Fix Secure Boot Automatus VM Installs #11239

Mab879 · 2023-11-01T12:32:16Z

Description:

Make the secure boot flag in install_vm.py work.

Rationale:

FIxes #11237

github-actions · 2023-11-01T12:34:58Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

vojtapolasek · 2023-11-01T15:49:41Z

Hello, I tried to install RHEL 8 and Fedora with this PR applied and unfortunately when I try to install with secureboot, I receive only blank screen and the installation does not proceed.

Mab879 · 2023-11-02T13:37:42Z

@vojtapolasek I have updated the PR, in my testing this should work better.

vojtapolasek · 2023-11-06T14:45:21Z

Hello @Mab879 I tried your latest PR and indeed the installation finishes successfully. However, I am not sure if the outcome is what we want.
I tried to verify that the resulting installed system runs with secureboot enabled through the bootctl command. It displays the secureboot state at the begining. Unfortunately, no matter if I supplied "--uefi normal" or "--uefi secureboot", the systemctl command reported that the secureboot is enabled.
I would expect that in case of "--uefi normal", the secureboot would not be enabled.

Mab879 · 2023-11-06T16:29:41Z

Hello @Mab879 I tried your latest PR and indeed the installation finishes successfully. However, I am not sure if the outcome is what we want. I tried to verify that the resulting installed system runs with secureboot enabled through the bootctl command. It displays the secureboot state at the begining. Unfortunately, no matter if I supplied "--uefi normal" or "--uefi secureboot", the systemctl command reported that the secureboot is enabled. I would expect that in case of "--uefi normal", the secureboot would not be enabled.

This is a bug that is currently in master. I will see if I can fix that.

Mab879 · 2023-11-06T16:48:05Z

Hello @Mab879 I tried your latest PR and indeed the installation finishes successfully. However, I am not sure if the outcome is what we want. I tried to verify that the resulting installed system runs with secureboot enabled through the bootctl command. It displays the secureboot state at the begining. Unfortunately, no matter if I supplied "--uefi normal" or "--uefi secureboot", the systemctl command reported that the secureboot is enabled. I would expect that in case of "--uefi normal", the secureboot would not be enabled.

I have updated the script to make sure that the normal uefi does not use secure boot.

vojtapolasek · 2023-11-07T08:03:50Z

Hello, unforrtunately now the installation does not start when "--uefi normal" is used.

ERROR    loader attribute 'secure' cannot be specified when firmware autoselection is enabled

Mab879 · 2023-11-08T21:52:30Z

Hello, unforrtunately now the installation does not start when "--uefi normal" is used.
ERROR    loader attribute 'secure' cannot be specified when firmware autoselection is enabled

What version OS are you running? I can't reproduce on F39 or F38.

vojtapolasek · 2023-11-09T11:23:41Z

I am running Fedora 38.
I grepped installed packages for qemu, virt and edk, I removed duplicates.

virt:

python3-libvirt-9.0.0-2.fc38.x86_64
virt-manager-common-4.1.0-2.fc38.noarch
libvirt-glib-4.0.0-8.fc38.x86_64
rubygem-ruby-libvirt-0.7.1-18.fc38.x86_64
rubygem-fog-libvirt-0.9.0-2.fc38.noarch
virt-manager-4.1.0-2.fc38.noarch
virt-install-4.1.0-2.fc38.noarch
libvirt-libs-9.0.0-3.fc38.x86_64
libvirt-client-9.0.0-3.fc38.x86_64
libvirt-daemon-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-core-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-network-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-disk-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-gluster-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-iscsi-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-logical-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-mpath-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-rbd-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-scsi-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-zfs-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-storage-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-interface-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-nodedev-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-nwfilter-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-qemu-9.0.0-3.fc38.x86_64
libvirt-daemon-driver-secret-9.0.0-3.fc38.x86_64
libvirt-daemon-kvm-9.0.0-3.fc38.x86_64
libvirt-daemon-config-network-9.0.0-3.fc38.x86_64
vagrant-libvirt-0.7.0-6.fc38.noarch

qemu:

ipxe-roms-qemu-20220210-3.git64113751.fc38.noarch
qemu-common-7.2.6-1.fc38.x86_64
qemu-ui-opengl-7.2.6-1.fc38.x86_64
qemu-ui-spice-core-7.2.6-1.fc38.x86_64
qemu-char-spice-7.2.6-1.fc38.x86_64
qemu-ui-spice-app-7.2.6-1.fc38.x86_64
qemu-audio-spice-7.2.6-1.fc38.x86_64
qemu-device-display-qxl-7.2.6-1.fc38.x86_64
qemu-ui-egl-headless-7.2.6-1.fc38.x86_64
qemu-ui-gtk-7.2.6-1.fc38.x86_64
qemu-ui-sdl-7.2.6-1.fc38.x86_64
qemu-audio-alsa-7.2.6-1.fc38.x86_64
qemu-audio-dbus-7.2.6-1.fc38.x86_64
qemu-audio-jack-7.2.6-1.fc38.x86_64
qemu-audio-oss-7.2.6-1.fc38.x86_64
qemu-audio-pa-7.2.6-1.fc38.x86_64
qemu-audio-sdl-7.2.6-1.fc38.x86_64
qemu-block-blkio-7.2.6-1.fc38.x86_64
qemu-block-curl-7.2.6-1.fc38.x86_64
qemu-block-dmg-7.2.6-1.fc38.x86_64
qemu-block-gluster-7.2.6-1.fc38.x86_64
qemu-block-iscsi-7.2.6-1.fc38.x86_64
qemu-block-nfs-7.2.6-1.fc38.x86_64
qemu-block-rbd-7.2.6-1.fc38.x86_64
qemu-block-ssh-7.2.6-1.fc38.x86_64
qemu-char-baum-7.2.6-1.fc38.x86_64
qemu-device-display-vhost-user-gpu-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-gpu-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-gpu-ccw-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-gpu-gl-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-gpu-pci-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-gpu-pci-gl-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-vga-7.2.6-1.fc38.x86_64
qemu-device-display-virtio-vga-gl-7.2.6-1.fc38.x86_64
qemu-device-usb-host-7.2.6-1.fc38.x86_64
qemu-device-usb-redirect-7.2.6-1.fc38.x86_64
qemu-device-usb-smartcard-7.2.6-1.fc38.x86_64
qemu-ui-curses-7.2.6-1.fc38.x86_64
qemu-virtiofsd-7.2.6-1.fc38.x86_64
qemu-pr-helper-7.2.6-1.fc38.x86_64
qemu-system-x86-core-7.2.6-1.fc38.x86_64
qemu-system-x86-7.2.6-1.fc38.x86_64
qemu-system-aarch64-core-7.2.6-1.fc38.x86_64
qemu-system-aarch64-7.2.6-1.fc38.x86_64
qemu-system-alpha-core-7.2.6-1.fc38.x86_64
qemu-system-alpha-7.2.6-1.fc38.x86_64
qemu-system-arm-core-7.2.6-1.fc38.x86_64
qemu-system-arm-7.2.6-1.fc38.x86_64
qemu-system-avr-core-7.2.6-1.fc38.x86_64
qemu-system-avr-7.2.6-1.fc38.x86_64
qemu-system-cris-core-7.2.6-1.fc38.x86_64
qemu-system-cris-7.2.6-1.fc38.x86_64
qemu-system-loongarch64-core-7.2.6-1.fc38.x86_64
qemu-system-loongarch64-7.2.6-1.fc38.x86_64
qemu-system-m68k-core-7.2.6-1.fc38.x86_64
qemu-system-m68k-7.2.6-1.fc38.x86_64
qemu-system-microblaze-core-7.2.6-1.fc38.x86_64
qemu-system-microblaze-7.2.6-1.fc38.x86_64
qemu-system-mips-core-7.2.6-1.fc38.x86_64
qemu-system-mips-7.2.6-1.fc38.x86_64
qemu-system-nios2-core-7.2.6-1.fc38.x86_64
qemu-system-nios2-7.2.6-1.fc38.x86_64
qemu-system-or1k-core-7.2.6-1.fc38.x86_64
qemu-system-or1k-7.2.6-1.fc38.x86_64
qemu-system-ppc-core-7.2.6-1.fc38.x86_64
qemu-system-ppc-7.2.6-1.fc38.x86_64
qemu-system-riscv-core-7.2.6-1.fc38.x86_64
qemu-system-riscv-7.2.6-1.fc38.x86_64
qemu-system-rx-core-7.2.6-1.fc38.x86_64
qemu-system-rx-7.2.6-1.fc38.x86_64
qemu-system-s390x-core-7.2.6-1.fc38.x86_64
qemu-system-s390x-7.2.6-1.fc38.x86_64
qemu-system-sh4-core-7.2.6-1.fc38.x86_64
qemu-system-sh4-7.2.6-1.fc38.x86_64
qemu-system-sparc-core-7.2.6-1.fc38.x86_64
qemu-system-sparc-7.2.6-1.fc38.x86_64
qemu-system-tricore-core-7.2.6-1.fc38.x86_64
qemu-system-tricore-7.2.6-1.fc38.x86_64
qemu-system-xtensa-core-7.2.6-1.fc38.x86_64
qemu-system-xtensa-7.2.6-1.fc38.x86_64
qemu-user-7.2.6-1.fc38.x86_64
qemu-user-static-xtensa-7.2.6-1.fc38.x86_64
qemu-user-static-x86-7.2.6-1.fc38.x86_64
qemu-user-static-sparc-7.2.6-1.fc38.x86_64
qemu-user-static-sh4-7.2.6-1.fc38.x86_64
qemu-user-static-s390x-7.2.6-1.fc38.x86_64
qemu-user-static-riscv-7.2.6-1.fc38.x86_64
qemu-user-static-ppc-7.2.6-1.fc38.x86_64
qemu-user-static-or1k-7.2.6-1.fc38.x86_64
qemu-user-static-nios2-7.2.6-1.fc38.x86_64
qemu-user-static-mips-7.2.6-1.fc38.x86_64
qemu-user-static-microblaze-7.2.6-1.fc38.x86_64
qemu-user-static-m68k-7.2.6-1.fc38.x86_64
qemu-user-static-loongarch64-7.2.6-1.fc38.x86_64
qemu-user-static-hppa-7.2.6-1.fc38.x86_64
qemu-user-static-hexagon-7.2.6-1.fc38.x86_64
qemu-user-static-cris-7.2.6-1.fc38.x86_64
qemu-user-static-arm-7.2.6-1.fc38.x86_64
qemu-user-static-alpha-7.2.6-1.fc38.x86_64
qemu-user-static-aarch64-7.2.6-1.fc38.x86_64
qemu-tools-7.2.6-1.fc38.x86_64
qemu-img-7.2.6-1.fc38.x86_64
qemu-7.2.6-1.fc38.x86_64
qemu-user-static-7.2.6-1.fc38.x86_64
qemu-kvm-7.2.6-1.fc38.x86_64
qemu-kvm-core-7.2.6-1.fc38.x86_64
qemu-guest-agent-7.2.6-1.fc38.x86_64

edk:

edk2-ovmf-20230524-3.fc38.noarch
edk2-aarch64-20230524-3.fc38.noarch
edk2-arm-20230524-3.fc38.noarch

Reproducer with --uefi normal

❯ sudo python install_vm.py  --libvirt qemu:///system --domain fedora_uefi --distro fedora --uefi normal
Using SSH public key from file: /home/vojta/.ssh/id_rsa.pub
Using hypervisor: qemu:///system
Using kickstart file: /tmp/test_suite.cfg

Starting install...
Retrieving 'vmlinuz'                                                                                                                                                                                                   |  11 MB  00:00:00 ... 
Retrieving 'initrd.img'                                                                                                                                                                                                | 102 MB  00:00:07 ... 
Allocating 'fedora_uefi.qcow2'                                                                                                                                                                                         |    0 B  00:00:00 ... 
Removing disk 'fedora_uefi.qcow2'                                                                                                                                                                                      |    0 B  00:00:00     
ERROR    loader attribute 'secure' cannot be specified when firmware autoselection is enabled
Domain installation does not appear to have been successful.
If it was, you can restart your domain by running:
  virsh --connect qemu:///system start fedora_uefi
otherwise, please restart your installation.

To determine the IP address of the fedora_uefi VM use:
  sudo virsh domifaddr fedora_uefi

To connect to the fedora_uefi VM use:
  ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@IP

To connect to the VM serial console, use:
  virsh console fedora_uefi

Reproducer with --uefi secureboot (this works)

sudo python install_vm.py  --libvirt qemu:///system --domain fedora_uefi_sb --distro fedora --uefi secureboot
Using SSH public key from file: /home/vojta/.ssh/id_rsa.pub
Using hypervisor: qemu:///system
Using kickstart file: /tmp/test_suite.cfg

Starting install...
Retrieving 'vmlinuz'                                                                                                                                                                                                   |  11 MB  00:00:00 ... 
Retrieving 'initrd.img'                                                                                                                                                                                                | 102 MB  00:00:07 ... 
Allocating 'fedora_uefi_sb.qcow2'                                                                                                                                                                                      |    0 B  00:00:00 ... 
Creating domain...                                                                                                                                                                                                     |    0 B  00:00:00     

Domain is still running. Installation may be in progress.
Waiting for the installation to complete.
Domain has shutdown. Continuing.
Domain creation completed.
Restarting guest.

To determine the IP address of the fedora_uefi_sb VM use:
  sudo virsh domifaddr fedora_uefi_sb

To connect to the fedora_uefi_sb VM use:
  ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@IP

To connect to the VM serial console, use:
  virsh console fedora_uefi_sb

Simplify the flags to only request secureboot.

codeclimate · 2023-12-04T20:17:22Z

Code Climate has analyzed commit d2b1f49 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

vojtapolasek

Thank you very much @Mab879 I confirm this works on Fedora 39 as a host system. Merging.

Mab879 added bugfix Fixes to reported bugs. Test Suite Update in Test Suite. labels Nov 1, 2023

Mab879 added this to the 0.1.71 milestone Nov 1, 2023

Mab879 requested a review from vojtapolasek November 1, 2023 12:32

Mab879 changed the title ~~Don't add UEFI for secure boot installs~~ Fix Secure Boot Automatus VM Installs Nov 1, 2023

Mab879 force-pushed the fix_secureboot_install branch from 81b6d3c to 3bbcf57 Compare November 2, 2023 13:36

marcusburghardt assigned vojtapolasek Nov 8, 2023

Mab879 force-pushed the fix_secureboot_install branch from 1281ff5 to c337dfc Compare November 16, 2023 16:05

vojtapolasek modified the milestones: 0.1.71, 0.1.72 Nov 28, 2023

Mab879 added 2 commits December 4, 2023 13:59

Fix Secureboot Installs

1bd7096

Simplify the flags to only request secureboot.

Ensure that normal UEFI does not use secure boot in install_vm.py

d2b1f49

Mab879 force-pushed the fix_secureboot_install branch from c337dfc to d2b1f49 Compare December 4, 2023 19:59

vojtapolasek approved these changes Jan 5, 2024

View reviewed changes

vojtapolasek merged commit a9e9dae into ComplianceAsCode:master Jan 5, 2024
34 checks passed

Mab879 deleted the fix_secureboot_install branch January 5, 2024 14:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Secure Boot Automatus VM Installs #11239

Fix Secure Boot Automatus VM Installs #11239

Mab879 commented Nov 1, 2023 •

edited

Loading

github-actions bot commented Nov 1, 2023

vojtapolasek commented Nov 1, 2023

Mab879 commented Nov 2, 2023

vojtapolasek commented Nov 6, 2023

Mab879 commented Nov 6, 2023

Mab879 commented Nov 6, 2023

vojtapolasek commented Nov 7, 2023

Mab879 commented Nov 8, 2023

vojtapolasek commented Nov 9, 2023

codeclimate bot commented Dec 4, 2023

vojtapolasek left a comment

Fix Secure Boot Automatus VM Installs #11239

Fix Secure Boot Automatus VM Installs #11239

Conversation

Mab879 commented Nov 1, 2023 • edited Loading

Description:

Rationale:

github-actions bot commented Nov 1, 2023

vojtapolasek commented Nov 1, 2023

Mab879 commented Nov 2, 2023

vojtapolasek commented Nov 6, 2023

Mab879 commented Nov 6, 2023

Mab879 commented Nov 6, 2023

vojtapolasek commented Nov 7, 2023

Mab879 commented Nov 8, 2023

vojtapolasek commented Nov 9, 2023

virt:

qemu:

edk:

Reproducer with --uefi normal

Reproducer with --uefi secureboot (this works)

codeclimate bot commented Dec 4, 2023

vojtapolasek left a comment

Choose a reason for hiding this comment

Mab879 commented Nov 1, 2023 •

edited

Loading