FDE: snap recovery --show-keys hangs, times out

Bug #2036631 reported by Andreas Hasenack
32
This bug affects 5 people
Affects Status Importance Assigned to Milestone
snapd (Ubuntu)
Confirmed
Undecided
Alfonso Sanchez-Beato

Bug Description

I installed mantic in a VM from the 2023-09-18 iso image. The VM has a TPM2 device, and booted with secure boot. I selected the TPM encryption option, and finished the install.

Upon first boot, I logged in via gdm, opened a shell, and ran `snap recover --show-keys`, which did show me what looked like a key. I then installed openssh, logged in remotely, and ran `snap recover --show-keys` again, but this time it got stuck, and eventually timed out:

root@mantic-tpm:~# snap recovery --show-keys
error: cannot communicate with server: timeout exceeded while waiting for response
root@mantic-tpm:~#

While it was stuck, I ran the ps command, and saw this (long command line truncated in the output):

   3018 ? Ssl 0:00 /usr/lib/snapd/snap-fde-keymgr add-recovery-key --key-file /var/lib/snapd/device/fde/recovery.key --devices /dev/disk/by-partuuid/
   3024 ? Z 0:00 \_ [cryptsetup] <defunct>

I then installed all available mantic updates, rebooted, tried again, but the same thing happened.

Right now I have these versions:

snapd 2.60.3+23.10.1

Oh, and looks like even "snap list" is stuck, but this might be because I still have the snap-fde-keymgr and the defunct cryptsetup in the process list.

Lemme reboot.

Ok, after reboot, snap list works:

$ snap list
Name Version Rev Tracking Publisher Notes
bare 1.0 5 latest/stable canonical✓ base
core22 20230801 864 latest/stable canonical✓ base
firefox 117.0.1-2 3145 latest/stable/… mozilla✓ -
gnome-42-2204 0+git.ff35a85 126 latest/stable/… canonical✓ -
gtk-common-themes 0.1-81-g442e511 1535 latest/stable/… canonical✓ -
pc 23.04-0.1 154 classic-23.10/stable canonical✓ gadget
pc-kernel 6.5.0.5.7 1415 23.10/stable canonical✓ kernel
snap-store 0+git.888baba 1040 latest/stable/… canonical✓ -
snapd 2.60.3 20092 latest/stable canonical✓ snapd
snapd-desktop-integration 0.9 83 latest/stable/… canonical✓ -

When I run `snap recovery --show-keys`, it gets stuck, and `snap list` stops working.

Other info:
The moment I run "snap recovery --show-keys", it still gets stuck, and I see this in the journal (yes, twice):
Sep 19 14:52:00 mantic-tpm systemd[1]: Starting run-u74.service - /usr/lib/snapd/snap-fde-keymgr add-recovery-key --key-file /var/lib/snapd/device/fde/recovery.key --devices /dev/disk/by-partuuid/92f35cac-4d55-45fa-a699-23c5dec8eacd --authorizations keyring --devices /dev/disk/by-partuuid/63b7d449-7881-489b-bfa5-ae4ba2f13de3 --authorizations file:/run/mnt/data/var/lib/snapd/device/fde/ubuntu-save.key...
Sep 19 14:52:00 mantic-tpm systemd[1]: Started run-u74.service - /usr/lib/snapd/snap-fde-keymgr add-recovery-key --key-file /var/lib/snapd/device/fde/recovery.key --devices /dev/disk/by-partuuid/92f35cac-4d55-45fa-a699-23c5dec8eacd --authorizations keyring --devices /dev/disk/by-partuuid/63b7d449-7881-489b-bfa5-ae4ba2f13de3 --authorizations file:/run/mnt/data/var/lib/snapd/device/fde/ubuntu-save.key.

Tags: fde
description: updated
description: updated
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in snapd (Ubuntu):
status: New → Confirmed
Revision history for this message
Alfonso Sanchez-Beato (alfonsosanchezbeato) wrote :
Changed in snapd (Ubuntu):
assignee: nobody → Alfonso Sanchez-Beato (alfonsosanchezbeato)
Revision history for this message
Lyndon Lapierre (ljlapierre) wrote :

After pulling down snapd 2.61.1 today I can now view my recovery keys correctly. I believe this is resolved, if anyone else wants to confirm.

Revision history for this message
James McKenzie (jamesps) wrote :

Likewise, using version 2.61.1 fixes the issue and I can reliably run `snap recovery --show-keys` without errors.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.