Re: [cip-dev][isar-cip-core][PATCH v2 2/3] initramfs-crypt-hook: suppress stderr log from cryptsetup

On 17.07.26 09:45, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <[email protected]>
> 
> LuksDump prints additional information to stderr on Debian Sid,
> this information is not necessary for the grep command. Suppress
> the messages to avoid cluttering the boot log.
> 
> Signed-off-by: Quirin Gylstorff <[email protected]>
> ---
> Changes v2:
>     - Added other calls of luksDump. These are only visible if the
>       image is started a second time
>  .../initramfs-crypt-hook/files/local-bottom-complete      | 2 +-
>  .../initramfs-crypt-hook/files/local-top-complete         | 8 ++++----
>  2 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/recipes-initramfs/initramfs-crypt-hook/files/local-bottom-complete b/recipes-initramfs/initramfs-crypt-hook/files/local-bottom-complete
> index 120ac29..0821566 100644
> --- a/recipes-initramfs/initramfs-crypt-hook/files/local-bottom-complete
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/local-bottom-complete
> @@ -75,7 +75,7 @@ for partition_set in $partition_sets; do
>  		continue
>  	fi
>  	if /usr/sbin/cryptsetup luksDump --batch-mode "$part_device" \
> -			| grep -q "luks2"; then
> +			2>/dev/null | grep -q "luks2" ; then
>  		mount_partition "$decrypted_part" "${rootmnt}""$partition_mountpoint"
>  	else
>  		mount_partition "$part_device" "$rootmnt""$partition_mountpoint"
> diff --git a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
> index 397b315..58f82db 100644
> --- a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
> @@ -124,7 +124,7 @@ reencrypt_existing_partition() {
>  	luks)
>  		# Check if reencrypt was aborted
>  		if /usr/sbin/cryptsetup luksDump --batch-mode "$1" \
> -				| grep -q "online-reencrypt-v2"; then
> +				2>/dev/null | grep -q "online-reencrypt-v2"; then
>  			/usr/sbin/cryptsetup repair --batch-mode "$1" < "$2" || \
>  				panic "cryptsetup repair was not successful"
>  		fi
> @@ -274,7 +274,7 @@ for partition_set in $partition_sets; do
>  	# If partition is already encrypted, decrypt and continue with next partition:
>  	decrypted_part=/dev/mapper/"$crypt_mount_name"
>  	if /usr/sbin/cryptsetup luksDump --batch-mode "$part_device" \
> -			| grep -q "systemd-tpm2\|clevis"; then
> +			2>/dev/null | grep -q "systemd-tpm2\|clevis"; then
>  		open_tpm2_partition "$part_device" "$crypt_mount_name" "$tpm_device"
>  
>  		# check if we are trying to mount root, set ROOT to decrypted partition:
> @@ -287,7 +287,7 @@ for partition_set in $partition_sets; do
>  
>  	# If partition contains an aborted reencrypt luks header, switch to reencrypt mode:
>  	if /usr/sbin/cryptsetup luksDump --batch-mode "${part_device}" \
> -			| grep -q "online-reencrypt-v2"; then
> +		2>/dev/null | grep -q "online-reencrypt-v2"; then
>  		partition_format="reencrypt"
>  	fi
>  
> @@ -337,7 +337,7 @@ for partition_set in $partition_sets; do
>  			# header, but no TPM2 token
>  			if cmp -s -n "$(( 10 * 1024 * 1024 ))" "${part_device}" /dev/zero || \
>  				( [ "$(get_fstype "${part_device}")" = "luks" ] && \
> -				! ( /usr/sbin/cryptsetup luksDump --batch-mode "$part_device" |
> +				! ( /usr/sbin/cryptsetup luksDump --batch-mode "$part_device" 2>/dev/null |
>  					grep -q "systemd-tpm2\|clevis" ) )
>  			then
>  				log_begin_msg "Encryption of ${part_device}"

Thanks, all 3 applied. This one, I wrapped a bit differently, though,
keeping the second line untouched.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center