title: getaddrinfo() fails in homemade initrd. How do I debug the bootprocess?
body: <p>I'm trying to secure the bootprocess of my workstation with a self-written version of something like Anti-Evil-Maid, but I'm unable to get the TPM daemon running. The problem appears to be, that TCSD fails, as soon as an .getaddrinfo() call is triggered by a connecting client. This means, the program starts, but exits as soon as it's being used.</p>
  
  <p>So far I've tried to determine TCSDs prerequisites by a strace, and copied the relevant files and libs into the initrd, but as of now I didn't get beyond said point. Unfortunately I can't copy logs from the init process into this post, because all files are gone as soon as the root is changed, but I can tell you, what I've tried so far. I assume, that the problem is linked to the glibc or to the bootprocess in general, but I don't know, how I could debug it any further.</p>
  
  <p>Let's start with the files I've copied into the initramfs. The hook-script looks as follows:</p>
  
  <pre><code>#!/bin/sh
  # trousers TPM software
  
  PREREQ=""
  
  prereqs()
  {
     echo "$PREREQ"
  }
  
  case $1 in
  prereqs)
     prereqs
     exit 0
     ;;
  esac
  
  . /usr/share/initramfs-tools/hook-functions
  
  
  # Here it begins
  
  copy_exec /home/dev/build/aem/tpm_pcr_extend /bin
  copy_exec /usr/bin/shasum /bin
  copy_exec /usr/sbin/adduser /sbin
  copy_exec /usr/bin/strace /bin
  copy_exec /usr/bin/getent /bin
  
  copy_exec /usr/sbin/tcsd /sbin
  copy_exec /usr/bin/tpm_unsealdata /bin
  copy_exec /usr/bin/tpm_sealdata /bin
  copy_exec /usr/sbin/tpm_nvinfo /sbin
  copy_exec /usr/sbin/tpm_nvread /sbin
  copy_exec /usr/sbin/tpm_resetdalock /sbin
  copy_exec /usr/sbin/tpm_selftest /sbin
  copy_exec /usr/sbin/tpm_version /sbin
  # copy_exec /etc/tcsd.conf /etc
  
  copy_exec /usr/src/initrd/etc/passwd /etc
  copy_exec /usr/src/initrd/etc/shadow /etc
  copy_exec /usr/src/initrd/etc/group /etc
  copy_exec /usr/src/initrd/etc/hosts /etc
  copy_exec /usr/src/initrd/etc/hostname /etc
  copy_exec /etc/host.conf /etc
  copy_exec /etc/hosts /etc
  copy_exec /etc/nsswitch.conf /etc
  copy_exec /etc/services /etc
  
  copy_modules_dir kernel/drivers/char/tpm
  
  copy_exec /usr/lib/libopencryptoki.so.0 /lib
  copy_exec /usr/lib/opencryptoki/stdll/* /lib/opencryptoki
  
  copy_exec /usr/lib/x86_64-linux-gnu/libcrypto.a /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libcrypto.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 /lib
  
  copy_exec /usr/lib/x86_64-linux-gnu/libtspi.so /lib
  
  copy_exec /usr/lib/x86_64-linux-gnu/libtpm_unseal.so /lib
  
  copy_exec /lib/x86_64-linux-gnu/libdl-2.19.so /lib
  copy_exec /lib/x86_64-linux-gnu/libdl.so.2 /lib
  
  copy_exec /lib/x86_64-linux-gnu/libc.so.6 /lib
  copy_exec /usr/lib/libdns.so.100 /lib
  copy_exec /usr/lib/libbind9.so.90 /lib
  copy_exec /lib/x86_64-linux-gnu/libresolv.so.2 /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss3.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_compat.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_dns.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_files.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_hesiod.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_nis.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnss_nisplus.so /lib
  copy_exec /usr/lib/x86_64-linux-gnu/libnssutil3.so /lib
  
  copy_exec /usr/lib/x86_64-linux-gnu/libssl.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/libssl3.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/lib4758cca.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libaep.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libatalla.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libcapi.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libchil.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libcswift.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgmp.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libnuron.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpadlock.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libsureware.so /lib/
  copy_exec /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libubsec.so /lib/
  </code></pre>
  
  <p>Next, there is a shortened version of the script, I'd like to run:</p>
  
  <p><strong>/etc/initramfs-tools/scripts/local-top/trousers</strong></p>
  
  <pre><code>#!/bin/sh
  PREREQ="lvm2"
  prereqs()
  {
       echo "$PREREQ"
  }
  
  case $1 in
  prereqs)
       prereqs
       exit 0
       ;;
  esac
  
  . /scripts/functions
  
  # Begin real processing below this line
  
  UNSEALED_SECRET="/tmp/aem/unsealed_secret"
  SEALED_SECRET="/mnt/sealed_secret"
  TCSD_EXE="/sbin/tcsd"
  TCSD_PATH="/var/lib/tpm"
  BOOT_PARTITION="/dev/mapper/linux-boot"
  TPM_UNSEAL="/bin/tpm_unsealdata"
  
  # Necessary to get the lvm files in /dev/mapper/
  udevadm trigger
  udevadm settle
  vgchange -a y
  
  # test, whether the relevant stuff is there
  if [ ! -x $TCSD_EXE ]; then
      echo "TCSD executable not found"
  fi
  
  if [ ! -e $BOOT_PARTITION ]; then
      echo "Boot Partition not found"
  fi
  
  if [ ! -x $TPM_UNSEAL ]; then
      echo "TPM Unseal not found"
  fi
  
  mkdir -p /tmp/aem
  touch $UNSEALED_SECRET
  if [ ! -e $UNSEALED_SECRET ]; then
      echo "Unsealed Secret File could not be written"
  fi
  
  # mount boot volume into /mnt
  mkdir /mnt
  mount $BOOT_PARTITION /mnt
  if [ ! -e $SEALED_SECRET ]; then
      echo "Sealed Secret File not found"
  fi
  
  
  echo "Starting TCSD"
  
  # /etc/passwd is overwritten by mkinitramfs, but TCSD needs the user tss
  echo "tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin" &gt;&gt; /etc/passwd
  
  # basic network configuration. I'm not sure, if it's allright
  echo "domain localhost" &gt; /etc/resolv.conf
  echo "127.0.0.1 localhost" &gt; /etc/hosts
  echo "multi on" &gt; /etc/host.conf
  echo "order hosts" &gt;&gt; /etc/hosts.conf
  
  # make sure, the libs are in the searchpath
  PATS=$PATH:/lib
  PATH=$PATH:/usr/lib
  PATH=$PATH:/usr/lib/x86_64-linux-gnu
  PATH=$PATH:/usr/lib/opencryptoki
  PATH=$PATH:/lib/x86_64-linux-gnu
  PATH=$PATH:/lib64
  
  # fixes an old bug in dynamically linked binaries, but is probably useless nowadays
  export LD_LIBRARY_PATH="/lib64:/usr/lib:/usr/lib/x86_64-linux-gnu:/usr/lib/opencryptoki:/lib/x86_64-linux-gnu"
  
  # import TPM modules
  modprobe tpm
  modprobe tpm_tis interrupt=0 force=1
  modprobe tpm_i2c_stm_st33
  
  # set up loopback network
  ip link set dev lo up
  ip route add 127.0.0.1 dev lo
  
  # create /var/lib/tpm which TCSD wants
  mkdir -p $TCSD_PATH
  chmod 700 $TCSD_PATH
  chown tss:tss $TCSD_PATH
  
  # start tcsd with the default settings. 
  tcsd || panic "TCSD failed"
  
  # try to decrypt a sealed file:
  echo "Unsealing Secret"
  echo "Starting Unseal"
  mkdir -p /tmp/aem
  chmod ugo=rwx /tmp/aem
  
  # Here it fails:
  
  tpm_unsealdata -i $SEALED_SECRET -o $UNSEALED_SECRET
  
  echo ""
  echo "-----------"
  echo "File: $UNSEALED_SECRET"
  cat $UNSEALED_SECRET
  echo "-----------"
  echo ""
  
  
  echo "starting shell"
  sh
  
  echo "Cleaning up"
  killall tcsd
  rm -f /tmp/aem
  umount /mnt
  </code></pre>
  
  <p>So. That's it. When tpm_unsealdata tries to connect to TCSD, TCSD makes a getaddrinfo() call, fails, and exits. The same is true for all the other tools from the trousers/tpm-tools package. </p>
  
  <p>To be honest, I don't know too much about this early stage of the bootprocess, so I'm probably not seeing something, while being unable to debug this any further. Some help would be greatly appreciated.</p>