Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/luksroot: Check whether the device already exists #50281

Merged
merged 1 commit into from Dec 1, 2018
Merged

nixos/luksroot: Check whether the device already exists #50281

merged 1 commit into from Dec 1, 2018

Conversation

dasJ
Copy link
Member

@dasJ dasJ commented Nov 12, 2018

The new reuse behaviour is cool and really useful but it breaks one of
my use cases. When using kexec, I have a script which will unlock the
disks in my initrd. However, do_open_passphrase will fail if the disk is
already unlocked.

Btw, can this be backported?

Motivation for this change

It braks my old (18.03) kexec-and-autounlock behaviour.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

@Mic92
Copy link
Member

Mic92 commented Nov 15, 2018

@GrahamcOfBorg test installer.luksroot

@GrahamcOfBorg
Copy link

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.boot.luksroot

Partial log (click to expand)

Cannot nix-instantiate `tests.boot.luksroot' because:
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/lib/attrsets.nix:347:27:
while evaluating the attribute 'boot' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/nixos/tests/all-tests.nix:32:3:
while evaluating 'handleTestOn' at /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/nixos/tests/all-tests.nix:19:33, called from /var/lib/gc-of-borg/nix-test-rs-14/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-14/nixos/tests/all-tests.nix:32:10:
access to path '/nix/store/w7v2s97vvwawhkm2nh0cg5fbjb0rx8b4-grahamc-aarch64-community-14' is forbidden in restricted mode

@Mic92
Copy link
Member

Mic92 commented Nov 15, 2018

@GrahamcOfBorg test installer.luksroot

@GrahamcOfBorg
Copy link

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: tests.installer.luksroot

Partial log (click to expand)

error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:347:27:
while evaluating anonymous function at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/lists.nix:113:41, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/lib/attrsets.nix:347:46:
while evaluating the attribute 'installer' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/nixos/tests/all-tests.nix:106:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/nixos/tests/all-tests.nix:106:15:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/rbvermaa-spot/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/nasmnyzyj6h1slqq3gj4fjib3fyjdhn6-rbvermaa-spot' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.installer.luksroot

Partial log (click to expand)

Cannot nix-instantiate `tests.installer.luksroot' because:
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/lib/attrsets.nix:347:27:
while evaluating the attribute 'installer' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/nixos/tests/all-tests.nix:106:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/nixos/tests/all-tests.nix:106:15:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-test-rs-19/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-19/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/vx1j2g6vfnn5akxmzp9vl3ivx9dsr2w4-grahamc-aarch64-community-19' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.installer.luksroot

Partial log (click to expand)

Cannot nix-instantiate `tests.installer.luksroot' because:
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/lib/attrsets.nix:347:27:
while evaluating the attribute 'installer' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/nixos/tests/all-tests.nix:106:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/nixos/tests/all-tests.nix:106:15:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-test-rs-8/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-8/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/6skgv13ma24s9xkxzss3nvnpzdnf6i49-grahamc-aarch64-community-8' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: tests.installer.luksroot

Partial log (click to expand)

Cannot nix-instantiate `tests.installer.luksroot' because:
error: while evaluating 'recursiveUpdate' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:415:26, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:384:37, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:347:21, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:332:33, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/lib/attrsets.nix:347:27:
while evaluating the attribute 'installer' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/nixos/tests/all-tests.nix:106:3:
while evaluating 'handleTest' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/nixos/tests/all-tests.nix:17:22, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/nixos/tests/all-tests.nix:106:15:
while evaluating 'discoverTests' at /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/nixos/tests/all-tests.nix:13:19, called from /var/lib/ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/builder-0-gustav.ewr1.nix.ci/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/5kbmfpapf81z35i9awqy860cmipw13ph-builder-0-gustav.ewr1.nix.ci' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: tests.boot.luksroot

Partial log (click to expand)

cannot link '/nix/store/.links/10z1wkbi5b6f5sri7fq4lsww59vp0cjg63jnhwx6glqjl4hpxgy5' to '/nix/store/332i2l76nlwzddv74xb6lmqwfjg57xja-gleber-bastion/pkgs/os-specific/linux/kernel/linux-4.4.nix': No space left on device
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:27:
while evaluating anonymous function at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/lists.nix:113:41, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:46:
while evaluating the attribute 'boot' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:32:3:
while evaluating 'handleTestOn' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:19:33, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:32:10:
access to path '/nix/store/332i2l76nlwzddv74xb6lmqwfjg57xja-gleber-bastion' is forbidden in restricted mode

@dasJ
Copy link
Member Author

dasJ commented Nov 27, 2018

Bump

# Return if already unlocked
if [ -b "/dev/mapper/${name}" ]; then
return
fi
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use cryptsetup status ${name} instead, it will exit with 0 if it exists (with 4 if it doesn't)

The new reuse behaviour is cool and really useful but it breaks one of
my use cases. When using kexec, I have a script which will unlock the
disks in my initrd. However, do_open_passphrase will fail if the disk is
already unlocked.
@dasJ
Copy link
Member Author

dasJ commented Dec 1, 2018

@infinisil Fixed and rebased

@infinisil infinisil merged commit 3fbdd47 into NixOS:master Dec 1, 2018
@dasJ dasJ deleted the luks-checkexist branch December 2, 2018 00:19
@dasJ dasJ mentioned this pull request Dec 2, 2018
10 tasks
@eadwu
Copy link
Member

eadwu commented Dec 2, 2018

Broke my boot sequence, stuck on waiting for device ....

@dasJ
Copy link
Member Author

dasJ commented Dec 2, 2018

@eadwu Strange, to me it looks like it's waiting before the changed code is executed

@dasJ
Copy link
Member Author

dasJ commented Dec 2, 2018

Yes, the order from my initrd:

wait_target …

do_open_passphrase() {
  # My code is here
}

open_normally() {
  do_open_passphrase
}

open_normally

Mic92 added a commit that referenced this pull request Dec 2, 2018
Mic92 added a commit that referenced this pull request Dec 2, 2018
This reverts commit 14b0a4f.

Apparently this can break peoples setup: #50281 (comment)
@Mic92
Copy link
Member

Mic92 commented Dec 2, 2018

It would help to add boot.trace to the kernel boot.kernelParams to see what code it executes.

@infinisil
Copy link
Member

Ah darn, thanks for the quick report @eadwu. @Mic92 You gonna revert it on master as well?

@Mic92
Copy link
Member

Mic92 commented Dec 2, 2018

reverted also on master: 50071c4

Mic92 added a commit that referenced this pull request Dec 2, 2018
This reverts commit 9cd4ce9.

This might be broken for some people: #50281 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants