rootmap: fix multipath + LUKS case#1473
Merged
jlebon merged 2 commits intocoreos:mainfrom Jun 17, 2024
Merged
Conversation
jlebon
force-pushed
the
pr/multipath-luks-fixes
branch
from
2fd8265 to
8c0d765
Compare
To iterate faster, it's convenient to be able to run `rdcore rootmap` directly from the real root (mounted over from the development host) and pointing it at `/`. But the naive appending we do here to find the physical root would give `//sysroot` which isn't in the mount table (obviously we could also canonicalize, but it's just cleaner to join it correctly in the first place).
In the multipath + LUKS case, `get_luks_uuid()` would incorrectly skip over the multipath partition containing the LUKS header because `is_dm_device()` returned true. The code eventually errors out when it gets to the disks backing the multipath device. The `is_dm_device()` check was added as part of 69b706d ("rootmap: handle filesystems with LUKS integrity") to correctly handle the LUKS integrity case in the Secure Execution path. There, the device right under the LUKS device is another crypt device mapper device used for integrity that we need to skip over. Instead of generically checking for a device mapper target, check specifically that it's a LUKS integrity target before deciding to skip. Part of: coreos/fedora-coreos-tracker#1728 Co-authored-by: Aashish Radhakrishnan <aaradhak@redhat.com> Co-authored-by: Gursewak Mangat <gursmangat@gmail.com> Co-authored-by: Michael Nguyen <mnguyen@redhat.com> Co-authored-by: Steven Presti <spresti@redhat.com>
jlebon
force-pushed
the
pr/multipath-luks-fixes
branch
from
8c0d765 to
0d42e10
Compare
Closed
Member
Author
|
CI is currently broken (see also #1474). |
Member
Author
|
This is ready for review now! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the multipath + LUKS case,
get_luks_uuid()would incorrectlyskip over the multipath partition containing the LUKS header because
is_dm_device()returned true. The code eventually errors out when itgets to the disks backing the multipath device.
The
is_dm_device()check was added as part of 69b706d ("rootmap:handle filesystems with LUKS integrity") to correctly handle the LUKS
integrity case in the Secure Execution path. There, the device right
under the LUKS device is another crypt device mapper device used for
integrity that we need to skip over.
Instead of generically checking for a device mapper target, check
specifically that it's a LUKS integrity target before deciding to skip.
Part of: coreos/fedora-coreos-tracker#1728