How to extract/unpack/uncompress the contents of the initramfs boot image on RHEL 7,8,9 ?

Solution Verified - Updated

Environment

  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 7

Note: For RHEL5 and RHEL6, refer to "How to unpack/uncompress and repack/re-compress an initial ramdisk (initrd/initramfs) boot image file?"

Issue

  • How to extract/unpack/uncompress the contents of the initramfs image on RHEL7 and RHEL8?

  • In RHEL6 and older, the contents of the initramfs or initrd image could be extracted using cpio as shown below:

    # zcat initramfs-2.6.32-431.el6.x86_64.img | cpio -idmv

  • However, it does not work when I try to extract the contents of initramfs image on RHEL7 as shown below and error is generated:


   # zcat initramfs-3.10.0-229.4.2.el7.x86_64.img | cpio -id

 gzip: initramfs-3.10.0-229.4.2.el7.x86_64.img: not in gzip format

cpio: premature end of archive


# file  initramfs-3.10.0-229.4.2.el7.x86_64.img 
initramfs-3.10.0-229.4.2.el7.x86_64.img: ASCII cpio archive (SVR4 with no CRC)</code></pre></blockquote></blockquote>



Resolution


There are two different /boot/initramfs*.img files that may be the target of an unpack operation:


A. ↴ Unpack /boot/initramfs-<kernel-version>.img, and

B. ↴ Unpack /boot/initramfs-<kernel-version>kdump.img




A. Unpack /boot/initramfs-<kernel-version>.img file


    

  1. # mkdir /tmp/initrd ; cd /tmp/initrd
    2. 

  2. # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r).img | gunzip -c | cpio -idmv
    3. 

  3. # ls
    4. 



 


  1. First, create a temporary work directory and switch into it. This will be the location where the initramfs contents will be unpacked into and viewed:

    • # mkdir /tmp/initrd ; cd    /tmp/initrd
    2. 

  2. Next, uncompress and extract the contents of the image from the /boot/ directory:

    • # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r).img | gunzip -c | cpio -idmv
      • 

    • Note the $(uname -r) will use the file for the current kernel version. You may also specify a specific file, such as:

      • # /usr/lib/dracut/skipcpio /boot/initramfs-3.10.0-957.el7.x86_64.img | gunzip -c | cpio -idmv
    3. 

  3. Now you may view the contents of the extracted directories and files from the boot image and interact with them:

    # ls
bin  dev  etc  init  lib  lib64  proc  root  run  sbin  shutdown  sys  sysroot  tmp  usr  var




B. Unpack /boot/initramfs-<kernel-version>kdump.img file


The instructions for unpacking the files within initramfs-*kdump.img files are slightly different.


    

  1.           # mkdir /tmp/initrd ; cd /tmp/initrd
    2. 

  2. RHEL 7  : # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r).img | gunzip -c | cpio -idmv
    
RHEL 8,9: # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r)kdump.img        | cpio -idmv
    3. 

  3.           # unsquashfs squash-root.img
    4. 

  4.           # ls
    5. 



 


  1. First, create a temporary work directory and switch into it. This will be the location where the initramfs contents will be unpacked into and viewed:

    • # mkdir /tmp/initrd ; cd    /tmp/initrd
  • To uncompress and extract the contents of the kdump.image, you will have to execute the following:
    • RHEL 7 : # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r)kdump.img | gunzip -c | cpio -idmv
    • RHEL 8,9: # /usr/lib/dracut/skipcpio /boot/initramfs-$(uname -r)kdump.img | cpio -idmv
  • And you need to use unsquashfs command from the squashfs-tools package to unpack squash-root.img. 
    # ls
bin  etc  init  lib  lib64  sbin  squash  squash-root.img  usr
# yum install squashfs-tools
# unsquashfs squash-root.img
  • Now you may view the contents of the extracted directories and files from the boot image and interact with them: 
    # ls
bin  dev  etc  init  lib  lib64  proc  root  run  sbin  shutdown  sys  sysroot  tmp  usr  var

    • Root Cause

    The initramfs file now stores both CPU microcode and the initial boot image in the one "combined" image file.

    The CPU microcode is stored with CPIO compression, then the boot image is stored with its own separate compression.

    The kernel processes the one "combined" image file, uncompresses and loads the CPU microcode into the CPU, then uncompresses the boot image and starts init.

    When viewing this combined image file on a booted system, it is necessary to use skipcpio to "skip past" the CPIO-compressed CPU microcode to access the boot image.

    Reference:

    SBR
    Product(s)
    Components
    Category
    Tags

    This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.