Chainbooting from grub over the network to local shim breaks chain of trust
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MAAS |
Fix Released
|
High
|
Unassigned | ||
OEM Priority Project |
Confirmed
|
High
|
ethan.hsieh | ||
shim |
New
|
Unknown
|
|||
grub2 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Groovy |
Fix Released
|
Undecided
|
Unassigned | ||
shim-signed (Ubuntu) |
Triaged
|
Undecided
|
Unassigned | ||
Focal |
Triaged
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
[Impact]
* UEFI Grub currently doesn't support exiting with an unsuccessful exit code. That means, a booted grub cannot determine that it should not be booting, exit, remove the installed shim protocol and ask the firmware to boot the next BootOrder BootEntry. Without this support livecd grub.cfg cannot perfrom "boot from local harddrive" or grub booted over the network cannot exit to continue regular boot off the harddrive, whilst preserving SecureBoot.
[Test Case]
* On a regular Ubuntu install, with UEFI and SecureBoot on, upgrade to new grub2 from proposed.
* Insert any Ubuntu installation CD as cdrom or usb-stick.
* Add a new UEFI boot entry for the CD or the usb-stick using efibootmgr, or by using your firmware settings (sudo systemctl reboot --firmware-setup)
* Make sure the regular Ubuntu install is the first in the BootOrder, followed by the cdrom/usb-stick.
* Start regular boot, interrupt it with Esc, and enter the grub shell by pressing 'c'
* Check that the new version of grub is running by doing
* echo "${package_
* Next type `exit 1`
* The current boot should reset and the boot off the installation media should proceed
* The grub menu options will look different
* Complete the boot, observe that one ended up in the livecd / installer environment and that secureboot is on by checking the output of `bootctl`.
[Where problems could occur]
* `exit` command of grub has changed to accept optional arguments that are no-op on all platforms, but uefi as that's the only one that supports passing return status. However some might attempt to use this on non-uefi platforms in vain. Previously exit command accepted no arguments. One might start rely on this functionality whilst using mismatched grubs - for example this is not available in Debian or Upstream, but is starting to be available in Ubuntu and has been available in Fedora/CentOS for a while now. No regular boot flows use `exit` command to boot.
[Other Info]
* Original bug report:
MAAS (2.4.2 and 2.6.2) cannot deploy to a server with Secure Boot active. This appears to be a regression of bug #1711203; the symptoms are identical. Namely:
1) The system can begin deployment fine.
2) After deployment is complete except for the final reboot, the
system will reboot.
3) GRUB appears briefly on the screen.
4) The system console briefly displays the message:
Bootloader has not verified loaded image
System is compromised. halting.
5) The node powers off.
6) Eventually MAAS times out on the deployment and declares
that it's failed.
I've verified this on three MAAS servers and one node each (jehan, a Quanta QuantaGrid D52B-1U in 18T; capella, a Supermicro SYS-6028U-TR4+ in 1SS, and brennan, an Intel NUC DC53427HYE on my home network).
Two of the MAAS servers are running MAAS 2.6.2-7841-
Related branches
- MAAS Lander: Approve
- Ghadi Rahme (community): Approve
- Adam Collard (community): Approve
-
Diff: 54 lines (+23/-10)1 file modifiedsrc/provisioningserver/templates/uefi/config.local.amd64.template (+23/-10)
Changed in maas: | |
status: | Incomplete → Confirmed |
Changed in maas: | |
milestone: | none → 2.8.0b2 |
Changed in maas: | |
milestone: | 2.8.0b2 → 2.8.0rc1 |
Changed in maas: | |
milestone: | 2.8.0b3 → 2.8.0rc1 |
Changed in maas: | |
milestone: | 2.8.0b4 → 2.8.0rc1 |
tags: | added: rls-bb-incoming |
tags: | added: rls-ff-incoming |
Changed in maas: | |
milestone: | 2.8.0rc1 → 2.8.0 |
Changed in maas: | |
milestone: | 2.8.0rc3 → 2.8.0 |
affects: | grub (Ubuntu) → grub2 (Ubuntu) |
tags: | added: id-5ee24d297b5c2a5aa43fda04 |
Changed in maas: | |
milestone: | 2.8.0 → 2.9.0b1 |
tags: | added: maas-grub |
tags: | removed: rls-bb-incoming rls-ff-incoming |
Changed in maas: | |
milestone: | 2.9.0b1 → 2.9.0b2 |
Changed in shim: | |
status: | Unknown → New |
Changed in maas: | |
milestone: | 2.9.0b2 → 2.9.0b3 |
milestone: | 2.9.0b3 → 2.9.0b4 |
Changed in maas: | |
status: | Confirmed → Triaged |
importance: | Undecided → High |
tags: | added: fr-24 |
Changed in maas: | |
milestone: | 2.9.0b4 → 2.9.0b7 |
Changed in maas: | |
milestone: | 2.9.0b7 → 2.9.x |
Changed in oem-priority: | |
assignee: | nobody → ethan.hsieh (ethan.hsieh) |
importance: | Undecided → Critical |
tags: | added: oem-priority |
Changed in grub2 (Ubuntu): | |
status: | Triaged → Fix Released |
Changed in grub2 (Ubuntu Focal): | |
status: | New → Triaged |
Changed in shim-signed (Ubuntu): | |
status: | Triaged → Invalid |
Changed in shim-signed (Ubuntu Focal): | |
status: | New → Invalid |
Changed in shim-signed (Ubuntu Groovy): | |
status: | Triaged → Invalid |
Changed in oem-priority: | |
status: | New → Confirmed |
description: | updated |
Changed in maas: | |
milestone: | 2.9.2 → 2.9.x |
Changed in maas: | |
milestone: | 3.3.0 → 3.4.0 |
Changed in maas: | |
milestone: | 3.4.0 → 3.5.0 |
Changed in maas: | |
status: | Triaged → Fix Committed |
Changed in maas: | |
milestone: | 3.5.0 → 3.5.0-beta1 |
status: | Fix Committed → Fix Released |
What operating system are you trying to deploy? Can you deploy Ubuntu 18.04?