STABLE-9: compat error checking additions#103
Conversation
When lvcreate fails we should bubble the error up to the caller. During development, I had a huge debugging dom0 which left only 24MB free in the volume group after being written to /dev/xenclient/root.new. This wasn't enough for the 143MB upgrade-compat image, so its LV could not be created. The error was not caught, so execution continued until install-bootloader eventually failed and failed the OTA. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> (cherry picked from commit a569cc6)
Use do_cmd so we have better insight into seal_system's operation. Signed-off-by: Jason Andryuk <jandryuk@gmail.com> This is a stable-9 version of ec21df6 to include the compat upgrade case.
If we can't mount upgrade-compat, we should error our before trying to call additional commands. This better indicates where the error lies. Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
|
There may be an issue with TPM 1.2. I'm investigating. |
|
LGTM, |
|
A TPM 1.2 box failed a forward seal, but I didn't finish investigating. There are two new AVCs for modprobe kmod_t inheriting updatemgr_t FDs. I think the should be benign. I'll try and investigate more tomorrow, but maybe adding do_cmd to seal_system should be held off for now. |
|
Ok, thanks! |
|
@jandryuk should we still hold off on this? |
|
I think this PR is fine to go in. I've been running it a bunch and it doesn't seem to be a problem. This morning I saw a failed forward seal of a TPM 1.2 legacy boot system, but I OTA-ed it with the same installer and that one successfully forward sealed. Something is going on, but it's not this PR. The kmod_t AVCs I noted above aren't from |
|
Cool, thanks, merging soon then. |
|
I was referring to these two:
I think they are from |
|
@jandryuk, should we open a ticket for someone to review ml-functions for any SELinux malfeasance? |
3 participants
The compat codepaths were missing some error checking which this PR adds.
mount_upgrade_compatwasn't exiting on failure, so execution continued. Return an error for that case.mount_upgrade_compat can fail if it wasn't written into a logical volume. We need create_lv to return an error when it cannot create an LV.
While touching the seal_system, prefix the seal commands with
do_cmdso they are logged.NOTE: Regardless of this PR, we don't abort the installer on forward sealing failure. This means we'll reboot and fail the measured launch. At the time seal_system is called, all the files have been updated, so there isn't a way to fail gracefully.
"install-main: Return failure from create_lv " is a cherry pick from the master PR.
"install-main: Add do_cmd to seal_system" is a modified version of the master PR to include the compat code paths.
Master PR #104