Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent WPK rollback from rebooting the host on Windows agent #20081

Merged
merged 1 commit into from Nov 10, 2023

Conversation

vikman90
Copy link
Member

@vikman90 vikman90 commented Nov 6, 2023

Related issue
Fixes #19994

As explained in the issue above, this PR aims to modify the WPK installer to prevent upgrades from attempting to reboot the agent's host on upgrade failure.

Tests

  • Test a failing WPK upgrade with rollback.

@jotacarma90
Copy link
Member

Testing

I have been analyzing in depth the possibility of system reboot during failed WPK rollback.
These are the tests I have carried out:

  • To start with I created a Windows WPK with the triggered bug to cause the rollback (I added the /forcerestart later for testing purposes).
  • Updating the agent remotely:
    /var/ossec/bin/agent_upgrade -a 003 -f /home/vagrant/wazuh_agent_v4.6.0-wpkfail_windows.wpk
  • In the agent I see that the whole process completes without reboots:
2023-11-07 14:21:31Z - Sysnative Powershell will be used to access the registry.
2023-11-07 14:21:31Z - Current version: v4.5.4.
2023-11-07 14:21:31Z - Generating backup.
2023-11-07 14:21:31Z - Backing up Wazuh home files.
2023-11-07 14:21:33Z - Searching Wazuh-Agent cached MSI through the registry.
2023-11-07 14:21:34Z - Wazuh-Agent cached MSI was not found.
2023-11-07 14:21:34Z - Trying to stop Wazuh service.
2023-11-07 14:21:36Z - Starting upgrade processs.
2023-11-07 14:21:40Z - Restarting Wazuh-Agent service.
2023-11-07 14:21:41Z - Installation finished.
2023-11-07 14:21:41Z - Process ID: 1432.
2023-11-07 14:21:51Z - Reading status file: status='connected'.
2023-11-07 14:21:51Z - Upgrade failed: Restoring former installation.
2023-11-07 14:21:51Z - Trying to stop Wazuh service.
2023-11-07 14:21:54Z - Performing the Wazuh-Agent uninstall using: "MsiExec.exe /X{9D3D6790-B985-442E-A412-6F069D9C09CD} /quiet".
2023-11-07 14:22:02Z - Restoring former Wazuh-Agent home files.
2023-11-07 14:22:02Z - Current version: v4.5.4.
2023-11-07 14:22:02Z - Installing Wazuh service.
2023-11-07 14:22:02Z - Starting Wazuh-Agent service.
  • However, Wazuh is not completely installed after the rollback, the ossec.log shows critical failures related to the FIM db, which prevent Wazuh from installing correctly. This problem will be investigated in a separate issue:
2023/11/07 14:22:04 wazuh-agent: ERROR: Couldn't create SQLite database 'queue/fim/db/fim.db': unable to open database file (14)
2023/11/07 14:22:04 wazuh-agent: CRITICAL: (6698): Creating Data Structure: sqlite3 db. Exiting.
  • Anyway this actually happens after the rollback uninstall, so the system reboot is not triggered in this case. According to what I have been investigating, if when executing the .msi neither /norestart nor /forcerestart is specified, it is the installer itself that reboots only if necessary, but I can't find the key that could have caused the reboot we are looking for:
    https://learn.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options#quiet
  • I have been investigating possible causes why a Windows installation might require a reboot. It could be anything from an antivirus to an application that has one of the critical files open during installation. But I have not been able to reproduce it.
    Finally, I have added to the wpk the option /forcerestart to see what happens, and as expected, after the restart the rollback does not continue, so I do not know how the user has reached this situation:
2023-11-07 19:46:03Z - Sysnative Powershell will be used to access the registry.
2023-11-07 19:46:03Z - Current version: v4.5.4.
2023-11-07 19:46:03Z - Generating backup.
2023-11-07 19:46:03Z - Backing up Wazuh home files.
2023-11-07 19:46:05Z - Searching Wazuh-Agent cached MSI through the registry.
2023-11-07 19:46:06Z - Wazuh-Agent cached MSI was not found.
2023-11-07 19:46:06Z - Trying to stop Wazuh service.
2023-11-07 19:46:08Z - Starting upgrade processs.
2023-11-07 19:46:10Z - Restarting Wazuh-Agent service.
2023-11-07 19:46:12Z - Installation finished.
2023-11-07 19:46:12Z - Process ID: 5188.
2023-11-07 19:46:22Z - Reading status file: status='connected'.
2023-11-07 19:46:22Z - Upgrade failed: Restoring former installation.
2023-11-07 19:46:22Z - Trying to stop Wazuh service.
2023-11-07 19:46:25Z - Performing the Wazuh-Agent uninstall using: "MsiExec.exe /X{9D3D6790-B985-442E-A412-6F069D9C09CD} /quiet /forcerestart".

Conclusions

Finally, I consider this PR approved, since its very purpose is to prevent the installer (or uninstaller in the case of rollback) from silently restarting the system at all costs.
That's what the /norestart option we want to add, the rest of the WPK, FIM and SQLite related problems will be investigated in a separate issue.

@vikman90 vikman90 force-pushed the fix/19994-wpk-rollback-reboot branch from 52ecd98 to 7375038 Compare November 9, 2023 16:40
@vikman90 vikman90 merged commit a2db551 into 4.7.0 Nov 10, 2023
69 checks passed
@vikman90 vikman90 deleted the fix/19994-wpk-rollback-reboot branch November 10, 2023 07:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Wazuh's upgrade process reboot remote host without confirmation or warning
2 participants