Bug 1542453 - libgcrypt-1.8.1-3 breaks gnupg2 on some systems (old kernels?)
Summary: libgcrypt-1.8.1-3 breaks gnupg2 on some systems (old kernels?)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libgcrypt
Version: 27
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-02-06 11:32 UTC by Panu Matilainen
Modified: 2018-07-04 14:10 UTC (History)
2 users (show)

Fixed In Version: libgcrypt-1.8.3-1.fc27 libgcrypt-1.8.3-1.fc28
Clone Of:
Environment:
Last Closed: 2018-06-17 19:44:56 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1380866 0 unspecified CLOSED dracut-fips breaks systemd (via libgcrypt) 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1561051 0 unspecified CLOSED F27 Server doesn't boot up in FIPS mode. 2021-02-22 00:41:40 UTC

Internal Links: 1380866 1561051

Description Panu Matilainen 2018-02-06 11:32:47 UTC
Description of problem:

libgcrypt-1.8.1-3 broke gnupg2 in semaphoreci.com containers, causing rpm upstream CI to fail since early December (finally managed to chase it down to libgcrypt from CI log diffs):

[luser@7b66b7853447 ~]$ gpg2 --import *.secret
gpg: directory '/home/luser/.gnupg' created
gpg: keybox '/home/luser/.gnupg/pubring.kbx' created
gpg: /home/luser/.gnupg/trustdb.gpg: trustdb created
gpg: key 4344591E1964C5FC: public key "rpm.org RSA testkey <rsa>" imported
gpg: error getting the KEK: End of file

Downgrading to libgcrypt-1.8.1-1.fc27 reliably makes it work, and upgrading reliably breaks it again. I can't reproduce this on my local Fedora system, but then the semaphoreci.com containers are running on an old kernel:

[luser@7b66b7853447 ~]$ uname -r
3.13.0-32-generic

...which makes me suspect the fallback logic in the patch added for bug 1380866 isn't quite right. Unfortunately strace is not permitted in the container :(

Version-Release number of selected component (if applicable):
libgcrypt-1.8.1-3.fc27

How reproducible:
Always

Steps to Reproduce:
1. run a kernel with no getrandom() support (note this is my assumption only)
2. gpg2 --import *.secret

Actual results:
[luser@7b66b7853447 ~]$ gpg2 --import *.secret; echo $?
gpg: directory '/home/luser/.gnupg' created
gpg: keybox '/home/luser/.gnupg/pubring.kbx' created
gpg: /home/luser/.gnupg/trustdb.gpg: trustdb created
gpg: key 4344591E1964C5FC: public key "rpm.org RSA testkey <rsa>" imported
gpg: error getting the KEK: End of file
gpg: Total number processed: 1
gpg:               imported: 1
gpg:       secret keys read: 1
2

Expected results:
[luser@7b66b7853447 ~]$ gpg2 --import *.secret; echo $?
gpg: directory '/home/luser/.gnupg' created
gpg: keybox '/home/luser/.gnupg/pubring.kbx' created
gpg: /home/luser/.gnupg/trustdb.gpg: trustdb created
gpg: key 4344591E1964C5FC: public key "rpm.org RSA testkey <rsa>" imported
gpg: key 4344591E1964C5FC: secret key imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
0


Additional info:
Rawhide is obviously also affected.

Comment 1 Tomas Mraz 2018-02-06 11:57:16 UTC
I am afraid that without strace I am unable to fix it. I reviewed the patch again and I do not see the error. It should simply fall back to reading /dev/urandom if the syscall returns -1 and sets errno to ENOSYS. Perhaps the errno is set to something else, but to what value?

Comment 2 Panu Matilainen 2018-02-06 13:53:37 UTC
I added some crude fprintf() logging to get around the strace limit, but it does seem to return ENOSYS as expected.

However dropping this last hunk of the patch makes it work:

@@ -246,9 +257,7 @@ _gcry_rndlinux_gather_random (void (*add
               _gcry_post_syscall ();
             }
           while (ret == -1 && errno == EINTR);
-          if (ret == -1 && errno == ENOSYS)
-            ; /* The syscall is not supported - fallback to /dev/urandom.  */
-          else
+          if (1)
             { /* The syscall is supported.  Some sanity checks.  */
               if (ret == -1)
                 log_fatal ("unexpected error from getrandom: %s\n",

Comment 3 Tomas Mraz 2018-02-06 15:34:47 UTC
Right, there is a logical error in the patch. I'll fix it.

Comment 4 Panu Matilainen 2018-02-07 10:23:18 UTC
Just tested it, I can verify this commit fixes my case:
https://src.fedoraproject.org/rpms/libgcrypt/c/e4efa24217b8586def20b1970b649f408928e839?branch=master

Comment 5 Fedora Update System 2018-06-15 07:12:03 UTC
libgcrypt-1.8.3-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ea5beb4cf

Comment 6 Fedora Update System 2018-06-15 07:12:20 UTC
libgcrypt-1.8.3-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-6788454ab6

Comment 7 Fedora Update System 2018-06-15 14:09:15 UTC
libgcrypt-1.8.3-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-6788454ab6

Comment 8 Fedora Update System 2018-06-15 16:35:15 UTC
libgcrypt-1.8.3-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ea5beb4cf

Comment 9 Fedora Update System 2018-06-17 19:44:56 UTC
libgcrypt-1.8.3-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2018-06-18 16:18:37 UTC
libgcrypt-1.8.3-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.