The purpose of this post is to show the debian / ubuntu debugging technique related to the "source search" in the system configuration file.

Test example: after long bullying of a tar.gz copy of the installed OS and after restoring it and installing updates, we get the message:

update-initramfs: Generating /boot/initrd.img-4.15.0-54-generic W: initramfs-tools configuration sets RESUME=/dev/mapper/U1563304817I0-swap W: but no matching swap device is available. I: The initramfs will attempt to resume from /dev/dm-1 I: (/dev/mapper/foobar-swap) I: Set the RESUME variable to override this. 

Purpose: to understand where this value (U1563304817I0) came from and how to change it correctly. This is the first example that comes across, not particularly interesting in itself, but convenient to show practical methods of working with Linux .

Step number 1: Where did RESUME come from?

 # cd /etc # grep -r RESUME initramfs-tools/conf.d/resume:RESUME=/dev/mapper/U1563304817I0-swap 

We recursively ( -r ) look for the mention of this variable in the / etc directory (where most of the configs are). We find conf.d a snippet that is explicitly used by the initramfs-tools package.

Where does this snippet come from?

There are three options:

1. Magic artifact (someone put and forgot)
2. Config from the package
3. A config generated by some script from system packages

Check No. 2 (as the simplest):

  dpkg -S initramfs-tools/conf.d/resume dpkg-query: no path found matching pattern *initramfs-tools/conf.d/resume* 

dpkg -S allows us to search the database of installed files and find which package the file belongs to. Here is an example of a successful search:

 dpkg -S resolv.conf manpages: /usr/share/man/man5/resolv.conf.5.gz systemd: /lib/systemd/resolv.conf 

We return to our task: the initramfs-tools/conf.d/resume file is not installed into the system from the package. Maybe it is generated in the postinst / preinst script of the package? Check version number 3.

 # cd /var/lib/dpkg/info/ # grep -r initramfs-tools/conf.d/resume * initramfs-tools-core.postrm: rm -f /etc/initramfs-tools/conf.d/resume 

The /var/lib/dpkg/info/ directory contains the unpacked versions of all the package "metafiles" (install / uninstall scripts, package descriptions, etc.). Surprisingly, this file is deleted in the postrm (upon deletion) of the initramfs-tools-core package. Let's see the contents of his postinst ... Nothing regarding the conf.d directory.

Let's look at the files from the initramfs-tools-core package.

 # dpkg -L initramfs-tools-core ... /usr/share/initramfs-tools/hooks/resume ... 

The dpkg -L command allows you to see all the files that are on the system from the specified package. I highlighted an interesting file to study. Examining the file shows how this variable is used, but does not answer where it comes from.

debconf

It turns out that this is someone's artifact. Whose? Before diving into the installer, let's take a look at another important Debian infrastructure - answers to questions. Every time a package asks a question, and in many cases when it does not ask a question, but uses the default option, both the question and the answer are fixed in a special database in Debian called debconf. We can look at the database of answers (and even set them before installing the package itself - debconf-set-selections ), for this we need the debconf-get-selections utility from debconf-utils . Unfortunately, nothing interesting was found: ( debconf-get-selections |grep -i resume returned empty).

debian-installer

The installer has its own database of answers to questions: /var/log/installer/cdebconf/questions.dat . Unfortunately, there is not a word about our resume there either.
But there are logs nearby, including syslog, where the entire installation log is written. The base-installer package is mentioned there, and on its page we can see a link to the raws.

Inside them, we easily find the answer to our question:

  resume="$(mapdevfs "$resume_devfs")"; then ... if [ "$do_initrd" = yes ]; then ... resumeconf=$IT_CONFDIR/resume .... echo "RESUME=$resume" >> $resumeconf 

mapdevfs is a utility with a clear purpose, and the function we are interested in is get_resume_partition , which reads / proc / swaps and selects the largest one there. Swap comes from partman.

The answer to our test task: the file is created by the installer in / target at the time of installation, i.e. we are talking about well-known, but an artifact. There are nobody and nothing in the existing packages in the system to change this file.

Summarizing

1. dpkg and debconf are the main methods for finding file providers.
2. a search in / var / lib / dpkg / info allows you to see file operations during the installation phase.
3. The installer can create artifact files that are never changed by anyone (except the user), and this can be seen in the installer code.