search

lkrg-org / lkrg

Linux Kernel Runtime Guard
https://lkrg.org
Other
404 stars 72 forks source link

CI: mkosi: Restore loading LKRG module from initrd #229

Closed vt-alt closed 1 year ago

vt-alt commented 1 year ago

For (non-grub) BLS boot - install generated by Dracut initrd into systemd-boot loader entry.

Man pages for curious details: systemd-boot(7), bootctl(1), kernel-install(8).

Link: https://github.com/lkrg-org/lkrg/pull/228#issuecomment-1235403740 Fixes: db42541 ("CI: mkosi: Do not assume grub is installed")

Only tested locally before push.

Using kernel-install is somewhat low-level'ish but it seems there's no more generic way.

ps. Curiously, this took 3 hours to investigate, produce best solution, and test.

vt-alt commented 1 year ago

OK this is only worked for mainline kernel test, but isn't for Ubuntu releases. ~Please do not merge yet.~

vt-alt commented 1 year ago

I suspect calling bootctl is not reliable in mkosi.postinst stage on Ubuntu older than kinetic, so I replaced it with other check. And there is no -v in kernel-install on bionic. Can be merged if all turns green.

ps. +1 hour.

solardiz commented 1 year ago

Thank you, @vt-alt!

The boot logs look good to me now.

One thing I don't get from reading your comments here and in the code: was there any issue with --force-drivers lkrg, what issue, or why else are we avoiding the need for this option now?

Anyway, I'll merge this now. Thanks again.

vt-alt commented 1 year ago

There is no issue with the option in the last version of PR, so this could be removed.

Intermediate versions used initrd rebuild by other methods which required adding force_drivers+= to dracut.conf.

But I thought it will be OK to keep dracut.conf method as more exemplary — in case someone take it as example of how to load LKRG in intrd (for their normal systems). (Perhaps, there is much overthinking on my part.) I did not find proper method of how to regenerate initrd now (for uefi). Before you just run 1 command — dracut -f (or even dracut with particular kernel version like we run) — but now this is not enough as initrd needs to additionally installed into BLS boot entry, so kernel-install needs to be run somehow too. Mkosi authors worked this around by running dpkg-reconfigure dracut, which (via hooks run dracut and kernel-install but) does not let any options pass into dracut.

vt-alt commented 1 year ago

(Additionally) Another 'generic' method is to run kernel-install without passing last argument with initrd filename. This would trigger dracut run to [re]generate it (initrd).