Bug 2120522
| Summary: | Backport necessary commits for Secure Execution into ostree | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | jschinta |
| Component: | ostree | Assignee: | Luca BRUNO <lucab> |
| Status: | CLOSED ERRATA | QA Contact: | HuijingHei <hhei> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.7 | CC: | hhei, lucab, ndubrovs, qzhang |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.7 | Flags: | pm-rhel:
mirror+
|
| Hardware: | s390x | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ostree-2022.2-5.el8 | Doc Type: | Enhancement |
| Doc Text: |
Backport logic for Secure Execution enablement on s390x.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-08 09:39:24 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Reserve s390x PC from beaker and install RHEL8.6 OS, download rhcos-412.86.202208302209-0-qemu.s390x.qcow2 and pull quay.io/coreos-assembler/coreos-assembler:latest, run cosa.
1) start qcow2, check ostree version is expected
$ rpm -q ostree
ostree-2022.2-5.el8.s390x
2) Run rpmostree.upgrade-rollback result is PASSED
# kola run --qemu-image rhcos-412.86.202208302209-0-qemu.s390x.qcow2 rpmostree.upgrade-rollback
=== RUN rpmostree.upgrade-rollback
=== RUN rpmostree.upgrade-rollback/upgrade
=== RUN rpmostree.upgrade-rollback/rollback
--- PASS: rpmostree.upgrade-rollback (1149.74s)
--- PASS: rpmostree.upgrade-rollback/upgrade (558.18s)
--- PASS: rpmostree.upgrade-rollback/rollback (341.48s)
PASS, output in _kola_temp/qemu-unpriv-2022-08-31-1136-71
I can confirm that with a coreos-installer build from the latest upstream code, you can build a working rhcos secure execution image. ``` [jschinta@localhost ~]$ rpm -q ostree ostree-2022.2-5.el8.s390x [jschinta@localhost ~]$ cat /sys/firmware/uv/prot_virt_guest 1 ``` This is from the image i build yesterday. We are still waiting on a new coreos-installer release before you can build secure execution images out of nightlys directly. Did a local RHCOS build with: - coreos-assembler: 61b68b437d489da8d899bf5788732c329e49c9a9 - os: bfd30ff5557b9a7e6b5baa37042bd859aa8f0c7c (HEAD -> release-4.12, origin/release-4.13, origin/release-4.12) - coreos-installer: 2964ddcb3cd1eb3baa6145a53a45abfce1805411 (HEAD -> main, upstream/main) Test procedure: - build RHCOS secex qemu image with ostree RPMs from https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=47267092 - check firstboot - check subsequentboot - sudo rpm-ostree kargs --append=foo && sudo reboot - journalctl -u ostree-finalize-staged.service ``` -- Logs begin at Thu 2022-09-01 10:26:04 UTC, end at Thu 2022-09-01 10:31:34 UTC. -- Sep 01 10:30:10 localhost.localdomain systemd[1]: Started OSTree Finalize Staged Deployment. Sep 01 10:30:20 localhost.localdomain systemd[1]: Stopping OSTree Finalize Staged Deployment... Sep 01 10:30:20 localhost.localdomain ostree[1636]: Finalizing staged deployment Sep 01 10:30:20 localhost.localdomain ostree[1636]: Copying /etc changes: 8 modified, 0 removed, 33 added Sep 01 10:30:20 localhost.localdomain ostree[1636]: Copying /etc changes: 8 modified, 0 removed, 33 added Sep 01 10:30:22 localhost.localdomain ostree[1636]: s390x SE: kernel: /boot/ostree/rhcos-c818833f974ad4a2b5cced47f1d3b34a703fd37b86abbbd49d39bf6be125ff58/vmlinuz-4.18.0-372.19.1.el8_6.s390x Sep 01 10:30:22 localhost.localdomain ostree[1636]: s390x SE: initrd: /boot/ostree/rhcos-c818833f974ad4a2b5cced47f1d3b34a703fd37b86abbbd49d39bf6be125ff58/initramfs-4.18.0-372.19.1.el8_6.s390x.img Sep 01 10:30:22 localhost.localdomain ostree[1636]: s390x SE: kargs: ignition.platform.id=qemu ostree=/ostree/boot.0/rhcos/c818833f974ad4a2b5cced47f1d3b34a703fd37b86abbbd49d39bf6be125ff58/0 rd.luks.name=1f589524-c70f-4ea5-be9a-19859d9fcacd=root root=UUID=2e2af85e-cbc1-4c01-9874-904597d033f8 rw rootflags=prjquota boo> Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: luks key added to initrd Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: key[1]: /etc/se-hostkeys/ibm-z-hostkey-1 Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: key[2]: /etc/se-hostkeys/ibm-z-hostkey-2 Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: key[3]: /etc/se-hostkeys/ibm-z-hostkey-3 Sep 01 10:30:23 localhost.localdomain ostree[1659]: WARNING: host-key document verification is disabled. Your workload is not secured. Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: `/sysroot/se/sdboot` generated Sep 01 10:30:23 localhost.localdomain zipl[1660]: Boot loader written to vda (0000) - fc:00 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Looking for components in '/lib/s390-tools' Sep 01 10:30:23 localhost.localdomain ostree[1660]: Target device information Sep 01 10:30:23 localhost.localdomain ostree[1660]: Device..........................: fc:00 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Partition.......................: fc:01 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Device name.....................: vda Sep 01 10:30:23 localhost.localdomain ostree[1660]: Device driver name..............: virtblk Sep 01 10:30:23 localhost.localdomain ostree[1660]: Type............................: disk partition Sep 01 10:30:23 localhost.localdomain ostree[1660]: Disk layout.....................: SCSI disk layout Sep 01 10:30:23 localhost.localdomain ostree[1660]: Geometry - start................: 2048 Sep 01 10:30:23 localhost.localdomain ostree[1660]: File system block size..........: 1024 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Physical block size.............: 512 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Device size in physical blocks..: 409600 Sep 01 10:30:23 localhost.localdomain ostree[1660]: Building bootmap in '/sysroot/se' Sep 01 10:30:23 localhost.localdomain ostree[1660]: Adding IPL section Sep 01 10:30:23 localhost.localdomain ostree[1660]: kernel image......: /sysroot/se/sdboot Sep 01 10:30:23 localhost.localdomain ostree[1660]: component address: Sep 01 10:30:23 localhost.localdomain ostree[1660]: heap area.......: 0x00002000-0x00005fff Sep 01 10:30:23 localhost.localdomain ostree[1660]: stack area......: 0x0000f000-0x0000ffff Sep 01 10:30:23 localhost.localdomain ostree[1660]: internal loader.: 0x0000a000-0x0000dfff Sep 01 10:30:23 localhost.localdomain ostree[1660]: parameters......: 0x00009000-0x000091ff Sep 01 10:30:23 localhost.localdomain ostree[1660]: kernel image....: 0x00010000-0x076f8fff Sep 01 10:30:23 localhost.localdomain ostree[1660]: environment blk.: 0x076f9000-0x076f93ff Sep 01 10:30:23 localhost.localdomain ostree[1660]: Environment block content: Sep 01 10:30:23 localhost.localdomain ostree[1660]: Preparing boot device: vda (0000). Sep 01 10:30:23 localhost.localdomain ostree[1660]: Detected SCSI PCBIOS disk layout. Sep 01 10:30:23 localhost.localdomain ostree[1660]: Writing SCSI master boot record. Sep 01 10:30:23 localhost.localdomain ostree[1660]: Syncing disks... Sep 01 10:30:23 localhost.localdomain ostree[1660]: Done. Sep 01 10:30:23 localhost.localdomain ostree[1636]: s390x SE: `sd-boot` zipled Sep 01 10:30:24 localhost.localdomain ostree[1636]: Transaction complete; bootconfig swap: yes; bootversion: boot.0.1, deployment count change: 1 Sep 01 10:30:24 localhost.localdomain ostree[1636]: Transaction complete; bootconfig swap: yes; bootversion: boot.0.1, deployment count change: 1 Sep 01 10:30:24 localhost.localdomain systemd[1]: ostree-finalize-staged.service: Succeeded. ``` So can confirm, that RPMs contain all required patches Thanks Nikita for the testing, change status to verified based on Comment 8 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ostree bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7557 |
Description of problem: We need Secure Execution for RHCOS 4.12, for which we need a new ostree version which includes the necessary changes for it to work Commits: commit 14a7c0c74bc080bbe8529c8645b895c118b83d9a Author: Nikita Dubrovskii <nikita.com> Date: Thu Jun 23 15:54:04 2022 +0200 s390x: rename sd-boot to sdboot Signed-off-by: Nikita Dubrovskii <nikita.com> commit 972f00e4835053b5c000937be2847da658f005dd Author: Nikita Dubrovskii <nikita.com> Date: Fri May 27 09:13:18 2022 +0200 s390x: do not unpack existing initrd, just append LUKS keys to its copy Signed-off-by: Nikita Dubrovskii <nikita.com> commit b03fa626f1c3242cbf5555a885f69ac03563c95f Author: Nikita Dubrovskii <nikita.com> Date: Tue May 24 19:30:35 2022 +0200 s390x: fail on error during reading of SecureExecution sysfs flag commit d0005698596ff3e434a3e4ddd4aea8d4c618079f Author: Nikita Dubrovskii <nikita.com> Date: Mon May 23 17:28:54 2022 +0200 s390x: ensure SecureExecution is enabled before sd-boot generation Signed-off-by: Nikita Dubrovskii <nikita.com> commit 7a5c604ca3391e93c4723dd539157434c7fb558b Author: Nikita Dubrovskii <nikita.com> Date: Mon Apr 4 16:09:50 2022 +0200 s390x: generate sd-boot at its own partition Signed-off-by: Nikita Dubrovskii <nikita.com>