Discuss

discuss@lists.centos.org

34733 discussions

Centos 7 shim fix failed
by david 06 Aug '20

06 Aug '20

Following the advice on this mailing list, I rebuilt (from scratch) Centos 7.8. I added the following line into /etc/yum.conf before the first update: exclude=grub2* shim* mokutil The system worked fine. I was able to do general updates yum -y update and all was well. HOWEVER, following Johnny Hughes' directions: a) remove the 'exclude' line from yum.conf b) perform update: yum -y update c) reinstall kernel. Here the instructions were vague, so I typed in... yum reinstall kernel-3.10.0 deriving the "3.10.0" label by the output of rpm -qa | grep kernel Yum got up to the point: Running transaction Installing : kernel-3.10.0-1127.el7.x86_64 1/1 at which point the process appeared to hang. No further output happened for five minutes. I opened a different terminal and entered "shutdown -r now". The result is an unbootable system. What did I do wrong? I must admit that there are multiple copies of advice on the mailing list, so perhaps I followed the wrong one? ------------------------------ So now, I tried the 'repair' mechanism, but couldn't make that work either. So, it was back to initial from-scratch install. David

8 13

CentOS 8 DNS resolution not working as expected
by isdtor 06 Aug '20

06 Aug '20

[root@localhost ~]# lsb_release -d Description: CentOS Linux release 8.2.2004 (Core) [root@localhost ~]# cat /etc/resolv.conf # Generated by NetworkManager search subdomain.company.com company.com nameserver 1.2.3.4 nameserver 5.6.7.8 [root@localhost ~]# host foo foo.subdomain.company.com has address 1.2.3.4 [root@localhost ~]# host foo.subdomain Host foo.subdomain not found: 3(NXDOMAIN) [root@localhost ~]# host foo.subdomain.company.com foo.subdomain.company.com has address 1.2.3.4 [root@localhost ~]# The expected result is that the lookup for foo.subdomain works, like it does under CentOS < 8. I tested this also on a RHEL8 machine and followed https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… to disable DNS processing by NM, but this did not change the outcome. How can the pre-CentOS 8 behaviour be restored?

3 5

CentOS Security Advisories OVAL feed??
by centos＠niob.at 05 Aug '20

05 Aug '20

Dear List, I have spent some time playing around with oscap and the RHEL OVAL feed (https://www.redhat.com/security/data/oval/v2/RHEL8/, also check Chapter 16 of the RHEL 8 Design Guide). Because I could not find an existing OVAL file for CentOS, I downloaded one of the RHEL8 files and managed to modify (eg. the rhel-8.1-e4s.oval.xml) it to make it work on a CentOS machine. Basically I just had to change the package signing key check to use the CentOS key and I had to replace the redhat-release RPM package name with "centos-release". Obviously, this would violate all kinds of rights if redistributed, due to the fact that the upstream vendor is named all over the place, but technically it "worked". On an internal system running a freshly updated CentOS 8.1 system I ended up with three errors, titled: * RHSA-2019:4269: container-tools:rhel8 security and bug fix update (Important) * RHSA-2019:3403: container-tools:rhel8 security, bug fix, and enhancement update (Important) * RHSA-2019:2799: nginx:1.14 security update (Important) This raises some questions (some of them connected), namely: Q1) There are no equivalent CESA advisories for those RHSA advisories: why is that? Note that there are also no equivalent CentOS packages to those mentioned in the RHSA advisories. (My guess: because, when the advisories where issued, Centos already had moved on to 8.2) Q2) Does this indicate a problem in the release process / handling of upstream updates on the side of the CentOS project? Were the advisories missed at the time of issuance? Q3) Does this indicate that only the latest CentOS (minor) release can be considered "secure" or "patched"? Q4) Is there a native OVAL file released from the CentOS project covering these issues? It could be extremely similar to the RHEL one, but it should take the answers to the above questions into account (eg. it could require the latests minor-release and there would only be one file for CentOS 8 if the answer to Q3 is "yes"). Q5) If the answer to the last question is "no": shouldn't there be such a resource? Thanks for any answers. peter

5 8

Announcing the version 1.0 hexpeek release!
by hexpeek＠hexpeek.com 05 Aug '20

05 Aug '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Announcing the version 1.0 hexpeek release! I am pleased to announce the first stable release of hexpeek, which seeks to be an efficient, powerful, and portable hex editor for files of all kinds and sizes. This release improves on the beta release with a live undo, a greatly increased backup depth, better support for writing to non-seekable files, and some miscellaneous cleanup. Visit https://www.hexpeek.com for more information. Out of respect for the bandwidth on this mailing list, I do not plan to announce future hexpeek releases here. There is a mailing list on https://www.hexpeek.com where future announcements will be posted. If you are interested in hexpeek becoming a package/port for your distro, please let me know. -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEEfeRsn/lRU2hTiGbecMFr/kefAX8FAl8qMysUHGhleHBlZWtA aGV4cGVlay5jb20ACgkQcMFr/kefAX9U9w//QlTM/zrd25att9/yYcqbQPkDAqhr sjCtSfMoY6sLlsI1IFR1GDu0v0l+TiW4R2iDDn8dD7esLBrhHXe+QLWd9OjioCF7 jB3Tpg+ozk9GMmwDFglbU6hiwTAM4w7O4NKrLEuR/kQoWZzweEXGjIV2ytWhCpps tsl3c/t2rSG0SqlhcHrQpy0uZ38v7f7+o3BCH23gqzdAW+mvvPC9iYLfYJqUGDRt fc5zmouLai9ZAARpqK3Mhu/RTlv8DnxpmsIt2cSJ6OFVbonKBqvDk1RFbLqSUwhU iJv+wMF97f2HT7g1RCNG+GGClD0TvceFP+8qhwIYUhBaRXLe1u+gEEqXvmlURd0h m77ydS58Z1ND1YGw01rTTBzDxnW21HHTFCqGHfRKOjVcLEQrt8CkTvcf7tM5fX+n fodXdEv8k8rrhbOYDyWqurdekWPZCrvrzEPuF+Ww/W6ownW8RwP2cgNccfOiuC2P dTJdIe5j4VASLtC17iUcwDiQuZYWdK5oBlf/ws9flInFHOlGVUGXuD1pum05Iq1u OZeJEHJj+yvP1drm4A1O8z3r8XfPa2WmWsQBc0TP8lOvU3l/E20p1T3TPs8EQbqA dRJyN1PcAv63DE0USa2P+tB18jZkvDV15YT/6yDkOtKEgIdtSsw6H5oscs96LfuI cKK++c04aRN9e28= =02ro -----END PGP SIGNATURE-----

2 1

Re: [CentOS] Safe to do yum update now?
by Marc Balmer 04 Aug '20

04 Aug '20

> Am 04.08.2020 um 17:59 schrieb Jerome Lille <jerome.lille(a)ownbay.net>: > > Hello > > Luckily I was not afflicted by this boot hole problem. I haven't done > yum update in a week or so. I just want to make sure that now it is > safe to do yum update? It is. > > /Jerome > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos

1 0

Safe to do yum update now?
by Jerome Lille 04 Aug '20

04 Aug '20

Hello Luckily I was not afflicted by this boot hole problem. I haven't done yum update in a week or so. I just want to make sure that now it is safe to do yum update? /Jerome

1 0

Re: [CentOS] Boot failed on latest CentOS 7 update
by david 03 Aug '20

03 Aug '20

At 12:50 PM 8/1/2020, Kay Schenk wrote: >Totally and completely on my HP microfiber. Wouldn't get past anything to >even get me into the grub menu. NOT AMUSED! > >_______________________ >Kay Schenk I was going to confirm the same, but the system that became unbootable was my mail system :-( Apparently, the SHIM/GRUB bug has hit both Centos 7 and 8. Too bad Ubuntu is enough different that makes it hard to switch. David

21 38

Re: [CentOS] 8.2.2004 Latest yum update renders machine unbootable
by david 03 Aug '20

03 Aug '20

At 02:54 AM 8/1/2020, Alessandro Baggi wrote: >Hi Johnny, >thank you very much for clarification. > >You said that in the centos infrastructure only one server got the problem. >What are the conditions that permit the breakage? There is a particular >configuration (hw/sw) case that match always the problem or it is random? > >Thank you I have two servers running Centos 7 on apple hardware (one mac-mini and one mac server). They both failed to reboot a few days ago. So perhaps whatever anti-boot bug hit Centos 8, also hit Centos 7. I can't tell what version got updated since the system simply fails to boot. I don't even get a grub screen. I'll have to rebuild the systems from scratch. David

12 27

8.2.2004 Quick recovery and fix for unbootable machines
by Alan McRae 03 Aug '20

03 Aug '20

This is a quick recovery and fix for the machines rendered unbootable after the grub2/shim yum update. It is written for CentOS 8.2.2004 but similar should work for any CentOS 8 or 7 as long as you get the correct shim file, that is, the one from the latest installation media. I am running on an x86_64 architecture (see uname -i). Please use the correct shim file for your architecture (shim-<arch>-15-11.el8.<arch>.rpm) I have tested this by breaking a machine and then recovering it. It works for me. I hope someone finds it useful. Let me know. Regards Alan HOW TO BOOT AN UNBOOTABLE MACHINE ================================= 1) Download a copy of rEFind. This is a UEFI boot manager. Burn it to a USB key. # wget -O refind.zip http://sourceforge.net/projects/refind/files/0.12.0/refind-flashdrive-0.12.… # unzip refind.zip # cd refind-flashdrive-0.12.0 # dd if=refind-flashdrive-0.12.0.img bs=4096 of=/dev/sdX (sdX is the device for your USB key, this will be erased, use the whole device use sdX not sdX1) 1800+0 records in 1800+0 records out 7372800 bytes (7.4 MB, 7.0 MiB) copied, 0.980893 s, 7.5 MB/s 2) Turn off secureboot in your UEFI hardware. 3) Boot the USB key. You should get a colourful screen with icons and a filename below. Use the left/right arrow keys to select the correct grubx64.efi. Hit space to boot. Your usual grub menu should appear and the system should boot normally. HOW TO FIX THE PROBLEM ===================== 1) We need to downgrade the shim package. Now your system is running get an older copy of the correct shim package for your architecture from the CentOS installation media (e.g. CentOS-8.2.2004-x86_64-dvd1.iso) and install it. # mount CentOS-8.2.2004-x86_64-dvd1.iso /mnt # cd /mnt/BaseOS/Packages # cp shim-x64-15-11.el8.x86_64.rpm /root # cd /root # umount /mnt OR Get the package from a CentOS mirror: # cd /root # wget http://ucmirror.canterbury.ac.nz/linux/CentOS/8.2.2004/BaseOS/x86_64/os/Pac… 2) We can now reinstall the older shim package using yum. This will downgrade the package to the working version. # yum install shim-x64-15-11.el8.x86_64.rpm Last metadata expiration check: 2:11:11 ago on Sun 02 Aug 2020 11:31:06 NZST. Dependencies resolved. ==================================================================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================================================================== Downgrading: shim-x64 x86_64 15-11.el8 @commandline 647 k Transaction Summary ==================================================================================================================================================================================== Downgrade 1 Package Total size: 647 k Is this ok [y/N]: y Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Downgrading : shim-x64-15-11.el8.x86_64 1/2 Cleanup : shim-x64-15-13.el8.x86_64 2/2 Verifying : shim-x64-15-11.el8.x86_64 1/2 Verifying : shim-x64-15-13.el8.x86_64 2/2 Installed products updated. Downgraded: shim-x64-15-11.el8.x86_64 Complete! 3) Your system should now boot normally. 4) add "exclude=shim*" to /etc/yum.conf to prevent the broken one being reinstalled. You should now be able to run 'yum update'. Remove the exclude= when a proper fix becomes available.

5 5

GUI boot failure after latest shim (etc) updates
by Fred Smith 03 Aug '20

03 Aug '20

This isn't the problem everyone else has been talking about, but... I made sure that yum update offered the packages Johnny said it should then updated. when I rebooted everything looked normal except it was taking a long time to bring up the login screen. Flipped over to ALT-F2 and saw a message about waiting for Plymouth boot screen to quit. I waited a while and it went up to (and past) 15 minutes. It said "no limit" so it apparently would have gone on forever. I couldn't get to a text-mode screen with ALT-f[2-6] so I went down to my Linux laptop to see if I could ssh into this box. Lo and behold, ssh worked fine. So I ran top and saw a plymouth (or plymouthd, I forget which) at the top of the list. killed it, came back upstairs and it was no longer spewing that message. now ALT-f2 gave me a text login, that I'm using now. I ran startx and after a long-seeming wait I get a desktop, but it is NOT my normal Mate desktop. Might be Gnome (since I installed a Centos Gnome system and retrofitted Mate from EPEL). Johnny had said we needed to make sure the kernel was installed along with the shim, et al. I looked at the list of files YUM wanted to install and saw some kernel files, so I assumed all was well. But maybe I missed something. What info can I provide to help figure this out? Or, what Kernel files should I force to be (re)installed? Also, I don't very often manually force a kernel install, but I know that some of the files are updates and some are installs, I'd appreciate a reminder of which is which so I can force it. Thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss