CentOS / RHEL 6 : How to extract initramfs image and edit/view it

In some cases you may want to extract the initramfs image file to check built-in contents. This post provides steps to extract initramfs image files for RHEL 6.

Steps

1. Locate your initramfs image and check the file type.

# ls -la /boot/initramfs-$(uname -r).img
-rw-r--r--. 1 root root 16196566 Feb  4  2015 /boot/initramfs-2.6.32-358.el6.x86_64.img
# file /boot/initramfs-2.6.32-358.el6.x86_64.img
/boot/initramfs-2.6.32-358.el6.x86_64.img: gzip compressed data, from Unix, last modified: Wed Feb  4 18:31:54 2015, max compression

2. Create a directory in /tmp and copy the initramfs image file to that directory (please check if /tmp has sufficent space to hold initramfs) :

# mkdir /tmp/initrmafs
# cp /boot/initramfs-$(uname -r).img /tmp/initramfs

3. Go to /tmp/initramfs and execute

# cd /tmp/initramfs
# gzip -dc /boot/initramfs-2.6.32-358.el6.x86_64.img | cpio -id
90556 blocks

Above command should extract initramfs image and create directories which you can investigate

# ls -lrt
total 15924
-rw-r--r-- 1 root root 16196566 Feb  4  2015 initramfs-2.6.32-358.el6.x86_64.img
drwxr-xr-x 2 root root     4096 Sep  2 11:01 pre-udev
drwxr-xr-x 2 root root     4096 Sep  2 11:01 cmdline
drwxr-xr-x 2 root root     4096 Sep  2 11:01 bin
drwxr-xr-x 2 root root     4096 Sep  2 11:01 proc
drwxr-xr-x 4 root root     4096 Sep  2 11:01 var
drwxrwxrwt 2 root root     4096 Sep  2 11:01 tmp
drwxr-xr-x 2 root root     4096 Sep  2 11:01 sysroot
drwxr-xr-x 2 root root     4096 Sep  2 11:01 sys
drwxr-xr-x 7 root root     4096 Sep  2 11:01 etc
-rw-r--r-- 1 root root       19 Sep  2 11:01 dracut-004-303.el6
drwxr-xr-x 2 root root     4096 Sep  2 11:01 pre-trigger
drwxr-xr-x 2 root root     4096 Sep  2 11:01 mount
drwxr-xr-x 2 root root     4096 Sep  2 11:01 initqueue-timeout
drwxr-xr-x 2 root root     4096 Sep  2 11:01 emergency
drwxr-xr-x 7 root root     4096 Sep  2 11:01 lib
drwxr-xr-x 2 root root     4096 Sep  2 11:01 initqueue-settled
drwxr-xr-x 2 root root     4096 Sep  2 11:01 initqueue-finished
-rwxr-xr-x 1 root root     8879 Sep  2 11:01 init
drwxr-xr-x 7 root root     4096 Sep  2 11:01 usr
drwxr-xr-x 2 root root     4096 Sep  2 11:01 pre-pivot
drwxr-xr-x 3 root root     4096 Sep  2 11:01 dev
drwxr-xr-x 3 root root     4096 Sep  2 11:01 lib64
drwxr-xr-x 2 root root     4096 Sep  2 11:01 sbin
drwxr-xr-x 2 root root     4096 Sep  2 11:01 initqueue

Now you can check and edit initramfs image, for example boot logs are located in /var/log directory. You can as well check what modules are loaded in initramfs , for that please check /lib/modules or /lib/dracut.It is also possible to edit any files in /etc/ if for example /etc/multipath.conf needs to be changed.

4. Now when changes are made to recreate initramfs image execute

# cd /tmp/initramfs
# rm initramfs-2.6.32-358.el6.x86_64.img
# find . | cpio -H newc -o > initramfs-2.6.32-358.el6.x86_64.cpio
# cat initramfs-2.6.32-358.el6.x86_64.cpio | gzip -9 > /tmp/initramfs-2.6.32-358.el6.x86_64.img

5. Now you can replace this initramfs image (/tmp/initramfs-2.6.32-358.el6.x86_64.img) with one located in /boot/

# cp /tmp/initramfs-2.6.32-358.el6.x86_64.img /boot/

Viewing the initramfs image content

To only list the contents of an initramfs image file, you can run:

# lsinitrd /boot/initramfs-2.6.32-358.el6.x86_64.img
/boot/initramfs-2.6.32-358.el6.x86_64.img: 16M
========================================================================
========================================================================
drwxr-xr-x  24 root     root            0 Feb  4  2015 .
drwxr-xr-x   2 root     root            0 Feb  4  2015 pre-udev
-rwxr-xr-x   1 root     root         1208 Jan  9  2013 pre-udev/30resume-genrules.sh
-rwxr-xr-x   1 root     root          149 Jan 15  2010 pre-udev/30mdmon-pre-udev.sh
....
Related Post