semantics of --ignore-install

semantics of --ignore-install

[Marco d'Itri]

[-- Attachment #1: Type: text/plain, Size: 5646 bytes --]

Bug or feature?

diff -U 0 \
  <(modprobe -q --show-depends nfs) \
  <(modprobe -q --show-depends nfs --ignore-install)

----- Forwarded message from Andras Korn <korn-debbugs@elan.rulez.org> -----

From: Andras Korn <korn-debbugs@elan.rulez.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#1022172: /lib/modprobe.d/50-nfs.conf causes initramfs-tools to
	stop including sunrpc module for nfs

Package: kmod
Version: 30+20220905-1
Severity: important

Hi,

I noticed that the sunrpc module was strangely absent from my initramfs, which resulted in a failure to netboot (which is my justification for the severity).

Upon examination, it turns out that the way module dependencies are worked out for initramfs generation depend on the output of this command:

# /sbin/modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/net/sunrpc/sunrpc.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/lockd/lockd.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs/nfs.ko 

This, above, is what the output looked like with versions of nfs-kernel-server before 1:2.6.2-1+b1, which didn't ship /lib/modprobe.d/50-nfs.conf.

With the new version of nfs-kernel-server, the output becomes:

# /sbin/modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko 
install /sbin/modprobe --ignore-install sunrpc $CMDLINE_OPTS && { /sbin/sysctl -q --pattern sunrpc --system; exit 0; } 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko 
install /sbin/modprobe --ignore-install lockd $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs.n[sl]m --system; exit 0; } 
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs/nfs.ko 

This confuses manual_add_modules() from /usr/share/initramfs-tools/hook-functions, which expects to only see insmod lines, not install lines here.

I thought --ignore-install was completely broken, but no, because without it, the output contains *more* "install" lines:

# /sbin/modprobe --all --set-version="6.0.0-1-amd64" --quiet --show-depends nfs
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko
install /sbin/modprobe --ignore-install sunrpc $CMDLINE_OPTS && { /sbin/sysctl -q --pattern sunrpc --system; exit 0; }
insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko
install /sbin/modprobe --ignore-install lockd $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs.n[sl]m --system; exit 0; }
install /sbin/modprobe --ignore-install nfs $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs --system; exit 0; }

If the /lib/modprobe.d/50-nfs.conf shipped by nfs-kernel-server is valid, then modprobe --ignore-install doesn't handle it correctly; if it's invalid, then I suppose modprobe should print an error. There seems to be a problem with modprobe either way, unless initramfs-tools misunderstands the purpose of --ignore-install.

Best regards,

András

-- System Information:
Debian Release: bookworm/sid
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (350, 'unstable'), (1, 'experimental')
merged-usr: no
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.17.15-caeeng (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=hu_HU.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8
Shell: /bin/sh linked to /bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

-- 
 Perl: The only language that looks the same before and after RSA encryption.

----- End forwarded message -----
----- Forwarded message from Marco d'Itri <md@Linux.IT> -----

From: Marco d'Itri <md@Linux.IT>
To: Andras Korn <korn-debbugs@elan.rulez.org>, 1022172@bugs.debian.org,
	initramfs-tools@packages.debian.org, nfs-utils@packages.debian.org
Subject: Bug#1022172: /lib/modprobe.d/50-nfs.conf causes initramfs-tools to
	stop including sunrpc module for nfs

On Oct 21, Andras Korn <korn-debbugs@elan.rulez.org> wrote:

> I thought --ignore-install was completely broken, but no, because without it, the output contains *more* "install" lines:
What you are actually seeing is that --ignore-install is applied only to 
the nfs module (the one which you have requested to load) but not to its 
own dependencies:

diff -U 0 <(modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs) <(modprobe --all --set-version="6.0.0-1-amd64" --quiet --show-depends nfs)

I am not sure if this is a bug or a feature, so this should be discussed 
with the upstream maintainer.

So the possible solutions are:
- the semantics of --ignore-install are changed upstream (this may take 
  some time)
- initramfs-tools learns to parse the install directives
- nfs-kernel-server uses a different design

No matter what happens to --ignore-install I suggest that 
nfs-kernel-server will replace the modprobe configuration with some udev 
rules like this one (untested):

ACTION=="add", SUBSYSTEM=="module", KERNEL=="sunrpc", \
  RUN+="/sbin/sysctl -q --pattern sunrpc --system"

-- 
ciao,
Marco



----- End forwarded message -----

-- 
ciao,
Marco

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: semantics of --ignore-install

[Lucas De Marchi]

On Fri, Oct 21, 2022 at 11:27:07PM +0200, Marco d'Itri wrote:
>Bug or feature?
>
>diff -U 0 \
>  <(modprobe -q --show-depends nfs) \
>  <(modprobe -q --show-depends nfs --ignore-install)

--ignore-install only applies to the module you are passing in the
command line, not its dependencies. From MODPROBE(8):

        -i, --ignore-install, --ignore-remove
	   This option causes modprobe to ignore install and remove
	   commands in the configuration file (if any) for the module
	   specified on the command line (any dependent modules are
	   still subject to commands set for them in the configuration
	   file). Both install and remove commands will currently be
	   ignored when this option is used regardless of whether the
	   request was more specifically made with only one or other
	   (and not both) of --ignore-install or --ignore-remove. See
	   modprobe.d(5).

There is also a warning in modprobe.d man page:

COMPATIBILITY
        A future version of kmod will come with a strong warning to avoid
        use of the install as explained above. This will happen once
        support for soft dependencies in the kernel is complete. That
        support will complement the existing softdep support within this
        utility by providing such dependencies directly within the
        modules.

At some point I stopped trying to remove it though as distros ship
these kind of tweaks 

Lucas De Marchi

>
>----- Forwarded message from Andras Korn <korn-debbugs@elan.rulez.org> -----
>
>From: Andras Korn <korn-debbugs@elan.rulez.org>
>To: Debian Bug Tracking System <submit@bugs.debian.org>
>Subject: Bug#1022172: /lib/modprobe.d/50-nfs.conf causes initramfs-tools to
>	stop including sunrpc module for nfs
>
>Package: kmod
>Version: 30+20220905-1
>Severity: important
>
>Hi,
>
>I noticed that the sunrpc module was strangely absent from my initramfs, which resulted in a failure to netboot (which is my justification for the severity).
>
>Upon examination, it turns out that the way module dependencies are worked out for initramfs generation depend on the output of this command:
>
># /sbin/modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/net/sunrpc/sunrpc.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/lockd/lockd.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs/nfs.ko
>
>This, above, is what the output looked like with versions of nfs-kernel-server before 1:2.6.2-1+b1, which didn't ship /lib/modprobe.d/50-nfs.conf.
>
>With the new version of nfs-kernel-server, the output becomes:
>
># /sbin/modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko
>install /sbin/modprobe --ignore-install sunrpc $CMDLINE_OPTS && { /sbin/sysctl -q --pattern sunrpc --system; exit 0; }
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko
>install /sbin/modprobe --ignore-install lockd $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs.n[sl]m --system; exit 0; }
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs/nfs.ko
>
>This confuses manual_add_modules() from /usr/share/initramfs-tools/hook-functions, which expects to only see insmod lines, not install lines here.
>
>I thought --ignore-install was completely broken, but no, because without it, the output contains *more* "install" lines:
>
># /sbin/modprobe --all --set-version="6.0.0-1-amd64" --quiet --show-depends nfs
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/netfs/netfs.ko
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/fscache/fscache.ko
>install /sbin/modprobe --ignore-install sunrpc $CMDLINE_OPTS && { /sbin/sysctl -q --pattern sunrpc --system; exit 0; }
>insmod /lib/modules/6.0.0-1-amd64/kernel/fs/nfs_common/grace.ko
>install /sbin/modprobe --ignore-install lockd $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs.n[sl]m --system; exit 0; }
>install /sbin/modprobe --ignore-install nfs $CMDLINE_OPTS && { /sbin/sysctl -q --pattern fs.nfs --system; exit 0; }
>
>If the /lib/modprobe.d/50-nfs.conf shipped by nfs-kernel-server is valid, then modprobe --ignore-install doesn't handle it correctly; if it's invalid, then I suppose modprobe should print an error. There seems to be a problem with modprobe either way, unless initramfs-tools misunderstands the purpose of --ignore-install.
>
>Best regards,
>
>András
>
>-- System Information:
>Debian Release: bookworm/sid
>  APT prefers stable-security
>  APT policy: (500, 'stable-security'), (350, 'unstable'), (1, 'experimental')
>merged-usr: no
>Architecture: amd64 (x86_64)
>Foreign Architectures: i386
>
>Kernel: Linux 5.17.15-caeeng (SMP w/8 CPU threads; PREEMPT)
>Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
>Locale: LANG=en_US.UTF-8, LC_CTYPE=hu_HU.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8
>Shell: /bin/sh linked to /bin/dash
>Init: runit (via /run/runit.stopit)
>LSM: AppArmor: enabled
>
>-- 
> Perl: The only language that looks the same before and after RSA encryption.
>
>----- End forwarded message -----
>----- Forwarded message from Marco d'Itri <md@Linux.IT> -----
>
>From: Marco d'Itri <md@Linux.IT>
>To: Andras Korn <korn-debbugs@elan.rulez.org>, 1022172@bugs.debian.org,
>	initramfs-tools@packages.debian.org, nfs-utils@packages.debian.org
>Subject: Bug#1022172: /lib/modprobe.d/50-nfs.conf causes initramfs-tools to
>	stop including sunrpc module for nfs
>
>On Oct 21, Andras Korn <korn-debbugs@elan.rulez.org> wrote:
>
>> I thought --ignore-install was completely broken, but no, because without it, the output contains *more* "install" lines:
>What you are actually seeing is that --ignore-install is applied only to
>the nfs module (the one which you have requested to load) but not to its
>own dependencies:
>
>diff -U 0 <(modprobe --all --set-version="6.0.0-1-amd64" --ignore-install --quiet --show-depends nfs) <(modprobe --all --set-version="6.0.0-1-amd64" --quiet --show-depends nfs)
>
>I am not sure if this is a bug or a feature, so this should be discussed
>with the upstream maintainer.
>
>So the possible solutions are:
>- the semantics of --ignore-install are changed upstream (this may take
>  some time)
>- initramfs-tools learns to parse the install directives
>- nfs-kernel-server uses a different design
>
>No matter what happens to --ignore-install I suggest that
>nfs-kernel-server will replace the modprobe configuration with some udev
>rules like this one (untested):
>
>ACTION=="add", SUBSYSTEM=="module", KERNEL=="sunrpc", \
>  RUN+="/sbin/sysctl -q --pattern sunrpc --system"
>
>-- 
>ciao,
>Marco
>
>
>
>----- End forwarded message -----
>
>-- 
>ciao,
>Marco