From 32fdd33749fdfb3ce714d5ab77e89e5da5c1289b Mon Sep 17 00:00:00 2001 From: Sergio Correia Date: Tue, 14 Jul 2026 08:55:43 +0000 Subject: [PATCH] Order clevis-luks-askpass after network-online.target Resolves: RHEL-186032 Signed-off-by: Sergio Correia --- ...r-clevis-luks-askpass-after-network-.patch | 43 ++++++++++++++++++ ...en-the-search-for-tang-bounded-devic.patch | 27 ++++++++++++ ...have_tang_bindings-failure-with-mult.patch | 44 +++++++++++++++++++ clevis.spec | 6 +++ 4 files changed, 120 insertions(+) create mode 100644 0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch create mode 100644 0002-dracut-tang-Harden-the-search-for-tang-bounded-devic.patch create mode 100644 0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch diff --git a/0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch b/0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch new file mode 100644 index 0000000..3098287 --- /dev/null +++ b/0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch @@ -0,0 +1,43 @@ +From 809abea0977627023d7258a02ac4e288bb2df5fc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= +Date: Thu, 18 Jun 2026 10:53:59 +0200 +Subject: [PATCH 1/3] dracut/tang: Order clevis-luks-askpass after + network-online.target + +When Tang bindings are present, rd.neednet=1 is set to bring up the +network in the initramfs, but clevis-luks-askpass.path has no ordering +dependency on network-online.target. This means systemd can activate +the askpass path unit before the network is ready, causing curl to fail +when contacting the Tang server. + +Install a systemd drop-in for clevis-luks-askpass.path that adds +After=network-online.target and Wants=network-online.target, ensuring +the network is online before clevis attempts to decrypt via Tang. +--- + src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +index 364f866..2368cb1 100755 +--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in ++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +@@ -37,6 +37,16 @@ have_tang_bindings() { + install() { + if [ "${hostonly_cmdline}" = "yes" ] && have_tang_bindings; then + echo "rd.neednet=1" > "${initdir}/etc/cmdline.d/99clevis-pin-tang.conf" ++ ++ if dracut_module_included "systemd"; then ++ # shellcheck disable=SC2154 # $systemdsystemunitdir is a dracut variable ++ mkdir -p "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d" ++ cat > "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d/network-online.conf" < +Date: Thu, 18 Jun 2026 15:09:08 +0200 +Subject: [PATCH 2/3] dracut/tang: Harden the search for "tang" bounded devices + +Let's say in the future that we have another PIN and we can write something +like "tango" in its configuration, we don't want it to match there. +--- + src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +index 2368cb1..5bed4be 100755 +--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in ++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +@@ -27,7 +27,7 @@ have_tang_bindings() { + . clevis-luks-common-functions + local dev + for dev in $(clevis_devices_to_unlock "list-open-devices"); do +- if clevis luks list -d "${dev}" -p | grep -q tang; then ++ if clevis luks list -d "${dev}" -p | grep -qw tang; then + return 0 + fi + done +-- +2.54.0 + diff --git a/0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch b/0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch new file mode 100644 index 0000000..87edda9 --- /dev/null +++ b/0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch @@ -0,0 +1,44 @@ +From 86e31d757d12757180fdab97b30be74c09d54adf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= +Date: Thu, 18 Jun 2026 15:51:40 +0200 +Subject: [PATCH 3/3] dracut/tang: Fix have_tang_bindings failure with multiple + tang slots + +Dracut sets 'set -o pipefail'. When have_tang_bindings runs +'clevis luks list -d DEV -p | grep -qw tang' on a device with +multiple tang slots, grep -q exits after matching the first slot, +closing the pipe. The still-running clevis luks list then gets +SIGPIPE when writing the second slot, exiting with code 141. +With pipefail, the pipeline returns 141 instead of 0, causing +have_tang_bindings to return 1 even though tang bindings exist. + +This means rd.neednet=1 is never written to the initramfs, so +NetworkManager is never started, and clevis cannot reach the +Tang server to unlock the LUKS volume. + +Fix by capturing the output in a variable first, then grepping +on the variable, avoiding the pipeline and SIGPIPE entirely. +--- + src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +index 5bed4be..431ac68 100755 +--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in ++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in +@@ -25,9 +25,10 @@ depends() { + + have_tang_bindings() { + . clevis-luks-common-functions +- local dev ++ local dev bindings + for dev in $(clevis_devices_to_unlock "list-open-devices"); do +- if clevis luks list -d "${dev}" -p | grep -qw tang; then ++ bindings="$(clevis luks list -d "${dev}" -p 2>/dev/null)" || : ++ if echo "${bindings}" | grep -qw tang; then + return 0 + fi + done +-- +2.54.0 + diff --git a/clevis.spec b/clevis.spec index e6a6d7e..1bf0a3f 100644 --- a/clevis.spec +++ b/clevis.spec @@ -8,6 +8,12 @@ URL: https://github.com/latchset/%{name} Source0: https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz Source1: clevis.sysusers +# Backport https://github.com/latchset/clevis/pull/562 +# dracut/tang: Order clevis-luks-askpass after network-online.target and more fixes +Patch: 0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch +Patch: 0002-dracut-tang-Harden-the-search-for-tang-bounded-devic.patch +Patch: 0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch + BuildRequires: git-core BuildRequires: gcc BuildRequires: meson