| Summary: | RHEL-6 tboot must not be offered as an optional package on UEFI systems | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Tony Camuso <tcamuso> | ||||
| Component: | anaconda | Assignee: | Anaconda Maintenance Team <anaconda-maint-list> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | Release Test Team <release-test-team> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.9 | CC: | dcantrell, jfeeney, jshortt, jtakahashi2, tcamuso | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-12-06 10:21:26 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available. The official life cycle policy can be reviewed here: http://redhat.com/rhel/lifecycle This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL: https://access.redhat.com/ |
Created attachment 1191700 [details] grub.conf file on an EFI system with tboot installed Description of problem: Because grub does not support tboot launch on UEFI-based systems, tboot should not be listed among the optional packages on UEFI based systems. This should also be backported to z-stream for all RHEL-6. If the user installs tboot on a UEFI system, s/he will not be able to boot, unless s/he knows how to edit the grub stanza in the grub pre-boot environment. This is not acceptable in any scenario, but it is catastrophic in a multi-provisioning environment. Only one grub stanza is created, and it launches tboot (see attached). I tried a number of things to make this unnecessary. Exiting the tboot.spec file with nonzero status causes the provision to abort, which leaves the system in an unknown (AFICT) state. Also tried creating an init script to uninstall tboot on shutdown, but I was unable to make that work consistently. It's the wrong approach, anyway, as the systemd mavens pointed out when I tried to do this in RHEL-7. The correct approach is not to install tboot on UEFI systems in the first place. The only way to do that without aborting the provisioning is to not make tboot available as an option in the first place. If a UEFI system is being provisioned,tboot must not be listed among the options.