Your message dated Sat, 05 Mar 2016 23:10:21 +0000 with message-id <[email protected]> and subject line Bug#816513: fixed in mandos 1.7.4-1 has caused the Debian Bug report #816513, regarding Call to configure_network in initramfs script broken due to set -e to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 816513: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816513 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: mandos-client Version: 1.6.9-1 Hi, The mandos initramfs script <${INITRAMFS}/scripts/init-premount/mandos> is configured with set -e. (#!/bin/sh -e in the shebang). This causes that it aborts when any command executed returns non-zero and the return value is not checked. The problem is that this script sources /scripts/functions from the initramfs and /scripts/functions was not designed to work with set -e. So when the mandos script calls any function sourced from /scripts/functions problems may happen. For example, I have found that when executing the function configure_networking it will cause the mandos script to abort if the DHCP server don't replies in less than 2 seconds. This function is called from the mandos initramfs script <${INITRAMFS}/scripts/init-premount/mandos> to configure the network when mandos=connect is specified on the kernel command line. Let's take a look to the function configure_networking: configure_networking() { # [... skipped code for clarity ....] for ROUNDTTT in 2 3 4 6 9 16 25 36 64 100; do # The NIC is to be configured if this file does not exist. # Ip-Config tries to create this file and when it succeds # creating the file, ipconfig is not run again. for x in /run/net-"${DEVICE}".conf /run/net-*.conf ; do [ -e "$x" ] && break 2 done case ${IP} in none|off) # Do nothing ;; ""|on|any) # Bring up device ipconfig -t ${ROUNDTTT} "${DEVICE}" ;; dhcp|bootp|rarp|both) ipconfig -t ${ROUNDTTT} -c ${IP} -d "${DEVICE}" ;; *) ipconfig -t ${ROUNDTTT} -d $IP # grab device entry from ip option NEW_DEVICE=${IP#*:*:*:*:*:*} if [ "${NEW_DEVICE}" != "${IP}" ]; then NEW_DEVICE=${NEW_DEVICE%%:*} else # wrong parse, possibly only a partial string NEW_DEVICE= fi if [ -n "${NEW_DEVICE}" ]; then DEVICE="${NEW_DEVICE}" fi ;; esac done # [... skipped code for clarity ....] } This function will call ipconfig (from klibc-utils) with a different ROUNDTTT value each time. The problem is that ipconfig will return a non-zero value if it fails to get the DHCP value before the timeout. This is fine if configure_networking has not been called with set -e. Otherwise it will break things because it makes abort the whole script on the first failure from ipconfig. This is part of trace from the initramfs obtained by booting the machine with the debug parameter in the kernel cmdline. Begin: Running /scripts/init-premount ... + run_scripts /scripts/init-premount + initdir=/scripts/init-premount + [ ! -d /scripts/init-premount ] + shift + . /scripts/init-premount/ORDER + /scripts/init-premount/plymouth + [ -e /conf/param.conf ] + /scripts/init-premount/mandos calling: settle IP-Config: eth1 hardware address 0c:14:3a:1b:af:81 mtu 1500 DHCP RARP IP-Config: eth0 hardware address 0c:14:2a:1b:af:80 mtu 1500 DHCP RARP IP-Config: no response after 2 secs - giving up + [ -e /conf/param.conf ] + [ n != y ] + log_end_msg + _log_msg done.\n + [ n = y ] + printf done.\n done. + maybe_break mount + [ = mount ] + log_begin_msg Mounting root file system + _log_msg Begin: Mounting root file system ... + [ n = y ] + printf Begin: Mounting root file system ... Begin: Mounting root file system ... + . /scripts/local + . /scripts/nfs + . /scripts/local As you can see, the script /scripts/init-premount/mandos exits as soon as IP-Config fails on the first try to get IP with a 2 second timeout. A possible fix is the following patch: --- a/usr/share/initramfs-tools/scripts/init-premount/mandos 2016-03-02 10:41:43.437960673 +0100 +++ b/usr/share/initramfs-tools/scripts/init-premount/mandos 2016-03-02 13:00:27.392153826 +0100 @@ -94,7 +94,7 @@ # If we are connecting directly, run "configure_networking" (from # /scripts/functions); it needs IPOPTS and DEVICE if [ "${connect+set}" = set ]; then - configure_networking + configure_networking || true if [ -n "$connect" ]; then cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf But there are also other possibilities like disabling set -e on the script. Maybe there are other functions that can cause trouble. I have checked all the scripts on my initramfs and only the mandos and the udev ones are running with set -e.
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---Source: mandos Source-Version: 1.7.4-1 We believe that the bug you reported is fixed in the latest version of mandos, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Teddy Hogeborn <[email protected]> (supplier of updated mandos package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 05 Mar 2016 23:10:07 +0100 Source: mandos Binary: mandos mandos-client Architecture: source amd64 all Version: 1.7.4-1 Distribution: unstable Urgency: medium Maintainer: Mandos Maintainers <[email protected]> Changed-By: Teddy Hogeborn <[email protected]> Description: mandos - server giving encrypted passwords to Mandos clients mandos-client - do unattended reboots with an encrypted root file system Closes: 816513 Changes: mandos (1.7.4-1) unstable; urgency=medium . * New upstream release. * initramfs-tools-script: Fix "Call to configure_network in initramfs script broken due to set -e" by surrounding call by "set +x" and "set -e" (Closes: #816513) * debian/control: (Source: mandos/Build-Depends-Indep): Change "python-gobject | python-gi" to "python-gi | python-gobject" (Package: mandos/Depends): - '' - Checksums-Sha1: 66983f4d8948d7673b408037c5bac06acb570f86 2223 mandos_1.7.4-1.dsc 9d4aba46ad5cabfb2a6a38e88f0d36212b20c301 174294 mandos_1.7.4.orig.tar.gz 3be654e4819e88b756deae1fcb9f0ebbf03f4ffa 14260 mandos_1.7.4-1.debian.tar.xz eb803d2dc10c2e21b1b7f8b7b98224e8f1df6305 154324 mandos-client-dbgsym_1.7.4-1_amd64.deb 230331d38fe3abc8764edbe4a60c771861a45e43 156160 mandos-client_1.7.4-1_amd64.deb 24bd3382dbf533a3dad1e4de609d43b3be3b47ab 84236 mandos_1.7.4-1_all.deb Checksums-Sha256: aedb7948e785ebdb4f2134668cb817bc3921819ad80e878674842074782458f3 2223 mandos_1.7.4-1.dsc 388ffb0d7e4b971f73e32f060de1274f92ef20326f4b8bfba8af268be8ea1e0c 174294 mandos_1.7.4.orig.tar.gz 8c6a2e25acd7f9e5f6fc8a82382cb468f926435141b18db2daa8bfd1a14de07f 14260 mandos_1.7.4-1.debian.tar.xz 4719ecab451b0e7ab4b82b7a6db20873547bab90a1eb35eac5ed787b21de6422 154324 mandos-client-dbgsym_1.7.4-1_amd64.deb c8589baef10a9039e9157e3f88ee9e8ce3980178e68ca4bccc5f0252951a30ad 156160 mandos-client_1.7.4-1_amd64.deb dcfd85d2eaa5f5e9bbde2abbabf6ffcaf46ba6a7cf69e14deee5937050c1baf4 84236 mandos_1.7.4-1_all.deb Files: c9e45135359e5f634a2d873325735b72 2223 admin extra mandos_1.7.4-1.dsc 1170e24b27af6f6a2e4b1cfecb7e1761 174294 admin extra mandos_1.7.4.orig.tar.gz f94848d13c594c34052829dfd4cdfcb6 14260 admin extra mandos_1.7.4-1.debian.tar.xz 6808929961e15d6fe8a6d6b6cffb01ab 154324 debug extra mandos-client-dbgsym_1.7.4-1_amd64.deb bd4b362ca768fbc8cd8eb795f547b0d1 156160 admin extra mandos-client_1.7.4-1_amd64.deb 7e40cbe26827a978ad2bb865c514717d 84236 admin extra mandos_1.7.4-1_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJW21uwAAoJEOubGwHeBXLki9kQAOa66neHboeyGSJsu3rz1fOP kwaQkIS3pein9Q7lCVy5EEWXHAMU7Xrj0ESzGKPqv1jMixn2zl3v7AGpyCjhgIGS pRrx3KPssbOVwG/I2ywuuI89j6wLBsJMkhug1JTo4+g4alhxkJWipaII3n5EyG6I msxgMGc7B0rjwTr6psvWJwJNWxrIXBKhjECMR+5AWz2z2DAEwKlrJqgLpbT4qZCP S2Gj4cGd+IoC8Rh1bfnoVVF2q+eSd12g904lpvWZCtjYrgXWf08Y8bXudTrqimgh Tcoz+0mBkkqsw+gl8JmCTc1pYgyighT4it+6bAIYOqUjNE6gnJWLryVPP7jhjfdO l3rmka043wwTWwI57lJNdA0eb7wQZAntN9IJhvGzfxet/s7CMfQ/cn1+bj4yTXxt UzNYSdOKYRmJnX6K1AQc34fTKX398AdCAieGBjFnhZBt2MZ+3jwfR2MfQF/VQYTZ zLlha2CQZfGbtscxW8TYdDKe95wZUZtbCFNDChXoRA/tm8Bod40uIWFei/P6iNFz zpEEziMLgDpWzj07QFWrlM+L9fu0hqrNG83wTteIRYlFzrt3pdaY4vPZTSfWPkgb v2m4ycox5APtNaGeNvYLI8lM4Wd7rlxZ0HZxtizg4+wNDm5elF8l6DdlTPn766TN cYK4ytlCw+m8LtFNpUzq =ZoK7 -----END PGP SIGNATURE-----
--- End Message ---
