[Bug 1877089] Re: zfcpdump kernel can not be IPLed when secure boot is requested
Dimitri John Ledkov
1877089 at bugs.launchpad.net
Wed Jul 8 13:52:24 UTC 2020
** Description changed:
+ [Impact]
+
+ * zfcpdump-kernel incompatible with s390-tools in focal
+ * zfcpdump-kernel incompatible with SIPL (secure IPL)
+ * fix all that for focal and up
+
+ * Upgrade to the v5.4 kernel
+ * Enable signing
+ * Update the path of the image, to the one that `zipl -d` in focal expects
+
+ [Test Case]
+
+ * Prepare sda1 drive for SCSI dump
+ * Stop all processes from the HMC
+ * Perform SCSI dump load from HMC
+ * Observe that dump is successful and used v5.4 kernel from the Operating System Messages
+ * Perform regular
+ * Mount the dump, and observe it is there in full
+
+ * Can be performed on the canonical z13 hmc without SIPL
+ * Will need IBM confirmation with SIPL, or further fixes
+
+ [Regression Potential]
+
+ * The kernel image used for zfcpdump is fairly static, doesn't have
+ loadable modules, but it does allow reading kernel memory which in
+ theory is not in the same spirit as lockdown. However, stopping all
+ processes and triggering scsi-dump is a priviledged HMC operation that
+ is otheriwse has a much higher access restrictions than lockdown can
+ provide.
+
+ [Other Info]
+
+ * Original bug report
+
+
I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
System can be secure booted, /sys/firmware/ipl/secure shows "1".
I prepared zfcp dump disk as described in LTC bug 185713.
Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.
Operating System Messages on HMC:
Preparing system.
Starting system.
System version 8.
Watchdog enabled.
Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
ZBootLoader 2.1.0.
MLOLOA6269064E Secure IPL: There are no signed components available on device HB
A=0.0.1800, WWPN=500507630309D327, LUN=4046400900000000.
IPL failed.
Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a
dump created.
Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
root at t35lp25:~# zipl --secure=1 -d /dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1
Building bootmap directly on partition '/dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1'
Adding dump section
- initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
- kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
- kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
- component address:
- heap area.......: 0x00002000-0x00005fff
- stack area......: 0x0000f000-0x0000ffff
- internal loader.: 0x0000a000-0x0000dfff
- parameters......: 0x00009000-0x000091ff
- kernel image....: 0x00010000-0x001b9fff
- parmline........: 0x001ba000-0x001ba1ff
- initial ramdisk.: 0x001c0000-0x0020edff
+ initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
+ kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
+ kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
+ component address:
+ heap area.......: 0x00002000-0x00005fff
+ stack area......: 0x0000f000-0x0000ffff
+ internal loader.: 0x0000a000-0x0000dfff
+ parameters......: 0x00009000-0x000091ff
+ kernel image....: 0x00010000-0x001b9fff
+ parmline........: 0x001ba000-0x001ba1ff
+ initial ramdisk.: 0x001c0000-0x0020edff
Preparing boot device: sde.
Done.
...and tried to SCSI dump this device again. But the same failure occured.
Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.
** Description changed:
[Impact]
- * zfcpdump-kernel incompatible with s390-tools in focal
- * zfcpdump-kernel incompatible with SIPL (secure IPL)
- * fix all that for focal and up
+ * zfcpdump-kernel incompatible with s390-tools in focal
+ * zfcpdump-kernel incompatible with SIPL (secure IPL)
+ * fix all that for focal and up
- * Upgrade to the v5.4 kernel
- * Enable signing
- * Update the path of the image, to the one that `zipl -d` in focal expects
+ * Upgrade to the v5.4 kernel
+ * Enable signing
+ * Update the path of the image, to the one that `zipl -d` in focal expects
[Test Case]
- * Prepare sda1 drive for SCSI dump
- * Stop all processes from the HMC
- * Perform SCSI dump load from HMC
- * Observe that dump is successful and used v5.4 kernel from the Operating System Messages
- * Perform regular
- * Mount the dump, and observe it is there in full
+ * Prepare sda1 drive for SCSI dump
+ * Stop all processes from the HMC
+ * Perform SCSI dump load from HMC
+ * Observe that dump is successful and used v5.4 kernel from the Operating System Messages
+ * Perform regular
+ * Mount the dump, and observe it is there in full
- * Can be performed on the canonical z13 hmc without SIPL
- * Will need IBM confirmation with SIPL, or further fixes
+ * Can be performed on the canonical z13 hmc without SIPL
+ * Will need IBM confirmation with SIPL, or further fixes
+
+ [Publication]
+
+ * zfcpdump-kernel image is OS series independant, and thus can be build
+ in focal with copies up to groovy.
[Regression Potential]
- * The kernel image used for zfcpdump is fairly static, doesn't have
+ * The kernel image used for zfcpdump is fairly static, doesn't have
loadable modules, but it does allow reading kernel memory which in
theory is not in the same spirit as lockdown. However, stopping all
processes and triggering scsi-dump is a priviledged HMC operation that
is otheriwse has a much higher access restrictions than lockdown can
provide.
[Other Info]
-
- * Original bug report
+ * Original bug report
I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
System can be secure booted, /sys/firmware/ipl/secure shows "1".
I prepared zfcp dump disk as described in LTC bug 185713.
Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.
Operating System Messages on HMC:
Preparing system.
Starting system.
System version 8.
Watchdog enabled.
Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
ZBootLoader 2.1.0.
MLOLOA6269064E Secure IPL: There are no signed components available on device HB
A=0.0.1800, WWPN=500507630309D327, LUN=4046400900000000.
IPL failed.
Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a
dump created.
Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
root at t35lp25:~# zipl --secure=1 -d /dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1
Building bootmap directly on partition '/dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1'
Adding dump section
initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
component address:
heap area.......: 0x00002000-0x00005fff
stack area......: 0x0000f000-0x0000ffff
internal loader.: 0x0000a000-0x0000dfff
parameters......: 0x00009000-0x000091ff
kernel image....: 0x00010000-0x001b9fff
parmline........: 0x001ba000-0x001ba1ff
initial ramdisk.: 0x001c0000-0x0020edff
Preparing boot device: sde.
Done.
...and tried to SCSI dump this device again. But the same failure occured.
Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to s390-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1877089
Title:
zfcpdump kernel can not be IPLed when secure boot is requested
Status in Ubuntu on IBM z Systems:
Confirmed
Status in s390-tools package in Ubuntu:
Invalid
Status in zfcpdump-kernel package in Ubuntu:
Confirmed
Status in zfcpdump-kernel source package in Focal:
Confirmed
Status in zfcpdump-kernel source package in Groovy:
Confirmed
Bug description:
[Impact]
* zfcpdump-kernel incompatible with s390-tools in focal
* zfcpdump-kernel incompatible with SIPL (secure IPL)
* fix all that for focal and up
* Upgrade to the v5.4 kernel
* Enable signing
* Update the path of the image, to the one that `zipl -d` in focal expects
[Test Case]
* Prepare sda1 drive for SCSI dump
* Stop all processes from the HMC
* Perform SCSI dump load from HMC
* Observe that dump is successful and used v5.4 kernel from the Operating System Messages
* Perform regular
* Mount the dump, and observe it is there in full
* Can be performed on the canonical z13 hmc without SIPL
* Will need IBM confirmation with SIPL, or further fixes
[Publication]
* zfcpdump-kernel image is OS series independant, and thus can be
build in focal with copies up to groovy.
[Regression Potential]
* The kernel image used for zfcpdump is fairly static, doesn't have
loadable modules, but it does allow reading kernel memory which in
theory is not in the same spirit as lockdown. However, stopping all
processes and triggering scsi-dump is a priviledged HMC operation that
is otheriwse has a much higher access restrictions than lockdown can
provide.
[Other Info]
* Original bug report
I installed Ubuntu 20.04 on IBM z15 with secure=1 in zipl conf.
System can be secure booted, /sys/firmware/ipl/secure shows "1".
I prepared zfcp dump disk as described in LTC bug 185713.
Stopped the system and performed a SCSI dump with "Enable Secure Boot for Linux" enabled.
Operating System Messages on HMC:
Preparing system.
Starting system.
System version 8.
Watchdog enabled.
Running 'ZBootLoader' version '1.0.0' level 'D41C.D41C_0014'.
ZBootLoader 2.1.0.
MLOLOA6269064E Secure IPL: There are no signed components available on device HB
A=0.0.1800, WWPN=500507630309D327, LUN=4046400900000000.
IPL failed.
Without "Enable Secure Boot for Linux" the dump kernel was IPLed and a
dump created.
Then I tried to rewrite the zfcp dump kernel with explicite setting of --secure=1:
root at t35lp25:~# zipl --secure=1 -d /dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1
Building bootmap directly on partition '/dev/disk/by-id/scsi-36005076303ffd3270000000000004609-part1'
Adding dump section
initial ramdisk...: /lib/s390-tools/zfcpdump/zfcpdump-initrd
kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1 cgroup_disable=memory '
component address:
heap area.......: 0x00002000-0x00005fff
stack area......: 0x0000f000-0x0000ffff
internal loader.: 0x0000a000-0x0000dfff
parameters......: 0x00009000-0x000091ff
kernel image....: 0x00010000-0x001b9fff
parmline........: 0x001ba000-0x001ba1ff
initial ramdisk.: 0x001c0000-0x0020edff
Preparing boot device: sde.
Done.
...and tried to SCSI dump this device again. But the same failure occured.
Again, without "Enable Secure Boot for Linux" the dump kernel was IPLed and a dump created.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1877089/+subscriptions
More information about the foundations-bugs
mailing list