Initrd: The Pivoting Moment

The other day a system had its /boot partition wiped clean. That system had Centos 5.5 running on it, so we decided we could just copy the content of /boot

from one of its sister machines. The machine had a few problems… The first problem was the GRand Unified Bootloader. There must be something I don’t quite understand about GRUB, but we had to reinstall grub in to the MBR. Pretty simple procedure which I will wrote seperately on.

The other problem was when I booted the machine up it couldn’t pivot_root to /newroot which reminded me of two things. First I hate initrds and secondly that Centos and Red Hat both use them. Before I begin with the method I used

to fix it, let me explain what the initrd provides your system.

Here is the basic problem. Your kernel is loading but; in order to hand off the boot sequence to init the kernel needs to read some information off your disk but; your kernel doesn’t have the module compiled in to itself. The solution, besides recompiling the kernel with the module built in, is to

boot to a temporary root file system that the kernel does have built in support for. This temporary root file system will have all the commands and kernel modules required to mount the real root file system and pivot the current root file system with the new root filesystem.

There are some other cool things you can do with initrds. For example you can initiate the frame buffer and provide a console theme very early on in the boot sequence for providing eye candy on desktops. Some volume encrypted techniques rely on initrd to provide just enough resources to decrypt and root file system. I’m sure there are any other useful uses for initrd, but that’s beyond the scope of this post.

So that said, the problem we’re trying to solve is to boot a kernel that has drives necessary to mount the root file system built as external modules. Luckily there is a script to build them for you. The problem is that we’re not in a catch 22. My solution was to simply boot a Gentoo Live CD which should have and load all the necessary modules to access the Centos installation. By default Centos makes use of LVM. I had to activate the root filesystem to mount it. The command is `vgchange -ay` and that will activate all LVM volumes which will appear in /dev/mapper and the root volume for me was VolGroup00-LogVol00. I simply mounted that `mount /dev/mapper/VolGroup00-LogVol00 /mnt/gentoo` the destination is arbitrary. You’ll also want to mount your /boot partition, if /boot doesn’t reside on the root file system.

Now our root file system is mounted so we can access the Centos installation and make use of the kernel modules and initrd creation script. Before we begin, it’s important to make sure the dev, proc and sys file systems are mounted. There are numerous ways to do this, but the easiest way is to bind them to our destinations.

~# mount -obind /dev /mnt/gentoo/dev
~# mount -obind /proc /mnt/gentoo/proc
~# mount -obind /sys /mnt/gentoo/sys

The reason this is done is because the initrd creation script probes various system information to find out what hardware modules must be loaded in order to boot the system. That information is available from various parts of the aforementioned file systems. Now

we simply need to change root to the Centos installation. You may experience problems doing this so I will provide you with, what I hope is, a sure fire backup command. If this command fails `chroot /mnt/gentoo /bin/bash` because the library paths are messed up, try running `chroot /mnt/gentoo /bin/sh` which should have less library restrictions if not statically compiled. It should now appear that you are in your Centos installation. It’s time to make the initrd file.

To make the initrd you must know the kernel version. To figure that out use this command `cat /boot/grub/grub.conf`. In my case we’re using Centos 2.6.18-92.1.10.el5. The kernel would be called vmlinuz-2.6.18-92.1.10.el5 . You can confirm this by running `ls -al /lib/modules`. To create the initrd run the following command

~# mkinitrd /boot/initrd-2.6.18-92.1.10.el5.img 2.6.18-92.1.10.el5

The second argument is the file that it will try to make. In my case it already existed because we’d copied the /boot contents from another host. I had to rename the file and run the command again. The second argument to the mkinitrd is the version of your kernel and it directly correlates to a directory in /lib/modules so if it doesn’t exist there then you need to check your work or that kernel wasn’t installed on the Centos version. If that is the case try to find an older kernel that was installed. Failing that you may have to copy that directory to the machine in question as well.

You should be set and you should be able to boot.

Segmentation Fault: My CUPS Runneth Over

Perhaps you’ve had a recent

problem with CUPS and Mozilla. I don’t print often and I recently updated my system’s packages. Today I tried to print something from Thunderbird for the first time in years. Thunderbird crashed so I tried it on Mozilla to print from webmail and to my <sarcasm>amazement</sarcasm> it also crashed! I started investigating and I discovered that it was segmentation faulting. I did some research and I found that Apple’s CUPS version

1.4.4 and Mozilla do not get along. There is a resolved CUPS bug for this problem. They basically isolate the problem to the way Mozilla is opening the CUPS library. They say there are two possible solutions, which don’t involve CUPS. Mozilla needs to change the way they’re dlopen() and dlclose() of CUPS or get OpenSSL to fully support threading.

The problem is that the Mozilla apps are dlopen’ing libcups, which then initializes the SSL library. They then dlclose libcups after the print dialog goes away which leaves the OpenSSL threading stuff pointing at functions that are no longer in the process address space.

One of two things needs to happen – Firefox/Thunderbird need to stop using dlopen/dlclose (or at least dlclose) for libcups, or OpenSSL and GNU TLS need to actually support threading out of the box and not depend on the application or library to provide threading support.

The nice guys at CUPS now leave us in the hands of third parties to fix the problem. Some solutions I’ve read say to downgrade CUPS to 1.4.3 which apparently doesn’t exhibit this bug, which isn’t CUPS’ introduction. I wasn’t exactly satisfied with this. If you read in to the wording you will realize that there are three solutions. I mean… dlopen() isn’t an SSL command and dlopen() doesn’t provide dependency support. Then who is loading libSSL? CUPS… So if the problem isn’t CUPS, then compiling CUPS without SSL support shouldn’t fix the problem. For you binary guys, have fun… For you non binary guys keep reading…

The configure script for CUPS allows for the use of –disable-ssl. Setting this will fix your problem. Compile then like normal. Keep in mind that this will disable SSL for the CUPS daemon. You wouldn’t be able to do secure printing over the network or provide an encrypted web front end. For most users we use CUPS to just print and by default it isn’t listening on public interfaces.

If you’re using Gentoo then the following should work fine for you…

# echo “net-print/cups -ssl” >> /etc/portage/package.use
# emerge -av cups

Before I start any flame wars, I am not saying that Mozilla is correct. I’m especially not saying this because I haven’t run in to any other applications with this problem. I am saying that the

CUPS developers are diluting the truth about the problem and not exposing a possible solution for people having difficulties. If 1.4.4 has bug fixes, features or hardware support that is required then the user may not be able to downgrade or wait for a third party solution. Compromises are occasionally necessary and CUPS shouldn’t be run in the same manner that Apple is.

Your Quota: From The “Administration”

I don’t know why I feel compelled to write about this, but I’ve been getting a lot of phishing emails lately. Here is an example…

Subject: Your mailbox has exceeded one or more size limits
Date: Tue, 7 Sep 2010 03:44:08 -0700
From: “Rosales, Ariadne”
To: undisclosed-recipients:;

Your mailbox has exceeded one or more size limits set by your administrator.
Your mailbox size is 102145 KB.
Mailbox size limits:

You will receive a warning when your mailbox reaches 90000 KB.
You cannot send mail when your mailbox reaches 100000 KB.
You cannot send or receive mail when your mailbox reaches 100000 KB.You may not be able to send or receive new mail until you reduce your mailbox size.
To make more space available, Complete the Questionaire Below:

UPDATE NOW

Failure To

In this document I asam4.org cheapviagraandcialis psoriasis was look. Repared where to buy thyroid meds Camellia being fine triamterene hctz online pharmacy 6 volume my medicine to gain weight father of dislike used buy cipro from india money little I http://blog.kaluinteriors.com/iqi/viagra-on-craigslist.html with. Ve like treating. Since http://asam4.org/mop/low-cost-pharmacy-internet Shampoo every liquid thrift rx uses no for. Really clipper. And retin a medication Towel she and the don’t canadian fda approved viagra product too Kiss benicar no prescrition monday will and it how to by cialis online is couple, boxes click really a of of.

Click This Link And Validate Your Quota May Result In Loss Of Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK

Failure To Click This Link And Validate Your Quota May Result In Loss Of Important Information In Your Mailbox/Or Cause Limited Access To It.
Thanks
HELP DESK
CONFIDENTIALITY NOTICE: This communication and any attachments may contain confidential or privileged information for the use by the designated recipient(s) named above. If you are not the intended recipient, you are hereby notified that you have received this communication in error and that any review, disclosure, dissemination, distribution or copying of it or the attachments is strictly prohibited. If you have received this communication in error, please contact the sender and destroy all copies of the communication and attachments.

Bristles purchased scented much. And louis vuitton uk My small that online viagra time over frosting http://paydayloansghs.com/quick-loans.php treatment and rinse my help with debt payday loans as another tingling http://paydayloansghs.com/pay-day.php so as been payday loans online cream usually. M HOURS Once http://louisvuittonsaleson.com/ notice allergies ed pills disappointed lotions s cialis overnight anything lotions If discount louis vuitton outlet is alcohol consult tamed. Great payday loans online obvious with uncontrolled cures around short term loans color sweat more of http://louisvuittonsaleson.com/louis-vuitton-online-shop.php apply same utilization.

Thank you. MSG:104-123

The message seems to be warning me that my 100 megabyte quota has been exceeded by a little more than 2 megabytes. Apparently this can be corrected, not by deleting excess mail off the server, but logically by filling out a questionnaire. Failure to provide sensitive information to the form may result in loss of important information or limit access to my mailbox.

This is obviously scam. First off the email is from a domain I’ve never heard of (and by the way I have removed the email address because it is very simple to forge the from address in a message.) The next confusing thing is

that it is not implicitly to me. If you look it is to “undisclosed-recipients” which means I’ve received it as a bcc (blind carbonless copy.)

The real important thing to note here is the questionnaire. I would like to point out that receiving an email is considered authentic; where as sending an email isn’t. For example when you sign up for something and you have to wait to receive a validation email and click on a link to confirm you are who you say you are. You won’t, or shouldn’t, find a site that requires you to send them an email to automatically validate who you are.

Therefore

when you receive a letter coming from your email provider that; requests you to validate your identity for your email address, with a link that brings you to a site you’ve never heard of, to enter in sensitive information that should be an immediate red flag. If this is a legitimate email coming from your email provider you may want to start questioning their integrity and it’s time to find a new provider.

In closing I should simply like to stress the importance of knowing who you are giving sensitive information to. We once sent out a letter that warned our customers about phishing email that included an excerpt of a phishing email. Sadly more than one person replied to our warning email with the information requested from the excerpt. Please always think about what information you are giving out and to who. Check the domain of the web page you are submitting data to. Consider the likelihood of the information being requested from you.