overlord/fdestate: run post install checks during auto repair

Author: valentindavid

overlord/devicestate/devicestate_systems_test.go

@@ -3439,7 +3439,7 @@ func mockHelperForEncryptionAvailabilityCheck(s suiteWithAddCleanup, c *C, isSup
 		s.DeviceManager().SetEncryptionSupportInfoInCacheUnlocked(cacheLabel, encInfo)
 	}
 
-	restore := install.MockSecbootPreinstallCheck(func(ctx context.Context, bootImagePaths []string) (*secboot.PreinstallCheckContext, []secboot.PreinstallErrorDetails, error) {
+	restore := install.MockSecbootPreinstallCheck(func(ctx context.Context, bootImagePaths []bootloader.BootFile) (*secboot.PreinstallCheckContext, []secboot.PreinstallErrorDetails, error) {
 		callCnt.checkCnt++
 		c.Assert(bootImagePaths, HasLen, 3)
 		c.Assert(isSupportedUbuntuHybrid, Equals, true)

overlord/fdestate/autorepair.go

@@ -20,11 +20,15 @@
 package fdestate
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
+	"strings"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/bootloader"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget/device"
 	"github.com/snapcore/snapd/logger"
@@ -34,8 +38,13 @@ import (
 )
 
 var (
+	bootloaderFind = bootloader.Find
+
+	bootReadModeenv = boot.ReadModeenv
+
 	secbootProvisionTPM        = secboot.ProvisionTPM
 	secbootShouldAttemptRepair = secboot.ShouldAttemptRepair
+	secbootPostinstallCheck    = secboot.PostinstallCheck
 
 	osutilBootID = osutil.BootID
 )
@@ -97,6 +106,105 @@ func getRepairAttemptResult(st *state.State) (*repairState, error) {
 	return rs.State, nil
 }
 
+func getBootChain() ([]bootloader.BootFile, error) {
+	modeenv, err := bootReadModeenv(dirs.GlobalRootDir)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read modeenv: %w", err)
+	}
+
+	rbl, err := bootloaderFind(boot.InitramfsUbuntuSeedDir, &bootloader.Options{
+		Role: bootloader.RoleRecovery,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot find recovery bootloader: %w", err)
+	}
+
+	tbl, ok := rbl.(bootloader.TrustedAssetsBootloader)
+	if !ok {
+		return nil, fmt.Errorf("internal error: recovery bootloader does not support trusted assets")
+	}
+
+	bl, err := bootloaderFind(boot.InitramfsUbuntuBootDir, &bootloader.Options{
+		Role:        bootloader.RoleRunMode,
+		NoSlashBoot: true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot find run bootloader: %w", err)
+	}
+
+	ebl, ok := bl.(bootloader.ExtractedRunKernelImageBootloader)
+	if !ok {
+		return nil, fmt.Errorf("internal error: run bootloader does not support kernel extraction")
+	}
+
+	info, err := ebl.TryKernel()
+	if err != nil {
+		if err == bootloader.ErrNoTryKernelRef {
+			info, err = ebl.Kernel()
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	trustedAssets, err := tbl.TrustedAssets()
+	if err != nil {
+		return nil, err
+	}
+
+	kernelPath := info.MountFile()
+
+	runModeBootChains, err := tbl.BootChains(bl, kernelPath)
+	if err != nil {
+		return nil, err
+	}
+
+	// runModeBootChains is all possible run boot chains, but only one should exist (there
+	// are legacy boot chains before we registered UEFI boot entries).
+	// The "BootFile"s for the gadget part points to identifier names instead of real path, so we
+	// need to resolve those. To resolve those we need to cross check with the modeenv, and then
+	// find the file in the cache. The last one, is the kernel and should be pointing to the right place.
+	for _, runModeBootChain := range runModeBootChains {
+		var chain []bootloader.BootFile
+
+		if len(runModeBootChain) == 0 {
+			// That is not possible for a boot chain to be size 0, because that would mean there is no
+			// kernel. We should not ignore this, there are bigger problems.
+			return nil, fmt.Errorf("internal error: no file in boot chain")
+		}
+
+		ignoreChain := false
+		for _, bf := range runModeBootChain[:len(runModeBootChain)-1] {
+			path := bf.Path
+			name, ok := trustedAssets[path]
+			if !ok {
+				return nil, fmt.Errorf("internal error: unknown trusted asset %s from boot chain", path)
+			}
+			var hashes []string
+			if bf.Role == bootloader.RoleRecovery {
+				hashes, ok = modeenv.CurrentTrustedRecoveryBootAssets[name]
+			} else {
+				hashes, ok = modeenv.CurrentTrustedBootAssets[name]
+			}
+			if !ok {
+				ignoreChain = true
+				break
+			}
+
+			// In theory we should only have one hash here. Multiple would be when we are trying
+			// a boot chain, and this should have been cleaned. It should be safe to take the last one (newest).
+			hash := hashes[len(hashes)-1]
+			p := filepath.Join(dirs.SnapBootAssetsDir, bl.Name(), fmt.Sprintf("%s-%s", name, hash))
+			chain = append(chain, bootloader.NewBootFile("", p, bf.Role))
+		}
+		if !ignoreChain {
+			return append(chain, runModeBootChain[len(runModeBootChain)-1]), nil
+		}
+	}
+
+	return nil, fmt.Errorf("cannot find the active boot chain")
+}
+
 func autoRepair(st *state.State) (AutoRepairResult, error) {
 	method, err := device.SealedKeysMethod(dirs.GlobalRootDir)
 	if err != nil {
@@ -106,8 +214,23 @@ func autoRepair(st *state.State) (AutoRepairResult, error) {
 	switch method {
 	case device.SealingMethodFDESetupHook:
 	case device.SealingMethodTPM, device.SealingMethodLegacyTPM:
-		// FIXME: re-run platform checks (post install checks?)
-		// Then maybe return AutoRepairFailedEncryptionSupport
+		images, err := getBootChain()
+		if err != nil {
+			return AutoRepairNotAttempted, err
+		}
+
+		if _, details, err := secbootPostinstallCheck(context.Background(), images); len(details) > 0 || err != nil {
+			if err != nil {
+				logger.Noticef("WARNING: could not auto repair keyslots due to failed platform initialization: %v", err)
+			} else {
+				var messages []string
+				for _, detail := range details {
+					messages = append(messages, fmt.Sprintf("- %s", detail.Message))
+				}
+				logger.Noticef("WARNING: could not auto repair keyslots due to failed platform initialization:\n%s", strings.Join(messages, "\n"))
+			}
+			return AutoRepairFailedPlatformInit, nil
+		}
 
 		lockoutAuthFile := device.TpmLockoutAuthUnder(boot.InstallHostFDESaveDir)
 		if err := secbootProvisionTPM(secboot.TPMPartialReprovision, lockoutAuthFile); err != nil {

overlord/fdestate/autorepair_test.go

@@ -21,19 +21,23 @@
 package fdestate_test
 
 import (
+	"context"
 	"fmt"
 	"os"
 
 	. "gopkg.in/check.v1"
 
 	sb "github.com/snapcore/secboot"
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/bootloader"
+	"github.com/snapcore/snapd/bootloader/bootloadertest"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/gadget/device"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/fdestate"
 	"github.com/snapcore/snapd/overlord/fdestate/backend"
 	"github.com/snapcore/snapd/secboot"
+	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/testutil"
 )
 
@@ -54,6 +58,58 @@ func (s *autoRepairSuite) SetUpTest(c *C) {
 	}))
 }
 
+func (s *autoRepairSuite) mockPostInstallChecks(c *C) {
+	recoveryBl := bootloadertest.Mock("recovery", "").WithTrustedAssets()
+	recoveryBl.TrustedAssetsMap = map[string]string{
+		"EFI/ubuntu/shim.efi": "ubuntu:shim",
+		"EFI/ubuntu/grub.efi": "ubuntu:grub",
+	}
+	recoveryBl.KernelBootFileBuilder = func(kernelPath string) bootloader.BootFile {
+		return bootloader.NewBootFile("some-kernel", "kernel.efi", bootloader.RoleRunMode)
+	}
+	recoveryBl.BootChainList = []bootloader.BootFile{
+		bootloader.NewBootFile("", "EFI/ubuntu/shim.efi", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "EFI/ubuntu/grub.efi", bootloader.RoleRecovery),
+		bootloader.NewBootFile("", "EFI/ubuntu/grub.efi", bootloader.RoleRunMode),
+	}
+
+	runBl := bootloadertest.Mock("run", "").WithExtractedRunKernelImage()
+	runBl.SetEnabledKernel(&snap.Info{SuggestedName: "some-kernel", InstanceKey: "x1", SnapType: snap.TypeKernel})
+
+	s.AddCleanup(fdestate.MockBootloaderFind(func(rootdir string, opts *bootloader.Options) (bootloader.Bootloader, error) {
+		if opts.Role == bootloader.RoleRecovery {
+			return recoveryBl, nil
+		} else if opts.Role == bootloader.RoleRunMode {
+			return runBl, nil
+		} else {
+			c.Errorf("unexpected")
+			return nil, fmt.Errorf("unexpected")
+		}
+	}))
+
+	s.AddCleanup(fdestate.MockBootReadModeenv(func(rootdir string) (*boot.Modeenv, error) {
+		return &boot.Modeenv{
+			CurrentTrustedBootAssets: map[string][]string{
+				"ubuntu:grub": {
+					"hash-grub-run",
+				},
+			},
+			CurrentTrustedRecoveryBootAssets: map[string][]string{
+				"ubuntu:shim": {
+					"hash-shim-recovery",
+				},
+				"ubuntu:grub": {
+					"hash-grub-recovery",
+				},
+			},
+		}, nil
+	}))
+
+	s.AddCleanup(fdestate.MockSecbootPostinstallCheck(func(ctx context.Context, bootImagePaths []bootloader.BootFile) (*secboot.PreinstallCheckContext, []secboot.PreinstallErrorDetails, error) {
+		return nil, nil, nil
+	}))
+}
+
 func (s *autoRepairSuite) TestAttemptAutoRepairNeeded(c *C) {
 	const onClassic = false
 	s.startedManager(c, onClassic)
@@ -85,6 +141,8 @@ func (s *autoRepairSuite) TestAttemptAutoRepairNeeded(c *C) {
 		return nil
 	})()
 
+	s.mockPostInstallChecks(c)
+
 	err := fdestate.AttemptAutoRepairIfNeeded(s.st, nil)
 	c.Assert(err, IsNil)
 
@@ -174,6 +232,8 @@ func (s *autoRepairSuite) TestAttemptAutoRepairNeededBadReprovision(c *C) {
 		return fmt.Errorf("Unexpected call")
 	})()
 
+	s.mockPostInstallChecks(c)
+
 	err := fdestate.AttemptAutoRepairIfNeeded(s.st, nil)
 	c.Assert(err, IsNil)
 
@@ -251,6 +311,8 @@ func (s *autoRepairSuite) TestAttemptAutoRepairErrorNoActivateStateRecovery(c *C
 		}, nil
 	})()
 
+	s.mockPostInstallChecks(c)
+
 	logbuf, restore := logger.MockLogger()
 	defer restore()
 
@@ -355,6 +417,8 @@ func (s *autoRepairSuite) TestAttemptAutoRepairNeededBadReseal(c *C) {
 		return fmt.Errorf("some error")
 	})()
 
+	s.mockPostInstallChecks(c)
+
 	err := fdestate.AttemptAutoRepairIfNeeded(s.st, nil)
 	c.Assert(err, IsNil)
 
@@ -390,3 +454,106 @@ func (s *autoRepairSuite) TestIgnoreOldAutoRepairResult(c *C) {
 	c.Assert(err, IsNil)
 	c.Check(result.Result, Equals, fdestate.AutoRepairResult("failed-platform-init"))
 }
+
+func (s *autoRepairSuite) TestAttemptAutoRepairFailedPostinstallChecks(c *C) {
+	const onClassic = false
+	s.startedManager(c, onClassic)
+
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	c.Assert(device.StampSealedKeys(dirs.GlobalRootDir, device.SealingMethodTPM), IsNil)
+
+	s.createUnlockedState(c, sb.ActivationSucceededWithPlatformKey)
+
+	defer fdestate.MockSecbootProvisionTPM(func(mode secboot.TPMProvisionMode, lockoutAuthFile string) error {
+		c.Errorf("unexpected call")
+		return fmt.Errorf("unexpected call")
+	})()
+
+	defer fdestate.MockSecbootShouldAttemptRepair(func(as *secboot.ActivateState) bool {
+		return true
+	})()
+
+	s.mockBootAssetsStateForModeenv(c)
+
+	defer fdestate.MockBackendResealKeyForBootChains(func(manager backend.FDEStateManager, method device.SealingMethod, rootdir string, params *boot.ResealKeyForBootChainsParams) error {
+		c.Errorf("unexpected call")
+		return fmt.Errorf("unexpected call")
+	})()
+
+	s.mockPostInstallChecks(c)
+	defer fdestate.MockSecbootPostinstallCheck(func(ctx context.Context, bootImagePaths []bootloader.BootFile) (*secboot.PreinstallCheckContext, []secboot.PreinstallErrorDetails, error) {
+		return nil, nil, fmt.Errorf("some error")
+	})()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	err := fdestate.AttemptAutoRepairIfNeeded(s.st, nil)
+	c.Assert(err, IsNil)
+
+	result, err := fdestate.GetRepairAttemptResult(s.st)
+	c.Assert(err, IsNil)
+
+	c.Check(result.Result, Equals, fdestate.AutoRepairResult("failed-platform-init"))
+
+	c.Check(logbuf.String(), testutil.Contains, `WARNING: could not auto repair keyslots due to failed platform initialization: some error`)
+}
+
+func (s *autoRepairSuite) TestAttemptAutoRepairFailedPostinstallChecksWithDetails(c *C) {
+	const onClassic = false
+	s.startedManager(c, onClassic)
+
+	s.st.Lock()
+	defer s.st.Unlock()
+
+	c.Assert(device.StampSealedKeys(dirs.GlobalRootDir, device.SealingMethodTPM), IsNil)
+
+	s.createUnlockedState(c, sb.ActivationSucceededWithPlatformKey)
+
+	defer fdestate.MockSecbootProvisionTPM(func(mode secboot.TPMProvisionMode, lockoutAuthFile string) error {
+		c.Errorf("unexpected call")
+		return fmt.Errorf("unexpected call")
+	})()
+
+	defer fdestate.MockSecbootShouldAttemptRepair(func(as *secboot.ActivateState) bool {
+		return true
+	})()
+
+	s.mockBootAssetsStateForModeenv(c)
+
+	defer fdestate.MockBackendResealKeyForBootChains(func(manager backend.FDEStateManager, method device.SealingMethod, rootdir string, params *boot.ResealKeyForBootChainsParams) error {
+		c.Errorf("unexpected call")
+		return fmt.Errorf("unexpected call")
+	})()
+
+	s.mockPostInstallChecks(c)
+	defer fdestate.MockSecbootPostinstallCheck(func(ctx context.Context, bootImagePaths []bootloader.BootFile) (*secboot.PreinstallCheckContext, []secboot.PreinstallErrorDetails, error) {
+		var details = []secboot.PreinstallErrorDetails{
+			{
+				Kind:    "kind-1",
+				Message: "error-1",
+			},
+			{
+				Kind:    "kind-2",
+				Message: "error-2",
+			},
+		}
+
+		return nil, details, nil
+	})()
+
+	logbuf, restore := logger.MockLogger()
+	defer restore()
+
+	err := fdestate.AttemptAutoRepairIfNeeded(s.st, nil)
+	c.Assert(err, IsNil)
+
+	result, err := fdestate.GetRepairAttemptResult(s.st)
+	c.Assert(err, IsNil)
+
+	c.Check(result.Result, Equals, fdestate.AutoRepairResult("failed-platform-init"))
+
+	c.Check(logbuf.String(), testutil.Contains, "WARNING: could not auto repair keyslots due to failed platform initialization:\n- error-1\n- error-2\n")
+}