DRACUT.CMDLINE(7) ================= :doctype: manpage :man source: dracut :man manual: dracut :man version: {version} NAME ---- dracut.cmdline - dracut kernel command line options DESCRIPTION ----------- The root device used by the kernel is specified in the boot configuration file on the kernel command line, as always. The traditional _root=/dev/sda1_ style device specification is allowed, but not encouraged. The root device should better be identified by LABEL or UUID. If a label is used, as in _root=LABEL=_ the initramfs will search all available devices for a filesystem with the appropriate label, and mount that device as the root filesystem. _root=UUID=_ will mount the partition with that UUID as the root filesystem. In the following all kernel command line parameters, which are processed by dracut, are described. "rd.*" parameters mentioned without "=" are boolean parameters. They can be turned on/off by setting them to {0|1}. If the assignment with "=" is missing "=1" is implied. For example _rd.info_ can be turned off with _rd.info=0_ or turned on with _rd.info=1_ or _rd.info_. The last value in the kernel command line is the value, which is honored. Standard ~~~~~~~~ **init=**____:: specify the path to the init program to be started after the initramfs has finished **root=**____:: specify the block device to use as the root filesystem. + [listing] .Example -- root=/dev/sda1 root=/dev/disk/by-path/pci-0000:00:1f.1-scsi-0:0:1:0-part1 root=/dev/disk/by-label/Root root=LABEL=Root root=/dev/disk/by-uuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7 root=UUID=3f5ad593-4546-4a94-a374-bcfb68aa11f7 root=PARTUUID=3f5ad593-4546-4a94-a374-bcfb68aa11f7 -- **rootfstype=**____:: "auto" if not specified. + [listing] .Example -- rootfstype=ext4 -- **rootflags=**____:: specify additional mount options for the root filesystem. If not set, _/etc/fstab_ of the real root will be parsed for special mount options and mounted accordingly. **ro**:: force mounting _/_ and _/usr_ (if it is a separate device) read-only. If none of ro and rw is present, both are mounted according to _/etc/fstab_. **rw**:: force mounting _/_ and _/usr_ (if it is a separate device) read-write. See also ro option. **rootfallback=**____:: specify the block device to use as the root filesystem, if the normal root cannot be found. This can only be a simple block device with a simple file system, for which the filesystem driver is either compiled in, or added manually to the initramfs. This parameter can be specified multiple times. **rd.auto** **rd.auto=1**:: enable autoassembly of special devices like cryptoLUKS, dmraid, mdraid or lvm. Default is off as of dracut version >= 024. **rd.hostonly=0**:: removes all compiled in configuration of the host system the initramfs image was built on. This helps booting, if any disk layout changed, especially in combination with rd.auto or other parameters specifying the layout. **rd.cmdline=ask**:: prompts the user for additional kernel command line parameters **rd.fstab=0**:: do not honor special mount options for the root filesystem found in _/etc/fstab_ of the real root. **resume=**____:: resume from a swap partition + [listing] .Example -- resume=/dev/disk/by-path/pci-0000:00:1f.1-scsi-0:0:1:0-part1 resume=/dev/disk/by-uuid/3f5ad593-4546-4a94-a374-bcfb68aa11f7 resume=UUID=3f5ad593-4546-4a94-a374-bcfb68aa11f7 -- **rd.skipfsck**:: skip fsck for rootfs and _/usr_. If you're mounting _/usr_ read-only and the init system performs fsck before remount, you might want to use this option to avoid duplication. iso-scan/filename ~~~~~~~~~~~~~~~~~ Mount all mountable devices and search for ISO pointed by the argument. When the ISO is found set it up as a loop device. Device containing this ISO image will stay mounted at /run/initramfs/isoscandev. Using iso-scan/filename with a Fedora/Red Hat/CentOS Live iso should just work by copying the original kernel cmdline parameters. [listing] .Example -- menuentry 'Live Fedora 20' --class fedora --class gnu-linux --class gnu --class os { set isolabel=Fedora-Live-LXDE-x86_64-20-1 set isofile="/boot/iso/Fedora-Live-LXDE-x86_64-20-1.iso" loopback loop $isofile linux (loop)/isolinux/vmlinuz0 boot=isolinux iso-scan/filename=$isofile root=live:LABEL=$isolabel ro rd.live.image quiet rhgb initrd (loop)/isolinux/initrd0.img } -- Misc ~~~~ **rd.emergency=**__[reboot|poweroff|halt]__:: specify, what action to execute in case of a critical failure. rd.shell=0 must also be specified. **rd.driver.blacklist=**____[,____,...]:: do not load kernel module . This parameter can be specified multiple times. **rd.driver.pre=**____[,____,...]:: force loading kernel module . This parameter can be specified multiple times. **rd.driver.post=**____[,____,...]:: force loading kernel module after all automatic loading modules have been loaded. This parameter can be specified multiple times. **rd.retry=**____:: specify how long dracut should retry the initqueue to configure devices. The default is 180 seconds. After 2/3 of the time, degraded raids are force started. If you have hardware, which takes a very long time to announce its drives, you might want to extend this value. **rd.timeout=**____:: specify how long dracut should wait for devices to appear. The default is '0', which means 'forever'. Note that this timeout should be longer than rd.retry to allow for proper configuration. **rd.noverifyssl**:: accept self-signed certificates for ssl downloads. **rd.ctty=**____:: specify the controlling terminal for the console. This is useful, if you have multiple "console=" arguments. **rd.shutdown.timeout.umount=**____:: specify how long dracut should wait for an individual umount to finish during shutdown. This avoids the system from blocking when unmounting a file system cannot complete and waits indefinitely. Value '0' means to wait 'forever'. The default is 90 seconds. [[dracutkerneldebug]] Debug ~~~~~ If you are dropped to an emergency shell, the file _/run/initramfs/rdsosreport.txt_ is created, which can be saved to a (to be mounted by hand) partition (usually /boot) or a USB stick. Additional debugging info can be produced by adding **rd.debug** to the kernel command line. _/run/initramfs/rdsosreport.txt_ contains all logs and the output of some tools. It should be attached to any report about dracut problems. **rd.info**:: print informational output though "quiet" is set **rd.shell**:: allow dropping to a shell, if root mounting fails **rd.debug**:: set -x for the dracut shell. If systemd is active in the initramfs, all output is logged to the systemd journal, which you can inspect with "journalctl -ab". If systemd is not active, the logs are written to dmesg and _/run/initramfs/init.log_. If "quiet" is set, it also logs to the console. **rd.memdebug=[0-5]**:: Print memory usage info at various points, set the verbose level from 0 to 5. + Higher level means more debugging output: + ---- 0 - no output 1 - partial /proc/meminfo 2 - /proc/meminfo 3 - /proc/meminfo + /proc/slabinfo 4 - /proc/meminfo + /proc/slabinfo + memstrack summary NOTE: memstrack is a memory tracing tool that tracks the total memory consumption, and peak memory consumption of each kernel modules and userspace progress during the whole initramfs runtime, report is generated and the end of initramsfs run. 5 - /proc/meminfo + /proc/slabinfo + memstrack (with top memory stacktrace) NOTE: memstrack (with top memory stacktrace) will print top memory allocation stack traces during the whole initramfs runtime. ---- **rd.break**:: drop to a shell at the end **rd.break=**__{cmdline|pre-udev|pre-trigger|initqueue|pre-mount|mount|pre-pivot|cleanup}__:: drop to a shell before the defined breakpoint starts **rd.udev.info**:: set udev to loglevel info **rd.udev.debug**:: set udev to loglevel debug I18N ~~~~ **rd.vconsole.keymap=**____:: keyboard translation table loaded by loadkeys; taken from keymaps directory; will be written as KEYMAP to _/etc/vconsole.conf_ in the initramfs. + [listing] .Example -- rd.vconsole.keymap=de-latin1-nodeadkeys -- **rd.vconsole.keymap.ext=**____:: list of extra keymaps to bo loaded (sep. by space); will be written as EXT_KEYMAP to _/etc/vconsole.conf_ in the initramfs **rd.vconsole.unicode**:: boolean, indicating UTF-8 mode; will be written as UNICODE to _/etc/vconsole.conf_ in the initramfs **rd.vconsole.font=**____:: console font; taken from consolefonts directory; will be written as FONT to _/etc/vconsole.conf_ in the initramfs. + [listing] .Example -- rd.vconsole.font=eurlatgr -- **rd.vconsole.font.map=**____:: see description of '-m' parameter in setfont manual; taken from consoletrans directory; will be written as FONT_MAP to _/etc/vconsole.conf_ in the initramfs **rd.vconsole.font.unimap=**____:: see description of '-u' parameter in setfont manual; taken from unimaps directory; will be written as FONT_UNIMAP to _/etc/vconsole.conf_ in the initramfs **rd.locale.LANG=**____:: taken from the environment; if no UNICODE is defined we set its value in basis of LANG value (whether it ends with ".utf8" (or similar) or not); will be written as LANG to _/etc/locale.conf_ in the initramfs. + [listing] .Example -- rd.locale.LANG=pl_PL.utf8 -- **rd.locale.LC_ALL=**____:: taken from the environment; will be written as LC_ALL to _/etc/locale.conf_ in the initramfs LVM ~~~ **rd.lvm=0**:: disable LVM detection **rd.lvm.vg=**____:: only activate all logical volumes in the the volume groups with the given name. rd.lvm.vg can be specified multiple times on the kernel command line. **rd.lvm.lv=**__/__:: only activate the logical volumes with the given name. rd.lvm.lv can be specified multiple times on the kernel command line. **rd.lvm.conf=0**:: remove any _/etc/lvm/lvm.conf_, which may exist in the initramfs crypto LUKS ~~~~~~~~~~~ **rd.luks=0**:: disable crypto LUKS detection **rd.luks.uuid=**____:: only activate the LUKS partitions with the given UUID. Any "luks-" of the LUKS UUID is removed before comparing to __. The comparisons also matches, if __ is only the beginning of the LUKS UUID, so you don't have to specify the full UUID. This parameter can be specified multiple times. __ may be prefixed by the keyword `keysource:`, see _rd.luks.key_ below. **rd.luks.allow-discards=**____:: Allow using of discards (TRIM) requests for LUKS partitions with the given UUID. Any "luks-" of the LUKS UUID is removed before comparing to __. The comparisons also matches, if __ is only the beginning of the LUKS UUID, so you don't have to specify the full UUID. This parameter can be specified multiple times. **rd.luks.allow-discards**:: Allow using of discards (TRIM) requests on all LUKS partitions. **rd.luks.crypttab=0**:: do not check, if LUKS partition is in _/etc/crypttab_ **rd.luks.timeout=**____:: specify how long dracut should wait when waiting for the user to enter the password. This avoid blocking the boot if no password is entered. It does not apply to luks key. The default is '0', which means 'forever'. crypto LUKS - key on removable device support ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ NB: If systemd is included in the dracut initrd, dracut's built in removable device keying support won't work. systemd will prompt for a password from the console even if you've supplied **rd.luks.key**. You may be able to use standard systemd *fstab*(5) syntax to get the same effect. If you do need **rd.luks.key** to work, you will have to exclude the "systemd" dracut module and any modules that depend on it. See *dracut.conf*(5) and https://bugzilla.redhat.com/show_bug.cgi?id=905683 for more information. **rd.luks.key=**_[:[:]]_:: __ is the pathname of a key file, relative to the root of the filesystem on some device. It's REQUIRED. When __ ends with '.gpg' it's considered to be key encrypted symmetrically with GPG. You will be prompted for the GPG password on boot. GPG support comes with the 'crypt-gpg' module, which needs to be added explicitly. + __ identifies the device on which the key file resides. It may be the kernel name of the device (should start with "/dev/"), a UUID (prefixed with "UUID=") or a label (prefix with "LABEL="). You don't have to specify a full UUID. Just its beginning will suffice, even if its ambiguous. All matching devices will be probed. This parameter is recommended, but not required. If it's not present, all block devices will be probed, which may significantly increase boot time. + If __ is given, the specified key will only be used for the specified LUKS device. Possible values are the same as for __. Unless you have several LUKS devices, you don't have to specify this parameter. The simplest usage is: + [listing] .Example -- rd.luks.key=/foo/bar.key -- + As you see, you can skip colons in such a case. [NOTE] =============================== Your LUKS partition must match your key file. dracut provides keys to cryptsetup with _-d_ (an older alias for _--key-file_). This uses the entire binary content of the key file as part of the secret. If you pipe a password into cryptsetup *without* _-d_ or _--key-file_, it will be treated as text user input, and only characters before the first newline will be used. Therefore, when you're creating an encrypted partition for dracut to mount, and you pipe a key into _cryptsetup luksFormat_,you must use _-d -_. Here is an example for a key encrypted with GPG (warning: _--batch-mode_ will overwrite the device without asking for confirmation): [listing] -- gpg --quiet --decrypt rootkey.gpg | \ cryptsetup --batch-mode --key-file - \ luksFormat /dev/sda47 -- If you use unencrypted key files, just use the key file pathname instead of the standard input. For a random key with 256 bits of entropy, you might use: [listing] -- head -32c /dev/urandom > rootkey.key cryptsetup --batch-mode --key-file rootkey.key \ luksFormat /dev/sda47 -- You can also use regular key files on an encrypted _keydev_. Compared to using GPG encrypted keyfiles on an unencrypted device this provides the following advantages: - you can unlock your disk(s) using multiple passphrases - better security by not losing the key stretching mechanism To use an encrypted _keydev_ you *must* ensure that it becomes available by using the keyword `keysource`, e.g. `rd.luks.uuid=keysource:aaaa` _aaaa_ being the uuid of the encrypted _keydev_. Example: Lets assume you have three disks _A_, _B_ and _C_ with the uuids _aaaa_, _bbbb_ and _cccc_. + You want to unlock _A_ and _B_ using keyfile _keyfile_. + The unlocked volumes be _A'_, _B'_ and _C'_ with the uuids _AAAA_, _BBBB_ and _CCCC_. + _keyfile_ is saved on _C'_ as _/keyfile_. One luks keyslot of each _A_, _B_ and _C_ is setup with a passphrase. + Another luks keyslot of each _A_ and _B_ is setup with _keyfile_. To boot this configuration you could use: [listing] -- rd.luks.uuid=aaaa rd.luks.uuid=bbbb rd.luks.uuid=keysource:cccc rd.luks.key=/keyfile:UUID=CCCC -- Dracut asks for the passphrase for _C_ and uses the keyfile to unlock _A_ and _B_. + If getting the passphrase for _C_ fails it falls back to asking for the passphrases for _A_ and _B_. If you want _C'_ to stay unlocked, specify a luks name for it, e.g. `rd.luks.name=cccc=mykeys`, otherwise it gets closed when not needed anymore. =============================== **rd.luks.key.tout=0**:: specify how many times dracut will try to read the keys specified in in rd.luk.key. This gives a chance to the removable device containing the key to initialise. MD RAID ~~~~~~~ **rd.md=0**:: disable MD RAID detection **rd.md.imsm=0**:: disable MD RAID for imsm/isw raids, use DM RAID instead **rd.md.ddf=0**:: disable MD RAID for SNIA ddf raids, use DM RAID instead **rd.md.conf=0**:: ignore mdadm.conf included in initramfs **rd.md.waitclean=1**:: wait for any resync, recovery, or reshape activity to finish before continuing **rd.md.uuid=**____:: only activate the raid sets with the given UUID. This parameter can be specified multiple times. DM RAID ~~~~~~~ **rd.dm=0**:: disable DM RAID detection **rd.dm.uuid=**____:: only activate the raid sets with the given UUID. This parameter can be specified multiple times. MULTIPATH ~~~~~~~~~ **rd.multipath=0**:: disable multipath detection **rd.multipath=default**:: use default multipath settings FIPS ~~~~ **rd.fips**:: enable FIPS **boot=**____:: specify the device, where /boot is located. + [listing] .Example -- boot=/dev/sda1 boot=/dev/disk/by-path/pci-0000:00:1f.1-scsi-0:0:1:0-part1 boot=UUID= boot=LABEL=