This bug was fixed in the package ubuntu-advantage-tools - 27.3~21.04.1
---------------
ubuntu-advantage-tools (27.3~21.04.1) hirsute; urgency=medium
* Backport new upstream release: (LP: #1942929) to hirsute
ubuntu-advantage-tools (27.3~21.10.1) impish; urgency=medium
* d/tools.postinst:
- consider cloud to be "none" on any cloud-id error
- purge old ua-messaging.timer/service files
- keep ua-timer.timer disabled if ua-messaging.timer was disabled by
the user
- properly configure both ubuntu-advantage-timer and
ubuntu-advantage-licence-check logs
* d/tools.postrm:
- remove ubuntu-advantage-timer and ubuntu-advantage-license-check logs
during purge
* systemd:
- remove ua-messaging.timer/service
- add new ua-timer.timer that runs every 6 hours
- add new ua-license_check.timer that runs every 5 minutes only if
activated by ua-license-check.path
* New upstream release 27.3 (LP: #1942929)
- ros:
+ add beta support to enable ros and ros-updates
+ add support for "required services" so that esm-infra and esm-apps
get auto-enabled when enabling ros or ros-updates
+ add support for "dependent services" so that user gets prompted to
disable ros/ros-updates if they disable esm-infra/esm-apps
- fips:
+ allow fips on GCP bionic now that optimized kernel is ready
+ disallow enabling fips on focal on clouds until cloud-optimized focal
fips-certified kernel is ready (LP: #1939449, LP: #1939932)
+ print warning about generic fips kernel if cloud-id fails
- cloud:
+ rely only on cloud-id to determine cloud type (LP: #1940131)
+ catch errors when determining cloud type
(LP: #1938207, LP: #1944676) (GH: #1541)
- azure:
+ bump IMDS API version to support Azure published images
- cli:
+ collect-logs command that creates a tar file with debug-relevant logs
and status info (GH: #463)
+ clean locks on exceptions more thoroughly to avoid false "Operation in
progress" status messages
+ retain past service state after detach
+ shows better error message when a port value in a proxy is invalid
- non-unicode locale support:
+ remove unicode-only characters from help file
+ don't print unicode-only characters in ua fix if non-utf8 locale
(GH: #1463)
- logrotate:
+ add logrotate functionality for ubuntu-advantage-timer.log.
+ Fix root:root logrotate permissions.
- ua-timer.timer:
+ introduce a single systemd timer to handle ua recurring jobs
+ timer runs every 2 hours to support most frequent timer job
+ recurring job intervals are configurable in uaclient.conf
+ individual jobs are disabled if their interval is set to 0
- status job:
+ update ua status every 12 hours
- messaging job:
+ update APT/MOTD ESM messaging every 6 hours
- metering job:
+ disabled until infrastructure is ready
+ for attached machines only, periodically update contract server with
status information for proper contract metering
- ua-license-check.timer:
+ only runs on LTS GCP instances that are not attached
+ runs every 5 minutes to check if gcp instance has license required to
auto-attach
- logs:
+ fixes duplicate logging (GH: #553)
- tests and support:
+ remove groovy integration tests
+ various improvements to integration tests
-- Grant Orndorff <grant.orndo...@canonical.com> Thu, 23 Sep 2021
16:42:08 -0400
** Changed in: ubuntu-advantage-tools (Ubuntu Hirsute)
Status: Fix Committed => Fix Released
** Changed in: ubuntu-advantage-tools (Ubuntu Focal)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1939932
Title:
Ubuntu PRO Focal on AWS and Azure should not install the generic FIPS
kernel via ubuntu-fips metapackage
Status in ubuntu-advantage-tools package in Ubuntu:
Fix Committed
Status in ubuntu-advantage-tools source package in Xenial:
Fix Released
Status in ubuntu-advantage-tools source package in Bionic:
Fix Released
Status in ubuntu-advantage-tools source package in Focal:
Fix Released
Status in ubuntu-advantage-tools source package in Hirsute:
Fix Released
Status in ubuntu-advantage-tools source package in Impish:
Fix Released
Bug description:
[Impact]
This bug impacts users on AWS or Azure, trying to enable FIPS/FIPS
updates on Focal images. Trying to install a non-cloud-optimized FIPS
kernel may lead to unwanted behavior on those clouds, including
inability to boot to the systems.
Although Focal has a FIPS certified kernel, the AWS adapted kernel is
not ready yet. There will be in the future a cloud-optimized version
of the FIPS kernel, and then users will be able to install it.
With the applied fix, UA will show a message saying that the kernel is
not available instead of showing any error. If the user really wants
to install FIPS, there is a feature override
("allow_default_fips_metapackage_on_focal_cloud") which will install
the default kernel, but this is the user's choice, and not
recommended.
[Test Case]
To verify that this issue is fixed by version 27.3, please run the
following script:
------------------------------
import os
from pycloudlib.ec2.cloud import EC2
api = EC2(
tag="test-ec2",
access_key_id=os.getenv("UACLIENT_BEHAVE_AWS_ACCESS_KEY_ID"),
secret_access_key=os.getenv("UACLIENT_BEHAVE_AWS_SECRET_ACCESS_KEY")
)
image_id = "ami-0ae1f7f35ab8e62d5" # Focal pro image
private_key_path = "ec2-{}.pem".format("test-key")
key_name = "test-key"
if key_name in api.list_keys():
api.delete_key(key_name)
keypair = api.client.create_key_pair(KeyName=key_name)
with open(private_key_path, "w") as stream:
stream.write(keypair["KeyMaterial"])
os.chmod(private_key_path, 0o600)
api.use_key(private_key_path, private_key_path, key_name)
vpc = api.get_or_create_vpc(name="test-ec2-pro")
instance = api.launch(image_id, vpc=vpc)
print("--- Creating base instance")
print(instance.execute("lsb_release -a"))
print(instance.execute("ua version"))
print(instance.execute("sudo ua enable fips --assume-yes"))
print("------------------")
print("--- Updating ua package")
print(instance.execute('sh -c \'echo "deb http://archive.ubuntu.com/ubuntu
$(lsb_release -sc)-proposed main" | tee
/etc/apt/sources.list.d/proposed.list\''))
instance.execute("sh -c 'sudo apt-get update > /dev/null'")
instance.execute("sh -c 'sudo apt-get install ubuntu-advantage-tools >
/dev/null'")
print(instance.execute("ua version"))
print(instance.execute("sudo ua enable fips --assume-yes"))
print("------------------")
instance.delete()
-------------------------------------------
This script depends on pycloudlib, which can be found here:
https://github.com/canonical/pycloudlib/tree/main/pycloudlib
[Regression Potential]
This change needs to make sure that we indeed prevent the installation of
non-cloud-optimized kernels. If a corner case shows up, the user might end up
with a wrong kernel. This is unlikely because we are using cloud-init tools,
present in AWS and Azure, to detect the cloud instance and effective blocking
the install. If this detection fails, it means cloud-init has some problem and
then, on AWS or Azure, the instance will have more problems than this one.
We need to make sure to keep track of the certification progress for
the cloud adapted FIPS package, so we can enable it in the future,
when it becomes available.
[Original Description]
For Ubuntu PRO on 20.04 (Focal) `ua enable fips` should only install a
cloud-optimized ubuntu-aws-fips or ubuntu-azure-fips metapackage. Installing a
non-cloud-optimized FIPS kernel on AWS and Azure could lead to inability to
boot on certain instance types. Expectation is that Focal AWS and Azure images
should disallow enabling either fips or fips-updates.
Expected behavior on Ubuntu PRO AWS and Azure Focal:
$ ua status | grep fips
fips no — NIST-certified FIPS modules
fips-updates no — Uncertified security updates to FIPS modules
$ sudo ua enable fips-updates
One moment, checking your subscription first
This system will NOT be considered FIPS certified, but will include security
and bug fixes to the FIPS packages.
Are you sure? (y/N) y
This subscription is not entitled to FIPS Updates.
For more information see: https://ubuntu.com/advantage
Actual behavior:
$ ua status | grep fips
fips yes disabled NIST-certified FIPS modules
fips-updates yes disabled Uncertified security updates to FIPS modules
$ sudo ua enable fips-updates
One moment, checking your subscription first
This system will NOT be considered FIPS certified, but will include security
and bug fixes to the FIPS packages.
Are you sure? (y/N) y
Updating package lists
Installing FIPS Updates packages
FIPS Updates enabled
A reboot is required to complete install
# see ubuntu-fips generic get installed which potentially degrades AWS and
Azure environments
$ sudo grep install /var/log/ubuntu-advantage.log
2021-08-13 22:19:07,344 - util.py:(506) [DEBUG]: Ran cmd: apt-get install
--assume-yes -o Dpkg::Options::="--force-confdef" -o
Dpkg::Options::="--force-confold" ubuntu-fips openssh-client
openssh-client-hmac openssh-server openssh-server-hmac openssh-client
openssh-client-hmac openssh-server openssh-server-hmac, rc: 0 stderr: b''
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1939932/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help : https://help.launchpad.net/ListHelp
