image: verbose debugging options (#1159)

disk-mapper/cmd/main.go

@@ -134,6 +134,10 @@ func main() {
 		vtpm.OpenVTPM,
 	)
 
+	if err := setupManger.LogDevices(); err != nil {
+		log.With(zap.Error(err)).Fatalf("Failed to log devices")
+	}
+
 	// prepare the state disk
 	if mapper.IsLUKSDevice() {
 		// set up rejoin client

disk-mapper/internal/setup/setup.go

@@ -16,6 +16,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"io/fs"
 	"net"
 	"os"
 	"path/filepath"
@@ -32,6 +33,7 @@ import (
 	"github.com/edgelesssys/constellation/v2/internal/logger"
 	"github.com/edgelesssys/constellation/v2/internal/nodestate"
 	"github.com/spf13/afero"
+	"go.uber.org/zap"
 )
 
 const (
@@ -74,9 +76,8 @@ func New(log *logger.Logger, csp string, diskPath string, fs afero.Afero,
 // PrepareExistingDisk requests and waits for a decryption key to remap the encrypted state disk.
 // Once the disk is mapped, the function taints the node as initialized by updating it's PCRs.
 func (s *Manager) PrepareExistingDisk(recover RecoveryDoer) error {
-	s.log.Infof("Preparing existing state disk")
 	uuid := s.mapper.DiskUUID()
-
+	s.log.With(zap.String("uuid", uuid)).Infof("Preparing existing state disk")
 	endpoint := net.JoinHostPort("0.0.0.0", strconv.Itoa(constants.RecoveryPort))
 
 	passphrase, measurementSecret, err := recover.Do(uuid, endpoint)
@@ -91,6 +92,7 @@ func (s *Manager) PrepareExistingDisk(recover RecoveryDoer) error {
 	if err := s.mounter.MkdirAll(stateDiskMountPath, os.ModePerm); err != nil {
 		return err
 	}
+
 	// we do not care about cleaning up the mount point on error, since any errors returned here should cause a boot failure
 	if err := s.mounter.Mount(filepath.Join("/dev/mapper/", stateDiskMappedName), stateDiskMountPath, "ext4", syscall.MS_RDONLY, ""); err != nil {
 		return err
@@ -100,6 +102,7 @@ func (s *Manager) PrepareExistingDisk(recover RecoveryDoer) error {
 	if err != nil {
 		return err
 	}
+
 	clusterID, err := attestation.DeriveClusterID(measurementSecret, measurementSalt)
 	if err != nil {
 		return err
@@ -119,7 +122,7 @@ func (s *Manager) PrepareExistingDisk(recover RecoveryDoer) error {
 
 // PrepareNewDisk prepares an instances state disk by formatting the disk as a LUKS device using a random passphrase.
 func (s *Manager) PrepareNewDisk() error {
-	s.log.Infof("Preparing new state disk")
+	s.log.With(zap.String("uuid", s.mapper.DiskUUID())).Infof("Preparing new state disk")
 
 	// generate and save temporary passphrase
 	passphrase := make([]byte, crypto.RNGLengthDefault)
@@ -165,6 +168,51 @@ func (s *Manager) saveConfiguration(passphrase []byte) error {
 	return s.config.Generate(stateDiskMappedName, s.diskPath, filepath.Join(keyPath, keyFile), cryptsetupOptions)
 }
 
+// LogDevices logs all available block devices and partitions (lsblk like).
+func (s *Manager) LogDevices() error {
+	var devices []fs.FileInfo
+	dirs, err := os.ReadDir("/sys/class/block")
+	if err != nil {
+		return err
+	}
+	for _, file := range dirs {
+		if file.IsDir() {
+			continue
+		}
+		fileInfo, err := file.Info()
+		if err != nil {
+			return err
+		}
+		devices = append(devices, fileInfo)
+	}
+
+	s.log.Infof("List of all available block devices and partitions:")
+	for _, device := range devices {
+		var stat syscall.Statfs_t
+		dev := "/dev/" + device.Name()
+		if err := syscall.Statfs(dev, &stat); err != nil {
+			s.log.With(zap.Error(err)).Errorf("failed to statfs %s", dev)
+			continue
+		}
+
+		// get the raw size, in bytes
+		size := stat.Blocks * uint64(stat.Bsize)
+		free := stat.Bfree * uint64(stat.Bsize)
+		avail := stat.Bavail * uint64(stat.Bsize)
+
+		s.log.Infof(
+			"Name: %-15s, Size: %-10d, Mode: %s, ModTime: %s, Size = %-10d, Free = %-10d, Available = %-10d\n",
+			dev,
+			device.Size(),
+			device.Mode(),
+			device.ModTime(),
+			size,
+			free,
+			avail)
+	}
+	return nil
+}
+
 // RecoveryServer interface serves a recovery server.
 type RecoveryServer interface {
 	Serve(context.Context, net.Listener, string) (key, secret []byte, err error)
@@ -195,6 +243,7 @@ func NewNodeRecoverer(recoveryServer RecoveryServer, rejoinClient RejoinClient)
 func (r *NodeRecoverer) Do(uuid, endpoint string) (passphrase, measurementSecret []byte, err error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
+
 	lis, err := net.Listen("tcp", endpoint)
 	if err != nil {
 		return nil, nil, err

image/Makefile

@@ -11,6 +11,7 @@ IMAGE_VERSION                    ?= v0.0.0
 DEBUG                            ?= false
 AUTOLOGIN                        ?= false
 AUTOLOGIN_ARGS                   := $(if $(filter true,$(AUTOLOGIN)),--autologin) # set "--autologin" if AUTOLOGIN is true
+KERNEL_DEBUG_CMDLNE              := $(if $(filter true,$(DEBUG)),constellation.debug) # set "constellation.debug" if DEBUG is true
 export INSTALL_DEBUGD            ?= $(DEBUG)
 export CONSOLE_MOTD = $(AUTOLOGIN)
 -include $(CURDIR)/config.mk
@@ -44,6 +45,7 @@ mkosi.output.%/fedora~37/image.raw: mkosi.files/mkosi.%.conf inject-bins inject-
 		$(AUTOLOGIN_ARGS) \
 		--environment=INSTALL_DEBUGD \
 		--environment=CONSOLE_MOTD \
+		--kernel-command-line="$(KERNEL_DEBUG_CMDLNE)" \
 		build
 	secure-boot/signed-shim.sh $@
 	@if [ -n $(SUDO_UID) ] && [ -n $(SUDO_GID) ]; then \

image/mkosi.skeleton/usr/lib/dracut/modules.d/39constellation-mount/prepare-state-disk.service

@@ -5,11 +5,12 @@ After=network-online.target nss-lookup.target configure-constel-csp.service
 Wants=network-online.target
 Requires=initrd-root-fs.target
 FailureAction=reboot-immediate
+After=export_constellation_debug.service
 
 [Service]
 Type=oneshot
 EnvironmentFile=/run/constellation.env
-ExecStart=/bin/bash /usr/sbin/prepare-state-disk
+ExecStart=/bin/bash /usr/sbin/prepare-state-disk $CONSTELLATION_DEBUG_FLAGS
 RemainAfterExit=yes
 StandardOutput=tty
 StandardInput=tty

image/mkosi.skeleton/usr/lib/dracut/modules.d/39constellation-mount/prepare-state-disk.sh

@@ -6,9 +6,26 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
+# parsing of the command line arguments. check if argv[1] is --debug
+verbosity=0
+if [[ $# -gt 0 ]]; then
+  if [[ $1 == "--debug" ]]; then
+    verbosity=-1
+    echo "[Constellation] Debug mode enabled"
+  else
+    echo "[Constellation] Unknown argument: $1"
+    exit 1
+  fi
+else
+  echo "[Constellation] Debug mode disabled"
+fi
+
 # Prepare the encrypted volume by either initializing it with a random key or by aquiring the key from another bootstrapper.
 # Store encryption key (random or recovered key) in /run/cryptsetup-keys.d/state.key
-disk-mapper -csp "${CONSTEL_CSP}"
+disk-mapper \
+  -csp "${CONSTEL_CSP}" \
+  -v "${verbosity}"
+
 if [[ $? -ne 0 ]]; then
   echo "Failed to prepare state disk"
   sleep 2 # give the serial console time to print the error message

image/mkosi.skeleton/usr/lib/systemd/system-preset/30-constellation.preset

@@ -5,3 +5,4 @@ enable containerd.service
 enable kubelet.service
 enable systemd-networkd.service
 enable tpm-pcrs.service
+enable export_constellation_debug.service

image/mkosi.skeleton/usr/lib/systemd/system/constellation-bootstrapper.service

@@ -2,6 +2,7 @@
 Description=Constellation Bootstrapper
 Wants=network-online.target
 After=network-online.target configure-constel-csp.service
+After=export_constellation_debug.service
 
 [Service]
 Type=simple
@@ -9,7 +10,7 @@ RemainAfterExit=yes
 Restart=on-failure
 EnvironmentFile=/run/constellation.env
 Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
-ExecStart=/usr/bin/bootstrapper
+ExecStart=/usr/bin/bootstrapper $CONSTELLATION_DEBUG_FLAGS
 
 [Install]
 WantedBy=multi-user.target

image/mkosi.skeleton/usr/lib/systemd/system/constellation-upgrade-agent.service

@@ -1,12 +1,14 @@
 [Unit]
 Description=Constellation Upgrade Agent
+After=export_constellation_debug.service
 
 [Service]
 Type=simple
 RemainAfterExit=yes
 Restart=on-failure
+EnvironmentFile=/run/constellation.env
 Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
-ExecStart=/usr/bin/upgrade-agent
+ExecStart=/usr/bin/upgrade-agent $CONSTELLATION_DEBUG_FLAGS
 
 [Install]
 WantedBy=multi-user.target

image/mkosi.skeleton/usr/lib/systemd/system/export_constellation_debug.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Export Constellation Debug Level to Environment
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash -c "tr ' ' '\n' < /proc/cmdline | grep -q 'constellation.debug' && echo CONSTELLATION_DEBUG_FLAGS=--debug >> /run/constellation.env"
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target