[PATCH] Relax restriction of dumping on encrypted target

[Arthur Zou]

Resolve: bz1053045

Description:
Currently kdumpctl will fail to create kdump initramfs and start
kdump service while dump target is encrypted. This restriction is
too strict.

Resolution:
Just warn user that encrypted device is in dump path and second
kernel will wait on console for password to be entered.

Signed-off-by: arthur 
---
 mkdumprd | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/mkdumprd b/mkdumprd
index bc002bc..c7dfa9c 100644
--- a/mkdumprd
+++ b/mkdumprd
@@ -467,7 +467,7 @@ is_crypt()
     eval "$line"
     [[ "$ID_FS_TYPE" = "crypto_LUKS" ]] && {
         dev=$(udevadm info --query=all --path=/sys/dev/block/$majmin | awk -F= '/DEVNAME/{print $2}')
-        perror "Device $dev is encrypted, can not be used in kdump."
+        echo "Warning: Target device $dev is encrypted."
         return 0
     }
     return 1
@@ -482,18 +482,11 @@ check_crypt()

[ $_ret -eq 0 ] && return

-    if [ $_ret -eq 1 ]; then
-        _target=$(get_block_dump_target)
-        perror "Can not save vmcore to target device $_target."
-    elif [ $_ret -eq 2 ]; then
-        perror "Default action is dump_to_rootfs but can not save vmcore to root device."
-    fi
-
     return 1
 }

if ! check_crypt; then
-    exit 1
+    echo "Warning: Encrypted device is in dump path and capture kernel will wait on console for password to be entered."
 fi

# firstly get right SSH_KEY_LOCATION

[Vivek Goyal]

On Mon, Feb 17, 2014 at 07:40:19PM +0800, arthur wrote:
> Resolve: bz1053045
>
> Description:
> Currently kdumpctl will fail to create kdump initramfs and start
> kdump service while dump target is encrypted. This restriction is
> too strict.
>
> Resolution:
> Just warn user that encrypted device is in dump path and second
> kernel will wait on console for password to be entered.
> Signed-off-by: arthur
>
> mkdumprd | 11 ++---------
>  1 file changed, 2 insertions(+), 9 deletions(-)
>
> diff --git a/mkdumprd b/mkdumprd
> index bc002bc..c7dfa9c 100644
> --- a/mkdumprd
> +++ b/mkdumprd
> @@ -467,7 +467,7 @@ is_crypt()
>      eval "$line"
>      [[ "$ID_FS_TYPE" = "crypto_LUKS" ]] && {
>          dev=$(udevadm info --query=all --path=/sys/dev/block/$majmin | awk -F= '/DEVNAME/{print $2}')
>    perror "Device $dev is encrypted, can not be used in kdump."
>    echo "Warning: Target device $dev is encrypted."

Don't use "Target". This could be an intermediate device in the device
stack. Also, I think we should convert this message into Info instead of
Warning. Last message where we warn about need of inputting password can
be a warning. All these intermediate messages are only for information
which tell which device is encrypted.

So may be use something like "Info: Device $dev is encrypted".
>      return 0
>  }
>  return 1
>
> @@ -482,18 +482,11 @@ check_crypt()
>  [ $_ret -eq 0 ] && return
>
> if [ $_ret -eq 1 ]; then
>    _target=$(get_block_dump_target)
>    perror "Can not save vmcore to target device $_target."
> elif [ $_ret -eq 2 ]; then
>    perror "Default action is dump_to_rootfs but can not save vmcore to root device."
> fi
> return 1
>
> }
>
> if ! check_crypt; then
> exit 1
> echo "Warning: Encrypted device is in dump path and capture kernel will wait on console for password to be entered."

How about changing the message a bit.

"Warning: Encrypted device is in dump path. User will prompted for
password during second kernel boot".

Thanks
Vivek

[Arthur Zou]

----- Original Message -----
> On Mon, Feb 17, 2014 at 07:40:19PM +0800, arthur wrote:
> > Resolve: bz1053045
> >
> > Description:
> > Currently kdumpctl will fail to create kdump initramfs and start
> > kdump service while dump target is encrypted. This restriction is
> > too strict.
> >
> > Resolution:
> > Just warn user that encrypted device is in dump path and second
> > kernel will wait on console for password to be entered.
> > Signed-off-by: arthur
> >
> > mkdumprd | 11 ++---------
> >  1 file changed, 2 insertions(+), 9 deletions(-)
> >
> > diff --git a/mkdumprd b/mkdumprd
> > index bc002bc..c7dfa9c 100644
> > --- a/mkdumprd
> > +++ b/mkdumprd
> > @@ -467,7 +467,7 @@ is_crypt()
> >      eval "$line"
> >      [[ "$ID_FS_TYPE" = "crypto_LUKS" ]] && {
> >          dev=$(udevadm info --query=all --path=/sys/dev/block/$majmin | awk
> >          -F= '/DEVNAME/{print $2}')
> >    perror "Device $dev is encrypted, can not be used in kdump."
> >    echo "Warning: Target device $dev is encrypted."
>
> Don't use "Target". This could be an intermediate device in the device
> stack. Also, I think we should convert this message into Info instead of
> Warning. Last message where we warn about need of inputting password can
> be a warning. All these intermediate messages are only for information
> which tell which device is encrypted.
>
> So may be use something like "Info: Device $dev is encrypted".

How about just "Device $dev is encrypted.". Because I didn't see any other
place use this format to show info message in kexec-tools userspace.
> >      return 0
> >  }
> >  return 1
> >
> > @@ -482,18 +482,11 @@ check_crypt()
> >  [ $_ret -eq 0 ] && return
> >
> > if [ $_ret -eq 1 ]; then
> >    _target=$(get_block_dump_target)
> >    perror "Can not save vmcore to target device $_target."
> > elif [ $_ret -eq 2 ]; then
> >    perror "Default action is dump_to_rootfs but can not save vmcore
> >
> > to root device."
> > fi
> > return 1
> >
> > }
> >
> > if ! check_crypt; then
> > exit 1
> > echo "Warning: Encrypted device is in dump path and capture kernel
> >
> > will wait on console for password to be entered."
>
> How about changing the message a bit.
>
> "Warning: Encrypted device is in dump path. User will prompted for
> password during second kernel boot".

That's fine!

Thanks
arthur
> Thanks
> Vivek

[Vivek Goyal]

On Tue, Feb 18, 2014 at 12:39:01AM -0500, Zhi Zou wrote:

[..]
> > So may be use something like "Info: Device $dev is encrypted".
>
> How about just "Device $dev is encrypted.". Because I didn't see any other
> place use this format to show info message in kexec-tools userspace.

Ok, that's fine too.

Our messaging in kdump system is really not uniform. We have written
message in anyway we want. I think we should fix it at some point of time.

We should somehow print severity of messge "Info, Warning, Error" so that
user can interpret what seriously to take a message.

We should also print subsystem name "kdump" so that user knows where
message is coming from.

Also first letter of first word of message should be capital.

For the time being I am fine with above but our messaging requires some
improvements.

Thanks
Vivek