Bug 1651016 - Kdump kernel fails to load with EFI secure boot enabled [NEEDINFO]
Summary: Kdump kernel fails to load with EFI secure boot enabled
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: shim
Version: 30
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matthew Garrett
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-18 18:57 UTC by Lyude
Modified: 2020-02-11 06:02 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
kasong: needinfo? (mjg59)


Attachments (Terms of Use)

Description Lyude 2018-11-18 18:57:30 UTC
Description of problem:
While this seemed to work on Fedora 27, since updating to F28 and F29 I haven't been able to get kdump to work on my server with EFI secure boot enabled.

Version-Release number of selected component (if applicable):
kexec-tools-2.0.17-10.fc29
kernel-4.19.2-300.fc29

How reproducible:
Always

Steps to Reproduce:
1. Enable secure boot
2. Setup kdump
3. Try to get kdump to load kdump kernel

Actual results:
-- Logs begin at Tue 2017-10-17 12:09:10 EDT, end at Sun 2018-11-18 13:48:29 EST. --
Nov 17 02:38:41 Sapphire systemd[1]: Starting Crash recovery kernel arming...
Nov 17 02:38:41 Sapphire kdumpctl[1505]: No kdump initial ramdisk found.
Nov 17 02:38:41 Sapphire kdumpctl[1505]: Rebuilding /boot/initramfs-4.18.18-300.fc29.x86_64kdump.img
Nov 17 02:38:46 Sapphire dracut[2979]: Executing: /usr/bin/dracut --quiet --hostonly --hostonly-cmdline --hostonly-i18n --hostonly-mode strict -o "plymouth dash resume ifcfg" -a watchdog --mount "/dev/mapper/Sapphire-root /sysroot xfs defaults" --no-hostonly-default-device -f /boot/initramfs-4.18.18-300.fc29.x86_64kdump.img 4.18.18-300.fc29.x86_64
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'busybox' will not be installed, because command 'busybox' could not be found!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'ifcfg' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'plymouth' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:47 Sapphire dracut[2979]: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found!
Nov 17 02:38:48 Sapphire dracut[2979]: dracut module 'stratis' will not be installed, because command 'stratisd-init' could not be found!
Nov 17 02:38:48 Sapphire dracut[2979]: dracut module 'resume' will not be installed, because it's in the list to be omitted!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'biosdevname' will not be installed, because command 'biosdevname' could not be found!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'busybox' will not be installed, because command 'busybox' could not be found!
Nov 17 02:38:49 Sapphire dracut[2979]: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found!
Nov 17 02:38:50 Sapphire dracut[2979]: dracut module 'stratis' will not be installed, because command 'stratisd-init' could not be found!
Nov 17 02:38:50 Sapphire dracut[2979]: *** Including module: bash ***
Nov 17 02:38:50 Sapphire dracut[2979]: *** Including module: systemd ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: systemd-initrd ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: watchdog ***
Nov 17 02:38:53 Sapphire kdumpctl[1505]: /usr/lib/dracut/modules.d/04watchdog/module-setup.sh: line 44: /sys/class/watchdog/watchdog0/device/modalias: No such file or directory
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: nss-softokn ***
Nov 17 02:38:53 Sapphire dracut[2979]: *** Including module: i18n ***
Nov 17 02:38:54 Sapphire dracut[2979]: *** Including module: drm ***
Nov 17 02:38:57 Sapphire dracut[2979]: *** Including module: dm ***
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 64-device-mapper.rules
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 60-persistent-storage-dm.rules
Nov 17 02:38:58 Sapphire dracut[2979]: Skipping udev rule: 55-dm.rules
Nov 17 02:38:58 Sapphire dracut[2979]: *** Including module: kernel-modules ***
Nov 17 02:39:00 Sapphire dracut[2979]: *** Including module: kernel-modules-extra ***
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/run/depmod.d/" does not exist
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/etc/depmod.d/" is ignored (directory or doesn't exist)
Nov 17 02:39:00 Sapphire dracut[2979]:   kernel-modules-extra: configuration source "/lib/depmod.d/" does not exist
Nov 17 02:39:00 Sapphire dracut[2979]: *** Including module: lvm ***
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 64-device-mapper.rules
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 56-lvm.rules
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 60-persistent-storage-lvm.rules
Nov 17 02:39:01 Sapphire dracut[2979]: *** Including module: mdraid ***
Nov 17 02:39:01 Sapphire dracut[2979]: Skipping udev rule: 64-md-raid.rules
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: fstab-sys ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: rootfs-block ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: terminfo ***
Nov 17 02:39:02 Sapphire dracut[2979]: *** Including module: udev-rules ***
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 40-redhat.rules
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 50-firmware.rules
Nov 17 02:39:02 Sapphire dracut[2979]: Skipping udev rule: 50-udev.rules
Nov 17 02:39:03 Sapphire dracut[2979]: Skipping udev rule: 91-permissions.rules
Nov 17 02:39:03 Sapphire dracut[2979]: Skipping udev rule: 80-drivers-modprobe.rules
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: dracut-systemd ***
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: usrmount ***
Nov 17 02:39:03 Sapphire dracut[2979]: *** Including module: base ***
Nov 17 02:39:04 Sapphire dracut[2979]: *** Including module: fs-lib ***
Nov 17 02:39:04 Sapphire dracut[2979]: *** Including module: kdumpbase ***
Nov 17 02:39:06 Sapphire dracut[2979]: *** Including module: shutdown ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Including modules done ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Installing kernel module dependencies ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Installing kernel module dependencies done ***
Nov 17 02:39:07 Sapphire dracut[2979]: *** Resolving executable dependencies ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Resolving executable dependencies done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Hardlinking files ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Hardlinking files done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Stripping files ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Stripping files done ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Generating early-microcode cpio image ***
Nov 17 02:39:11 Sapphire dracut[2979]: *** Constructing AuthenticAMD.bin ****
Nov 17 02:39:11 Sapphire dracut[2979]: *** Store current command line parameters ***
Nov 17 02:39:11 Sapphire dracut[2979]: Stored kernel commandline:
Nov 17 02:39:11 Sapphire dracut[2979]:  rd.lvm.lv=Sapphire/root
Nov 17 02:39:11 Sapphire dracut[2979]:  rd.md.uuid=46c281b8:f0f444a7:dfebee61:2a9edd77
Nov 17 02:39:11 Sapphire dracut[2979]: *** Creating image file '/boot/initramfs-4.18.18-300.fc29.x86_64kdump.img' ***
Nov 17 02:39:14 Sapphire dracut[2979]: *** Creating initramfs image file '/boot/initramfs-4.18.18-300.fc29.x86_64kdump.img' done ***
Nov 17 02:39:16 Sapphire kdumpctl[1505]: Secure Boot is enabled. Using kexec file based syscall.
Nov 17 02:39:17 Sapphire kdumpctl[1505]: kexec_file_load failed: Required key not available
Nov 17 02:39:17 Sapphire kdumpctl[1505]: kexec: failed to load kdump kernel
Nov 17 02:39:17 Sapphire kdumpctl[1505]: Starting kdump: [FAILED]
Nov 17 02:39:17 Sapphire systemd[1]: kdump.service: Main process exited, code=exited, status=1/FAILURE
Nov 17 02:39:17 Sapphire systemd[1]: kdump.service: Failed with result 'exit-code'.
Nov 17 02:39:17 Sapphire systemd[1]: Failed to start Crash recovery kernel arming.

With the addition of:

…
[   64.297084] PKCS#7 signature not signed with a trusted key
…

in dmesg

Expected results:
kdump kernel should load

Comment 1 Kairui Song 2018-11-20 08:22:14 UTC
Root cause is MokListRT is missing after shim-15.

Rollback to shim < 15, or add Fedora Secure Boot CA key to trusted keys in EFI would fix it.

Reassigning to shim.

Comment 2 Lyude 2019-05-04 18:11:23 UTC
Any update on this?

Comment 3 Kairui Song 2020-02-11 06:02:23 UTC
Hi, any update? This should have been fixed in upstream, need to be backported.


Note You need to log in before you can comment on or make changes to this bug.