system}"
+    export wwinit_runtime="${wwinit_uri}&stage=runtime&compress=gz"; info "wwinit_runtime=${wwinit_runtime}"
+    if [ -n "$(getarg wwinit.KernelOverride)" ]
+    then
+        export wwinit_kmods="${wwinit_uri}&stage=kmods&compress=gz"; info "wwinit_kmods=${wwinit_kmods}"
+    fi
 
     wwinit_tmpfs_size=$(getarg wwinit.tmpfs.size=)
     if [ -n "$wwinit_tmpfs_size" ]

etc/grub/grub.cfg.ww

@@ -42,10 +42,7 @@ menuentry "Network boot node: {{.Id}}" --id ww4 {
 menuentry "Network boot node with dracut: {{.Id}}" --id dracut {
     initramfs="${uri}&stage=initramfs"
 
-    uri="http://{{.Ipaddr}}:{{.Port}}/provision/${net_default_mac}?assetkey=${assetkey}"
-    container="${uri}&stage=container&compress=gz"
-    system="${uri}&stage=system&compress=gz"
-    runtime="${uri}&stage=runtime&compress=gz"
+    wwinit_uri="http://{{.Ipaddr}}:{{.Port}}/provision/${net_default_mac}"
 
     {{if .KernelOverride }}
     echo "Kernel:                {{.KernelOverride}}"
@@ -55,7 +52,7 @@ menuentry "Network boot node with dracut: {{.Id}}" --id dracut {
     echo "KernelArgs:            {{.KernelArgs}}"
 
     net_args="rd.neednet=1 {{range $devname, $netdev := .NetDevs}}{{if and $netdev.Hwaddr $netdev.Device}} ifname={{$netdev.Device}}:{{$netdev.Hwaddr}} {{end}}{{end}}"
-    wwinit_args="root=wwinit wwinit.container=${container} wwinit.system=${system} wwinit.runtime=${runtime} init=/init"
+    wwinit_args="root=wwinit wwinit.uri=${wwinit_uri}"
     linux $kernel wwid=${net_default_mac} {{.KernelArgs}} $net_args $wwinit_args
 
     if [ x$? = x0 ] ; then

etc/ipxe/dracut.ipxe

@@ -13,7 +13,8 @@ echo Kernel:        {{.ContainerName}} (container default)
 echo KernelArgs:    {{.KernelArgs}}
 echo
 
-set uri http://{{.Ipaddr}}:{{.Port}}/provision/{{.Hwaddr}}?assetkey=${asset}&uuid=${uuid}
+set baseuri http://{{.Ipaddr}}:{{.Port}}/provision/{{.Hwaddr}}
+set uri ${baseuri}?assetkey=${asset}&uuid=${uuid}
 echo Warewulf Controller: {{.Ipaddr}}
 
 echo Downloading Kernel Image:
@@ -29,7 +30,7 @@ echo Downloading initramfs
 initrd --name initramfs ${uri}&stage=initramfs || goto reboot
 
 set dracut_net rd.neednet=1 {{range $devname, $netdev := .NetDevs}}{{if and $netdev.Hwaddr $netdev.Device}} ifname={{$netdev.Device}}:{{$netdev.Hwaddr}} {{end}}{{end}}
-set dracut_wwinit root=wwinit wwinit.container=${uri}&stage=container&compress=gz wwinit.system=${uri}&stage=system&compress=gz wwinit.runtime=${uri}&stage=runtime&compress=gz {{if ne .KernelOverride ""}}wwinit.kmods=${uri}&stage=kmods&compress=gz{{end}} init=/init
+set dracut_wwinit root=wwinit wwinit.uri=${baseuri} {{if ne .KernelOverride ""}}wwinit.KernelOverride={{ .KernelOverride }}{{end}} init=/init
 
 echo Booting initramfs
 #echo Network KernelArgs: ${dracut_net}
@@ -52,4 +53,4 @@ echo  Rebooting in 30s.
 echo ================================================================================
 sleep 30
 reboot
-{{ end }}
+{{ end }}

warewulf.spec.in

@@ -93,6 +93,9 @@ Requires: dracut
 %else
 Requires: dracut-network
 %endif
+Requires: curl
+Requires: cpio
+Requires: dmidecode
 
 %description dracut
 Warewulf is a stateless and diskless container operating system provisioning
@@ -217,6 +220,9 @@ getent group %{wwgroup} >/dev/null || groupadd -r %{wwgroup}
 
 
 %changelog
+* Tue Jun 18 2024 Josh Burks <jeburks2@asu.edu>
+- Add curl, cpio, and dracut as requires for warewulf-dracut
+
 * Thu Apr 18 2024 Jonathon Anderson <janderson@ciq.com>
 - New warewulf-dracut subpackage