Re: mkinitrd update discussion/survey

On Sat, Feb 26, 2005 at 10:55:32AM +0100, Benjamin Schieder wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> | 1)	I keep a busybox and basic tools on my /boot partition (/dev/hda1),
> | 	and boot with root=/dev/hda1 init=/linuxrc.  my linuxrc will (first)
> | 	e2fsck my root partition and then mount it (just seems like the
> | 	right order to me, though most distros seem to disagree).  Also
> | 	allows any kind of raid/encryption/nfs/whatever root to work
> | 	much more easily than I've ever managed with an initrd.  And it
> | 	might be useful just to offer an 'initpart' as a debugging tool,
> | 	and once the bugs are out, make a ramdisk out of it.
> Doesn't fsck complain if the filesystem to be checked is mounted?

Not if it's mounted read-only (maybe this is only true for the root
partition?)  So most distros mount root ro, fsck it ( hopefully ...
since / hasn't been fscked, fsck may not run, or it may run but just
make prank phone calls to the russian maffia).

Needless to say, if you can't fsck, you're fsck'd. :)

Recursive: (adj) see recursive
> 
> | 2)	[ on pivot_root ]
> | 3)	Although I have not yet entirely implemented it, I have always
> | 	wanted to set up (especially my servers at the office) with
> | 	busybox, basic tools, and dropbear sshd.  If e2fsck fails, or
> | 	any of the annoyances that could cause the boot process to hang,
> | 	just bring up a network, fire up an sshd, and start sending mail
> | 	to anybody who might be able to fix it.
> That's something I never thought about but actually makes more sense
> than I thought at first read.
> 
> | 4)	Also on my presonal 'things to break list':  An encrypted root
> | 	partition, a boot partition as described above, but it always
> | 	brings up sshd -- which allows the admin of the system to ssh
> | 	in and enter the passphrase for the root partition.
> Now here's finally a way how I can encrypt my rootfs :D
Yep ... 'course you could do it with an initrd ... you could do anything
I discuss here on an initrd ... I just:

	a)	ran across a bunch of 1G IDE drives for $5, and therefore have
		lots of groovy 'boot floppies'.
	b)	Kept forgetting to unmount my ramdisks and dd them to to initrd
		before rebooting.
> 
> | 	Anyway, once the passphrase is entered and the fix is in, just
> | 	tell the system to continue (in an unspecified and murky mystical
> | 	way ... I guess one could start sshd in debug mode, so it exits
> | 	after each connection) and it completes the boot process.
> Just using a special "shell" that exits after successful mounting of the
> rootfs should be fine here.
Sure!  The only advantage to a real shell is you might want to keep the
user interactive through the fsck, which would have to be after the
passphrase.

> 
> Care to share what you've got so far?
> If I got that right it might be possible to use Tobias' rescue target
> for this purpose quite fine. Also I've been looking for a way to more
> easily get encryption going than to mount a monitor and keyboard to my
> server :/
> 
> Tobias, any thoughts on whether that's possible without tweaking it too
> much?
> 
> Anyone else got thoughts here? I'd like to revamp the boot process to
> allow for this kind of stuff easily.
I'm on 6 weeks vacation and so I'll do you one better ... I should be
able to do a proof-of-concept implementation , end-to-end, and send
it to the list (all you really need is a list of what's there, and the
/linuxrc).

But (odd as it may sound, since I'm subscribed to this list) I haven't
got a rock-linux system, so the system will be tested with gentoo.

Since the only thing done after root is mounted should be
	pivot_root . /boot
	cd /
	mount --move /boot/proc proc
	mount --move /boot/dev dev
	mount --move /boot/sys sys
	exec /sbin/init "$@"
or something to that effect, it should work just as well with rock.

I DO have it on my todo list to reboot my dual-amd64 from one of
your (i386) boot-disks and bootstrap an amd64 rocklinux, but that is
probably more time consuming (Mostly 'cause I'm an anal bastard ;-)
and I'll probably need to wait until I've reassembled my laptop.


> 
> 
> Greetings,
> 	blindy
> 
> - --
> Benjamin 'blindCoder' Schieder
> Registered Linux User #289529: http://counter.li.org
> finger blindcoder-1k+CIuW/[email protected] | gpg --import
> - --
> /lusr/bin/brain: received signal: SIGIDIOT
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
> 
> iD8DBQFCIEeT7Wabow2Um2YRAhsRAJ9Qh6AAgiddbCBDKX3jC/fNhMzdmgCfeP0j
> rC53GkrxrPqr+UgGZQEXUEU=
> =FEPe
> -----END PGP SIGNATURE-----
> _______________________________________________
> rock-devel mailing list
> [email protected]
> http://www.rocklinux.net/mailman/listinfo/rock-devel
---
Don't blame me, I voted libertarian.