List Info

Thread: Re: Cryptsetup with sata drive and cryptoroot




Re: Cryptsetup with sata drive and cryptoroot
user name
2007-02-07 05:50:13
Scott, Ian,

After reading and chatting with Scott in IRC, it seems that
the below
patch should not be necessary anymore. Could you please
comment on the
patch below? How does this integrate into
https://wik
i.ubuntu.com/UdevDeviceMapper?

What changes should be done on the cryptsetup side so that
booting
From=20a crypted rootfs becomes possible?=20

What happens if that rootfs is on an lvm on raid?

Ilkka Tuohela <hileiki.fi> writes:

> ti, 2007-02-06 kello 20:55 +0100, Reinhard Tartler
kirjoitti:
>> Ilkka Tuohela <hileiki.fi> writes:
>>=20
>> > I already have posted a bug with patch for
this, but since it has not=
=20
>> > appeared in the package for 3 months I think
it's lost so I'll contact
>> > you directly.
>>=20
>> Thank you very much for your patch, I think you did
the right thing to
>> contact us both. Could you please tell us the bugno
of the bug you refer
>> in this context?
>
> This fix should close ubuntu bugs 21878 and 82071 for
feisty.
>
> https://bugs.launchpad.net/ubuntu/+source/cryptse
tup/+bug/21878
> https://bugs.launchpad.net/ubuntu/+source/cryptse
tup/+bug/82071
>
>> Your patch seems to solve
>> https://bugs.launchpad.net/ubuntu/+source/mdadm/+bug/7
5681 for root on
>> cryptsetup. Since it seems to be the same problem,
would it be possible
>> to solve it in the same place? Does the same
problems exist in debian as
>> well?
>
> I don't think so, because the mdadm script is not
expecting the device
> we are looking for. It's the lvm script which should do
this, and does,
> it just does not understand LUKS nodes.
>
> As I said, my loops are directly copied from LVM
scripts, and when we
> execute the lvm scripts, the commands will go though
without problems.=20
> The reason we can't expect lvm script to handle this,
is that LVM will=20
> hang the boot process for the length of the testing
loop.=20
>
> Current way it 'works'
> - lvm script executes and expects to find LVM from the
root=3D parameter,
>   the device is encrypted so it isn't valid and loop
continues until
>   the it expires in 3 minutes
> - after this cryptsetup script will find the root
device just fine, if=20
>   it is executed after lvm script, since lvm script
took care of getting
>   the device online
>
> So, kind of chicken and egg stuff - if lvm script does
the device
> detection, it takes long time, and if cryptsetup script
is before=20
> lvm script, it has to wait for device.
>
> Anyway, my loop is usually safe because it does return
quickly if=20
> the device node appears normally (within couple of
seconds). If you
> configure nonexisting root device, it hangs for 3
minutes, but I don't
> see this as a big problem...


Patch following here:

=2D--
/usr/share/initramfs-tools/scripts/local-top/cryptroot	2007-
01-27 14:=
36:12.000000000 +0300
+++
usr/share/initramfs-tools/scripts/local-top/cryptroot	2006-1
2-15 10:18:=
09.000000000 +0300
 -8,7
+8,7 
 	# Make sure that cryptroot is run last in local-top
 	for req in /scripts/local-top/*; do
 		script=3D$(basename $req)
=2D		if [ $script !=3D cryptroot ]; then
+		if [ $script !=3D cryptroot -a $script !=3D lvm ]; then
 			echo $script
 		fi
 	done
 -110,7
+110,14 
 	# Reduce padded --'s to -'s
 	vg=3D$(echo $ | sed -e 's#--#-#g')
=20
=2D	vgchange -ay $
+	slumber=3D360
+	while [ $ -gt 0 -a ! -d "/dev/$" ];
do
+  		lvm pvscan > /dev/null 2>&1
+  		lvm vgchange -ay $ > /dev/null 2>&1
+  		/bin/sleep 0.5
+  		slumber=3D$(( $ - 1 ))
+	done
+
 	return $?
 }
=20
 -156,6
+163,12 
 		activate_vg $cryptsource
 	fi
=20
+	slumber=3D360
+	while [ $ -gt 0 -a ! -r "$cryptsource"
]; do
+  		slumber=3D$(( $ - 1 ))
+		/bin/sleep 0.5
+	done
+
 	if [ ! -e $cryptsource ]; then
 		echo "cryptsetup: Source device $cryptsource not
found"
 		return 1


=2D-=20
Gruesse/greetings,
Reinhard Tartler, KeyID 945348A4

-- 
ubuntu-devel mailing list
ubuntu-devellists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel


Re: Cryptsetup with sata drive and cryptoroot
user name
2007-02-07 11:44:37
Reinhard Tartler writes ("Re: Cryptsetup with sata
drive and cryptoroot"):
> After reading and chatting with Scott in IRC, it seems
that the below
> patch should not be necessary anymore. Could you please
comment on the
> patch below? How does this integrate into
> https://wik
i.ubuntu.com/UdevDeviceMapper?

It should indeed no longer be necessary to do any messing
about with
lvm (or anything else) in your script.  We now have
arrangements to do
the right thing from udev on device detection.

However it would be better if your cryptsetup could run out
of udev as
well.  Since only one program can take this looping
approach, you may
run into difficulties if some other kind of weird block
device is
also involved in booting.

Ian.

-- 
ubuntu-devel mailing list
ubuntu-devellists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel


Re: Cryptsetup with sata drive and cryptoroot
country flaguser name
Saudi Arabia
2007-03-26 00:23:10
Reinhard Tartler kirjoitti:
> Scott, Ian,
> 
> After reading and chatting with Scott in IRC, it seems
that the below
> patch should not be necessary anymore. Could you please
comment on the
> patch below? How does this integrate into
> https://wik
i.ubuntu.com/UdevDeviceMapper?

So what's status of including my small patches for feisty
package?

I'm talking about:
- patch to wait for the crypto device to appear (not LVM),
this patch
  also cleaned up anything LVM and EVMS-related parts from
the scripts
- patch to add documentation of LVMROOT-ON-LUKS to the
README in package

I have been running my own, patched version with the first
patch since
we last talked about this, and it's working just perfectly.
The patch
for waiting for device to appear is really required, as long
as we don't
change whole cryptsetup package to asynchronous one, which
does not seem
feasible to do with feisty (no way to handle asynchronous
scripts with
input from user). Without the device waiting patch you just
don't get a
working system in many cases, because the cryptsetup script
is executed
before kernel has the devices ready.

I would love to see completely asynchornous cryptsetup
handling, but we
really should fix the waiting problem NOW, not waiting for
someone to
actually implement required asynchornous input tasks.

Oh, btw, same 'wait for root device' problem exists in edgy
as well, and
same 'wait for device' fix works there. The maximum wait
time is maybe
silly (360*0.5 seconds, i.e. 3 minutes), I think maximum of
30 seconds
should be really fine.

	*hile*

-- 
ubuntu-devel mailing list
ubuntu-devellists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel


[1-3]

about | contact  Other archives ( Real Estate discussion Medical topics )