Solutions

How to extract/unpack/uncompress the contents of the initramfs boot image on CentOS 7,8 ?

by ,


We have by far the largest RPM repository with NGINX module packages and VMODs for Varnish. If you want to install NGINX, Varnish, and lots of useful performance/security software with smooth yum upgrades for production use, this is the repository for you.
Active subscription is required.

Operating System and Software

  • CentOS 7
  • Rocky Linux 8

Note: For RHEL5 and RHEL6, refer to How to unpack/uncompress and repack/re-compress an initial ramdisk (initrd/initramfs) boot image file?

Problem

  • How to extract/unpack/uncompress the contents of the initramfs image on CentOS 7 and Rocky Linux 8?
  • In RHEL6 and older, the contents of the initramfs or initrd image could be extracted using cpio as shown below:

    # zcat initramfs-2.6.32-431.el6.x86_64.img | cpio -idmv
    
  • However, it does not work when I try to extract the contents of initramfs image on CentOS 7 as shown below and error is generated:

   # zcat initramfs-3.10.0-229.4.2.el7.x86_64.img | cpio -id
        
    gzip: initramfs-3.10.0-229.4.2.el7.x86_64.img: not in gzip format
    cpio: premature end of archive
    
    # file  initramfs-3.10.0-229.4.2.el7.x86_64.img 
    initramfs-3.10.0-229.4.2.el7.x86_64.img: ASCII cpio archive (SVR4 with no CRC)

How to Fix

  1. First, create a temporary work directory and switch into it. This will be the location where the initramfs contents will be unpacked into and viewed:
     mkdir /tmp/initrd cd /tmp/initrd
  2. Uncompress and extract the contents of the image in the /boot/ directory:
     /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r).img | gunzip -c | cpio -idmv
  • The $(uname -r) will use the file for the current kernel version. You may also specify a specific file, such as:
    /usr/lib/dracut/skipcpio /boot/initramfs-3.10.0-957.el7.x86_64.img | gunzip -c | cpio -idmv
  • You may now view the contents of the boot image and interact with them:
    # ls
    bin  dev  etc  init  lib  lib64  proc  root  run  sbin  shutdown  sys  sysroot  tmp  usr  var
  • Origin of the Problem

    The initramfs file now stores both CPU microcode and the initial boot image in the one “combined” image file.

    The CPU microcode is stored with CPIO compression, then the boot image is stored with its own separate compression.

    The kernel processes the one “combined” image file, uncompresses and loads the CPU microcode into the CPU, then uncompresses the boot image and starts init.

    When viewing this combined image file on a booted system, it is necessary to use skipcpio to “skip past” the CPIO-compressed CPU microcode to access the boot image.

    Reference:

    Leave a Reply

    This site uses Akismet to reduce spam. Learn how your comment data is processed.

    %d bloggers like this: