Bug 2208040

Summary:	Ensure /dev/random and /dev/urandom even if run in a container
Product:	Red Hat Enterprise Linux 9	Reporter:	Colin Walters <walters>
Component:	dracut	Assignee:	Pavel Valena <pvalena>
Status:	NEW ---	QA Contact:	qe-baseos-daemons
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.2	CC:	dtardon, jmarrero, mhrivnak, pvalena
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	ostree
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Story
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Colin Walters 2023-05-17 18:43:07 UTC

Particularly with FIPS mode, it's required to have /dev/random and /dev/urandom in the initramfs.  Today we usually run dracut in a fully privileged environment (e.g. a host system as root, or a build system for Image Builder/rpm-ostree).

However, with https://fedoraproject.org/wiki/Changes/OstreeNativeContainer we want to enable a use case that looks like

```
$ cat Dockerfile
FROM quay.io/fedora/fedora-coreos:stable
ADD /path/to/foo /usr/lib/dracut/modules.d
RUN dracut
```

to inject a dracut module and regenerate the initramfs.  

The default podman/docker policy denies creation of device nodes.  However, we don't actually need to create "real" devices - we just need them to end up in the initramfs file.

https://github.com/dracutdevs/dracut/pull/2331 is an upstream PR that aims to address this.  Can you take a look?

Basically we need to ensure that we always have the device nodes in the initramfs, regardless of FIPS mode or not.

Comment 1 Colin Walters 2023-06-14 18:01:08 UTC

Can someone who maintains dracut please take a look at this issue and comment upstream or here?

This is part of enabling "CoreOS Layering" for OCP https://docs.openshift.com/container-platform/4.13/post_installation_configuration/coreos-layering.html as well as outside of it.

Comment 2 Pavel Valena 2023-06-29 14:30:10 UTC

I've looked into the upsteram PR and apart from the stored {u,}random file it looks OK. I'll look into making this PR viable for upstream.

Comment 3 Joseph Marrero 2023-06-29 14:59:31 UTC

Thank you so much Pavel! Let me know if there is anything you need from us.

Comment 5 Pavel Valena 2023-08-16 12:14:22 UTC

Postponing, as there is some kernel activity expected first, to be able to implement required dracut changes (as in line with PR discussion). Please let me know if I've missed something actionable.

[1] https://github.com/dracutdevs/dracut/pull/2331#issuecomment-1662821979