Bug 1651016

Summary: kexec/kdump kernel fails to load with EFI secure boot enabled
Product: [Fedora] Fedora Reporter: Lyude <lyude>
Component: shimAssignee: Peter Jones <pjones>
Status: POST --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 30CC: bhe, joe, kasong, mattdm, mjg59, pjones, ruyang
Target Milestone: ---Flags: bcotton: fedora_prioritized_bug-
kasong: needinfo? (mjg59)
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Lyude 2018-11-18 18:57:30 UTC
Description of problem:
While this seemed to work on Fedora 27, since updating to F28 and F29 I haven't been able to get kdump to work on my server with EFI secure boot enabled.

Version-Release number of selected component (if applicable):
kexec-tools-2.0.17-10.fc29
kernel-4.19.2-300.fc29

How reproducible:
Always

Steps to Reproduce:
1. Enable secure boot
2. Setup kdump
3. Try to get kdump to load kdump kernel

Actual results:
-- Logs begin at Tue 2017-10-17 12:09:10 EDT, end at Sun 2018-11-18 13:48:29 EST. --
Nov 17 02:38:41 Sapphire systemd[1]: Starting Crash recovery kernel arming...
Nov 17 02:38:41 Sapphire kdumpctl[1505]: No kdump initial ramdisk found.
Nov 17 02:38:41 Sapphire kdumpctl[1505]: Rebuilding /boot/initramfs-4.18.18-300.fc29.x86_64kdump.img
Nov 17 02:38:46 Sapphire dracut[2979]: Executing: /usr/bin/dracut --quiet --hostonly --hostonly-cmdline --hostonly-i18n --hostonly-mode strict -o "plymouth dash resume ifcfg" -a watchdog --mount "/dev/mapper/Sapphire-root /sysroot xfs defaults" --no-hostonly-default-device -f /boot/initramfs-4.18.18-300.fc29.x86_64kdump.img 4.18.18-300.fc29.x86_64
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'busybox' will not be installed, because command 'busybox' could not be found!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'ifcfg' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'plymouth' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found!
Nov 17 02:38:48 Sapphire dracut[2979]: dracut module 'stratis' will not be installed, because command 'stratisd-init' could not be found!
Nov 17 02:38:48 Sapphire dracut[2979]: dracut module 'resume' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'biosdevname' will not be installed, because command 'biosdevname' could not be found!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'busybox' will not be installed, because command 'busybox' could not be found!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found!
Nov 17 02:38:50 Sapphire dracut[2979]: dracut module 'stratis' will not be installed, because command 'stratisd-init' could not be found!
Nov 17 02:38:50 Sapphire dracut[2979]: *** Including module: bash ***
Nov 17 02:38:50 Sapphire dracut[2979]: *** Including module: systemd ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: systemd-initrd ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: watchdog ***
Nov 17 02:38:53 Sapphire kdumpctl[1505]: /usr/lib/dracut/modules.d/04watchdog/module-setup.sh: line 44: /sys/class/watchdog/watchdog0/device/modalias: No such file or directory
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: nss-softokn ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: i18n ***
Nov 17 02:38:54 Sapphire dracut[2979]: *** Including module: drm ***
Nov 17 02:38:57 Sapphire dracut[2979]: *** Including module: dm ***
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 64-device-mapper.rules
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 60-persistent-storage-dm.rules
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 55-dm.rules
Nov 17 02:38:58 Sapphire dracut[2979]: *** Including module: kernel-modules ***
Nov 17 02:39:00 Sapphire dracut[2979]: *** Including module: kernel-modules-extra ***
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/run/depmod.d/" does not exist
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/etc/depmod.d/" is ignored (directory or doesn't exist)
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/lib/depmod.d/" does not exist
Nov 17 02:39:00 Sapphire dracut[2979]: *** Including module: lvm ***
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 64-device-mapper.rules
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 56-lvm.rules
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 60-persistent-storage-lvm.rules
Nov 17 02:39:01 Sapphire dracut[2979]: *** Including module: mdraid ***
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 64-md-raid.rules
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: fstab-sys ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: rootfs-block ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: terminfo ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: udev-rules ***
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 40-redhat.rules
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 50-firmware.rules
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 50-udev.rules
Nov 17 02:39:03 Sapphire dracut[2979]: Skipping udev rule: 91-permissions.rules
Nov 17 02:39:03 Sapphire dracut[2979]: Skipping udev rule: 80-drivers-modprobe.rules
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: dracut-systemd ***
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: usrmount ***
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: base ***
Nov 17 02:39:04 Sapphire dracut[2979]: *** Including module: fs-lib ***
Nov 17 02:39:04 Sapphire dracut[2979]: *** Including module: kdumpbase ***
Nov 17 02:39:06 Sapphire dracut[2979]: *** Including module: shutdown ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Including modules done ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Installing kernel module dependencies ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Installing kernel module dependencies done ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Resolving executable dependencies ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Resolving executable dependencies done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Hardlinking files ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Hardlinking files done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Stripping files ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Stripping files done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Generating early-microcode cpio image ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Constructing AuthenticAMD.bin ****
Nov 17 02:39:11 Sapphire dracut[2979]: *** Store current command line parameters ***
Nov 17 02:39:11 Sapphire dracut[2979]: Stored kernel commandline:
Nov 17 02:39:11 Sapphire dracut[2979]:  rd.lvm.lv=Sapphire/root
Nov 17 02:39:11 Sapphire dracut[2979]:  rd.md.uuid=46c281b8:f0f444a7:dfebee61:2a9edd77
Nov 17 02:39:11 Sapphire dracut[2979]: *** Creating image file '/boot/initramfs-4.18.18-300.fc29.x86_64kdump.img' ***
Nov 17 02:39:14 Sapphire dracut[2979]: *** Creating initramfs image file '/boot/initramfs-4.18.18-300.fc29.x86_64kdump.img' done ***
Nov 17 02:39:16 Sapphire kdumpctl[1505]: Secure Boot is enabled. Using kexec file based syscall.
Nov 17 02:39:17 Sapphire kdumpctl[1505]: kexec_file_load failed: Required key not available
Nov 17 02:39:17 Sapphire kdumpctl[1505]: kexec: failed to load kdump kernel
Nov 17 02:39:17 Sapphire kdumpctl[1505]: Starting kdump: [FAILED]
Nov 17 02:39:17 Sapphire systemd[1]: kdump.service: Main process exited, code=exited, status=1/FAILURE
Nov 17 02:39:17 Sapphire systemd[1]: kdump.service: Failed with result 'exit-code'.
Nov 17 02:39:17 Sapphire systemd[1]: Failed to start Crash recovery kernel arming.

With the addition of:

…
[   64.297084] PKCS#7 signature not signed with a trusted key
…

in dmesg

Expected results:
kdump kernel should load

Comment 1 Kairui Song 2018-11-20 08:22:14 UTC
Root cause is MokListRT is missing after shim-15.

Rollback to shim < 15, or add Fedora Secure Boot CA key to trusted keys in EFI would fix it.

Reassigning to shim.

Comment 2 Lyude 2019-05-04 18:11:23 UTC
Any update on this?

Comment 3 Kairui Song 2020-02-11 06:02:23 UTC
Hi, any update? This should have been fixed in upstream, need to be backported.

Comment 4 Dave Young 2020-02-25 07:45:17 UTC
Is this Fedora 30 only or also including 31 and rawhide?

Comment 5 Dave Young 2020-02-25 07:47:25 UTC
Also, if kdump does not work then kexec reboot will not work as well, updated the bug summary line

Comment 6 Kairui Song 2020-02-25 07:50:12 UTC
The fix is needed for rawhide, f32, and f31.

Comment 7 Ben Cotton 2020-02-26 18:18:15 UTC
Rejected as a prioritized bug. Assigning it to an active maintainer should be enough to move this along. https://meetbot.fedoraproject.org/fedora-meeting/2020-02-26/fedora_prioritized_bugs_and_issues.2020-02-26-16.00.log.html#l-85

Setting status to POST since there's an upstream fix

Comment 8 Fedora Admin XMLRPC Client 2020-02-27 04:29:41 UTC
This package has changed maintainer in the Fedora.
Reassigning to the new maintainer of this component.