<div dir="ltr"><div>This should be addressed to the maintainers of meta-secure-core, this is, Jia. <br></div><div><br></div><div>Openembedded/Yocto in general does not define or test OS upgrades.</div><div><br></div><div>You can also start looking into the failure you're getting from here:</div><div><a href="https://github.com/rpm-software-management/rpm/blob/master/plugins/ima.c">https://github.com/rpm-software-management/rpm/blob/master/plugins/ima.c</a></div><div><br></div><div>Alex<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, 16 Feb 2020 at 22:21, Muhlenkamp, Lewis <<a href="mailto:lewis.muhlenkamp@stryker.com">lewis.muhlenkamp@stryker.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_3294336248073245212WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ve been trying to get the security stuff in meta-secure-core working so I can upgrade from one version of the OS I’m creating, right now called LewisOS, to a new version, just by being able to run “rpm -U” or “dnf upgrade” commands. I
can run “dnf upgrade” successfully against non kernel related packages, but the kernel, initramfs and systemd-boot RPMs always fail with the same error, no matter what I try.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am using Zeus for my builds. I am using an older commit for LewisOS version X, 8a518a2054bdd349d7661ee4872590fc8750313f, dated 2019 Dec 30, of the meta-secure-core GIT repo. I am using 8302e3c479154157667e22e9d7c5461c966b4586, dated
2020 Jan 19, of the meta-secure-core GIT repo for LewisOS version Y.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My machine is intel-corei7-64.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’ll just stick with systemd-boot RPM for this email. LewisOS version X installs systemd-boot-243+0+efb536d0cb-r0.corei7_64_intell_common. LewisOS version Y contains systemd-boot-243.2-r0.corei7_64_intel_common. When I try to upgrade
systemd-boot, I get the following error message:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">=== Start upgrade messages ===<u></u><u></u></p>
<p class="MsoNormal">root@intel-corei7-64:/var/opt/repos/os# rpm -q systemd-boot<u></u><u></u></p>
<p class="MsoNormal">systemd-boot-243+0+efb536d0cb-r0.corei7_64_intel_common<u></u><u></u></p>
<p class="MsoNormal">root@intel-corei7-64:/var/opt/repos/os# rpm -qp systemd-boot-243.2-r0.corei7_64_intel_common.rpm<u></u><u></u></p>
<p class="MsoNormal">systemd-boot-243.2-r0.corei7_64_intel_common<u></u><u></u></p>
<p class="MsoNormal">root@intel-corei7-64:/var/opt/repos/os# rpm -Uhv systemd-boot-243.2-r0.corei7_64_intel_common.rpm<u></u><u></u></p>
<p class="MsoNormal">Verifying… ######################################## [100%]<u></u><u></u></p>
<p class="MsoNormal">Preparing… ######################################## [100%]<u></u><u></u></p>
<p class="MsoNormal">Updating / installing…<u></u><u></u></p>
<p class="MsoNormal"> 1:systemd-boot-243.2-r0 ######################################## [ 50%]<u></u><u></u></p>
<p class="MsoNormal">error: ima: could not apply signature on ‘/boot/EFI/BOOT/bootx64.efi;5e49ad05’: Operation not supported<u></u><u></u></p>
<p class="MsoNormal">error: Plugin ima: hook fsm_file_prepare failed<u></u><u></u></p>
<p class="MsoNormal">error: unpacking of archive failed on file /boot/EFI/BOOT/bootx64.efi;5e49ad05: cpio: (error 0x2)<u></u><u></u></p>
<p class="MsoNormal">error: systemd-boot-243.2-r0.corei7_64_intel_common: install failed<u></u><u></u></p>
<p class="MsoNormal">error: systemd-boot-243+0+efb536d0cb-r0.corei7_64_intel_common: erase skipped<u></u><u></u></p>
<p class="MsoNormal">=== End upgrade messages ===<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The above error messages also appear when I try updating kernel-image-bzimage, kernel-initramfs and systemd-bootconf.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have the following in my bblayers.conf file:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">=== Start bblayers.conf ===<u></u><u></u></p>
<p class="MsoNormal"># LAYER_CONF_VERSION is increased each time build/conf/bblayers.conf<u></u><u></u></p>
<p class="MsoNormal"># changes incompatibly<u></u><u></u></p>
<p class="MsoNormal">LCONF_VERSION = "7"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">BBPATH = "${TOPDIR}"<u></u><u></u></p>
<p class="MsoNormal">BBFILES ?= ""<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">BBLAYERS ?= " \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-stryker/meta-lewisos-distro \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-stryker/meta-lewisos-common \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-stryker/meta-lewisos-edge \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/oe-core/meta \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-python \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-perl \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-filesystems \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-oe \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-networking \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-openembedded/meta-webserver \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-intel \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-virtualization \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-cloud-services \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-cloud-services/meta-openstack \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-signing-key \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-tpm \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-tpm2 \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-efi-secure-boot \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-integrity \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-encrypted-storage \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-ids \<u></u><u></u></p>
<p class="MsoNormal"> ${HOME}/meta-secure-core/meta-intel-sgx \<u></u><u></u></p>
<p class="MsoNormal"> "<u></u><u></u></p>
<p class="MsoNormal">=== End bblayers.conf ===<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Here is my local.conf file<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">=== Start local.conf ===<u></u><u></u></p>
<p class="MsoNormal">MACHINE ?= "intel-corei7-64"<u></u><u></u></p>
<p class="MsoNormal">DL_DIR ?= "/var/opt/openembedded-linux/downloads"<u></u><u></u></p>
<p class="MsoNormal">SSTATE_DIR ?= "/var/opt/openembedded-linux/sstate-cache"<u></u><u></u></p>
<p class="MsoNormal">PACKAGE_CLASSES ?= "package_rpm"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Extra image configuration defaults<u></u><u></u></p>
<p class="MsoNormal">#<u></u><u></u></p>
<p class="MsoNormal"># The EXTRA_IMAGE_FEATURES variable allows extra packages to be added to the generated<u></u><u></u></p>
<p class="MsoNormal"># images.<u></u><u></u></p>
<p class="MsoNormal"># There are other application targets that can be used here too, see<u></u><u></u></p>
<p class="MsoNormal"># meta/classes/image.bbclass and meta/classes/core-image.bbclass for more details.<u></u><u></u></p>
<p class="MsoNormal"># We default to enabling the debugging tweaks.<u></u><u></u></p>
<p class="MsoNormal">EXTRA_IMAGE_FEATURES ?= "debug-tweaks"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">USER_CLASSES ?= "buildstats image-mklibs image-prelink"<u></u><u></u></p>
<p class="MsoNormal">PATCHRESOLVE = "noop"<u></u><u></u></p>
<p class="MsoNormal">BB_DISKMON_DIRS ??= "\<u></u><u></u></p>
<p class="MsoNormal"> STOPTASKS,${TMPDIR},1G,100K \<u></u><u></u></p>
<p class="MsoNormal"> STOPTASKS,${DL_DIR},1G,100K \<u></u><u></u></p>
<p class="MsoNormal"> STOPTASKS,${SSTATE_DIR},1G,100K \<u></u><u></u></p>
<p class="MsoNormal"> STOPTASKS,/tmp,100M,100K \<u></u><u></u></p>
<p class="MsoNormal"> ABORT,${TMPDIR},100M,1K \<u></u><u></u></p>
<p class="MsoNormal"> ABORT,${DL_DIR},100M,1K \<u></u><u></u></p>
<p class="MsoNormal"> ABORT,${SSTATE_DIR},100M,1K \<u></u><u></u></p>
<p class="MsoNormal"> ABORT,/tmp,10M,1K"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">PACKAGECONFIG_append_pn-qemu-native = " sdl"<u></u><u></u></p>
<p class="MsoNormal">PACKAGECONFIG_append_pn-nativesdk-qemu = " sdl"<u></u><u></u></p>
<p class="MsoNormal">CONF_VERSION = "1"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DISTRO = "lewisos"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># The following 2 lines are to generate an ISO.<u></u><u></u></p>
<p class="MsoNormal">IMAGE_FSTYPES += "live"<u></u><u></u></p>
<p class="MsoNormal">NOISO = "0"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># The following line is needed to help address issues with updating the OS.<u></u><u></u></p>
<p class="MsoNormal"># It prevents a lot of messages regarding file/directory ownership issues.<u></u><u></u></p>
<p class="MsoNormal">DIRFILES = "1"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># The BBMASK directive below is to prevent the kernel-initramfs.bbappend<u></u><u></u></p>
<p class="MsoNormal"># from meta-secure-core from being used. We have customized the bb file.<u></u><u></u></p>
<p class="MsoNormal"># So, don't want any changes to it.<u></u><u></u></p>
<p class="MsoNormal">BBMASK += "meta-secure-core/meta-efi-secure-boot/recipes-core/images/kernel-initramfs.bbappend"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># INITRAMFS_IMAGE must be defined here. It cannot be defined in an image<u></u><u></u></p>
<p class="MsoNormal"># recipe. If it is only defined in an image recipe, the build fails to<u></u><u></u></p>
<p class="MsoNormal"># sign packages.<u></u><u></u></p>
<p class="MsoNormal">INITRAMFS_IMAGE = "secure-core-image-initramfs"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Similarly, the kernel-image-bzimage must be defined here. When it was<u></u><u></u></p>
<p class="MsoNormal"># set in the image recipe, got complaints about no buildable providers.<u></u><u></u></p>
<p class="MsoNormal"># Weird.<u></u><u></u></p>
<p class="MsoNormal">IMAGE_INSTALL += "kernel-image-bzimage"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># These DISTRO_FEATURES must remain here. When I tried to put them into<u></u><u></u></p>
<p class="MsoNormal"># the lewisos.conf distro configuration file, the build of the stryker-edge<u></u><u></u></p>
<p class="MsoNormal"># image failed. Got old errors. Apparently some of the bbappends were<u></u><u></u></p>
<p class="MsoNormal"># not picked up properly when these were defined in the distro config<u></u><u></u></p>
<p class="MsoNormal"># file. Not sure why.<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_NATIVE_append += "systemd ima tpm tpm2 efi-secure-boot luks"<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_append += "systemd ima tpm tpm2 efi-secure-boot luks modsign pam intel-sgx"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">MACHINE_FEATURES_NATIVE_append += "efi"<u></u><u></u></p>
<p class="MsoNormal">MACHINE_FEATURES_append += "efi"<u></u><u></u></p>
<p class="MsoNormal">DEBUG_FLAGS_forcevariable = ""<u></u><u></u></p>
<p class="MsoNormal">USER_CLASSES_remove = "image-prelink"<u></u><u></u></p>
<p class="MsoNormal">=== End local.conf ===<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Here is my lewisos.conf distro configuration file.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">=== Start lewisos.conf ===<u></u><u></u></p>
<p class="MsoNormal"># Lewisos distribution configuration file<u></u><u></u></p>
<p class="MsoNormal">DISTRO = "lewisos"<u></u><u></u></p>
<p class="MsoNormal">DISTRO_NAME = "Lewis test distribution"<u></u><u></u></p>
<p class="MsoNormal">DISTRO_VERSION = "0.1.3-ou"<u></u><u></u></p>
<p class="MsoNormal">MAINTAINER = "<a href="mailto:mako.device@stryker.com" target="_blank">mako.device@stryker.com</a>"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">IMAGE_VERSION_SUFFIX = "-${DISTRO_VERSION}"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Want to use systemd as the init manager<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_append = " systemd"<u></u><u></u></p>
<p class="MsoNormal">VIRTUAL-RUNTIME_init_manager = "systemd"<u></u><u></u></p>
<p class="MsoNormal">VIRTUAL-RUNTIME_initscripts = "systemd-compat-units"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Need virtualization<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_append = " virtualization"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Add support for wireless<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_append = " wifi"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Add support for disk encryption, secure boot and access to TPM<u></u><u></u></p>
<p class="MsoNormal"># Needed for both the product build, and for native<u></u><u></u></p>
<p class="MsoNormal"># From the meta-secure-core layer<u></u><u></u></p>
<p class="MsoNormal"># DISTRO_FEATURES_append = " ima tpm tpm2 efi-secure-boot luks modsign pam intel-sgx"<u></u><u></u></p>
<p class="MsoNormal"># DISTRO_FEATURES_NATIVE_append = " ima tpm tpm2 efi-secure-boot luks"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Remove undesirable features<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_BACKFILL_CONSIDERED += "nfs"<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit"<u></u><u></u></p>
<p class="MsoNormal">DISTRO_FEATURES_BACKFILL_CONSIDERED += "zeroconf"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># Set up for signing RPMs<u></u><u></u></p>
<p class="MsoNormal"># Inherit the sign_rpm_ext and user-key-store classes from the meta-secure-core<u></u><u></u></p>
<p class="MsoNormal"># layer. They provide some additional functionality.<u></u><u></u></p>
<p class="MsoNormal"># If not using the meta-secure-core layer, uncomment the sign_rpm line and<u></u><u></u></p>
<p class="MsoNormal"># comment out the sign_rpm_ext and user-key-store lines.<u></u><u></u></p>
<p class="MsoNormal"># INHERIT += "sign_rpm"<u></u><u></u></p>
<p class="MsoNormal">INHERIT += "sign_rpm_ext"<u></u><u></u></p>
<p class="MsoNormal">INHERIT += "user-key-store"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"># NOTE: The two RPM_GPG lines cannot have spaces in their values. It causes<u></u><u></u></p>
<p class="MsoNormal"># the build to fail since the scripts cannot handle the space.<u></u><u></u></p>
<p class="MsoNormal">RPM_GPG_NAME = "xxxxxxxx"<u></u><u></u></p>
<p class="MsoNormal">RPM_GPG_PASSPHRASE = "yyyyyyyy"<u></u><u></u></p>
<p class="MsoNormal">=== End lewisos.conf ===<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">And here is my bbappend for linux-intel<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">=== Start linux-intel_%.bbappend ===<u></u><u></u></p>
<p class="MsoNormal">FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"<u></u><u></u></p>
<p class="MsoNormal">SRC_URI += "file://kernel_baseline.scc"<u></u><u></u></p>
<p class="MsoNormal">KERNEL_IMAGEDEST = "boot/${DISTRO}-${DISTRO_VERSION}"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">FILES_kernel-image-bzimage = "/boot/${PV}/bzImage-${KERNEL_VERSION_NAME}"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">python do_package_prepend () {<u></u><u></u></p>
<p class="MsoNormal"> os.remove(d.getVar('D') + '/' + d.getVar('KERNEL_IMAGEDEST') + '/bzImage')<u></u><u></u></p>
<p class="MsoNormal">}<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">require recipes-kernel/linux/linux-yocto-integrity.inc<u></u><u></u></p>
<p class="MsoNormal">=== End linux-intel_%.bbappend ===<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m removing symbolic links and putting the kernel and initramfs in version specific directories because the /boot partition is vfat, which doesn’t support symbolic links, and if I kept the names as something like bzImage, then “dnf upgrade”
would complain about multiple RPMs trying to own the same file.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">What am I missing? Where did I make a mistake? Does the meta-secure-core, or Openembedded/Yocto in general support upgrading from version X to version Y of an OS using just some command like “dnf upgrade”?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If you need more information, please let me know.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">As one last piece of info, if I remove “ima” from DISTRO_FEATURES, the build hangs when trying to sign the RPMs.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thank you<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Lewis Muhlenkamp<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
Follow this link to read our <a href="https://www.stryker.com/content/stryker/gb/en/legal/global-policy-statement.html/" target="_blank">
Privacy Statement</a>
</div>
-- <br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org" target="_blank">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</blockquote></div>