Public bug reported:
Summary
On an Ubuntu 24.04 (noble) Azure Confidential VM, the signed UKI shipped
with linux-image-6.17.0-1018-azure-fde runs the Ubuntu Core initrd unit
initrd-core-tmpfiles-setup.service on every boot. The unit fails because
core-writable.conf does not exist on a classic (cloudimg-rootfs) system.
Boot completes normally, but the failed unit is carried into the running
system, which then reports degraded.
Environment
Ubuntu 24.04 LTS, Azure Confidential VM (AMD SEV-SNP,
Standard_NCC40ads_H100_v5), Secure Boot and vTPM enabled, DiskWithVMGuestState
Kernel: 6.17.0-1018-azure-fde
Kernel command line contains snapd_recovery_mode=cloudimg-rootfs
Boot path: shim → /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde,
managed by nullboot 0.5.3-0ubuntu0.24.04.1
ubuntu-core-initramfs is not installed; the UKI is not rebuilt locally
Provenance of the booted UKI
$ dpkg -L linux-image-6.17.0-1018-azure-fde | grep efi
/usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde
$ cmp /usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde \
/boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde && echo identical
identical
$ sbverify --list /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde
signature 1
image signature issuers:
- /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master
Certificate Authority
image signature certificates:
- subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical
Ltd. Secure Boot Signing (2022 v1)
Observed behaviour (every boot, unit attempted twice per boot)
systemd[1]: Starting initrd-core-tmpfiles-setup.service - Create initial
writable directories...
systemd-tmpfiles[626]: Failed to open 'core-writable.conf': No such file or
directory
systemd[1]: initrd-core-tmpfiles-setup.service: Main process exited,
code=exited, status=1/FAILURE
systemd[1]: initrd-core-tmpfiles-setup.service: Failed with result 'exit-code'.
systemd[1]: Failed to start initrd-core-tmpfiles-setup.service - Create initial
writable directories.
After switch-root:
$ systemctl --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
● initrd-core-tmpfiles-setup.service not-found failed failed
initrd-core-tmpfiles-setup.service
Reproducible from the very first boot
The failure is already present on the first boot of the image, before
any package was installed, upgraded or removed (first apt transaction is
~6 minutes later). It occurs identically on all later boots. No linux-*,
nullboot, shim or grub package was changed between the first and the
current boot.
Expected behaviour
On a classic root filesystem booted with snapd_recovery_mode=cloudimg-
rootfs, Ubuntu Core–specific initrd units should not run, or should be
skipped cleanly, so that the system does not end up degraded.
Analysis (not verified against the shipped UKI contents)
In core-initrd (snapd repository), the unit is:
ConditionPathExists=!/sysroot/etc/system-image/writable-paths
ExecStart=/usr/bin/systemd-tmpfiles --root=/sysroot --create core-writable.conf
SuccessExitStatus=DATAERR CANTCREAT
On a classic system /etc/system-image/writable-paths never exists, so
the condition always passes. core-writable.conf is not present, and the
resulting exit status 1 is not covered by SuccessExitStatus. Possible
fixes: also condition the unit on the presence of core-writable.conf or
on the boot mode not being cloudimg-rootfs, or exclude the unit when
building the azure-fde UKI.
Impact
Cosmetic for boot, but systemctl is-system-running reports degraded
permanently, which triggers health checks and monitoring on confidential
VM fleets.
** Affects: linux-azure-fde-6.17 (Ubuntu)
Importance: Undecided
Status: New
** Description changed:
**Summary**
On an Ubuntu 24.04 (noble) Azure Confidential VM, the signed UKI shipped
with `linux-image-6.17.0-1018-azure-fde` runs the Ubuntu Core initrd
unit `initrd-core-tmpfiles-setup.service` on every boot. The unit fails
because `core-writable.conf` does not exist on a classic (cloudimg-
rootfs) system. Boot completes normally, but the failed unit is carried
into the running system, which then reports `degraded`.
**Environment**
- Ubuntu 24.04 LTS, Azure Confidential VM (AMD SEV-SNP,
`Standard_NCC40ads_H100_v5`), Secure Boot and vTPM enabled,
`DiskWithVMGuestState`
- Kernel: `6.17.0-1018-azure-fde`
- Kernel command line contains `snapd_recovery_mode=cloudimg-rootfs`
- Boot path: shim → `/boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde`,
managed by `nullboot 0.5.3-0ubuntu0.24.04.1`
- `ubuntu-core-initramfs` is not installed; the UKI is not rebuilt locally
**Provenance of the booted UKI**
```
$ dpkg -L linux-image-6.17.0-1018-azure-fde | grep efi
/usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde
$ cmp /usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde \
- /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde && echo identical
+ /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde && echo identical
identical
$ sbverify --list /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde
signature 1
image signature issuers:
- - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master
Certificate Authority
+ - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master
Certificate Authority
image signature certificates:
- - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical
Ltd. Secure Boot Signing (2022 v1)
+ - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical
Ltd. Secure Boot Signing (2022 v1)
```
**Observed behaviour (every boot, unit attempted twice per boot)**
```
systemd[1]: Starting initrd-core-tmpfiles-setup.service - Create initial
writable directories...
systemd-tmpfiles[626]: Failed to open 'core-writable.conf': No such file or
directory
systemd[1]: initrd-core-tmpfiles-setup.service: Main process exited,
code=exited, status=1/FAILURE
systemd[1]: initrd-core-tmpfiles-setup.service: Failed with result
'exit-code'.
systemd[1]: Failed to start initrd-core-tmpfiles-setup.service - Create
initial writable directories.
```
After switch-root:
```
$ systemctl --failed
- UNIT LOAD ACTIVE SUB DESCRIPTION
+ UNIT LOAD ACTIVE SUB DESCRIPTION
● initrd-core-tmpfiles-setup.service not-found failed failed
initrd-core-tmpfiles-setup.service
```
**Reproducible from the very first boot**
The failure is already present on the first boot of the image, before
any package was installed, upgraded or removed (first apt transaction is
~6 minutes later). It occurs identically on all later boots. No
`linux-*`, `nullboot`, `shim` or `grub` package was changed between the
first and the current boot.
**Expected behaviour**
On a classic root filesystem booted with `snapd_recovery_mode=cloudimg-
rootfs`, Ubuntu Core–specific initrd units should not run, or should be
skipped cleanly, so that the system does not end up `degraded`.
**Analysis (not verified against the shipped UKI contents)**
In `core-initrd` (snapd repository), the unit is:
```
ConditionPathExists=!/sysroot/etc/system-image/writable-paths
ExecStart=/usr/bin/systemd-tmpfiles --root=/sysroot --create
core-writable.conf
SuccessExitStatus=DATAERR CANTCREAT
```
On a classic system `/etc/system-image/writable-paths` never exists, so
the condition always passes. `core-writable.conf` is not present, and
the resulting exit status 1 is not covered by `SuccessExitStatus`.
Possible fixes: also condition the unit on the presence of `core-
writable.conf` or on the boot mode not being `cloudimg-rootfs`, or
exclude the unit when building the azure-fde UKI.
**Impact**
Cosmetic for boot, but `systemctl is-system-running` reports `degraded`
permanently, which triggers health checks and monitoring on confidential
VM fleets.
** Description changed:
- **Summary**
+ Summary
On an Ubuntu 24.04 (noble) Azure Confidential VM, the signed UKI shipped
- with `linux-image-6.17.0-1018-azure-fde` runs the Ubuntu Core initrd
- unit `initrd-core-tmpfiles-setup.service` on every boot. The unit fails
- because `core-writable.conf` does not exist on a classic (cloudimg-
- rootfs) system. Boot completes normally, but the failed unit is carried
- into the running system, which then reports `degraded`.
+ with linux-image-6.17.0-1018-azure-fde runs the Ubuntu Core initrd unit
+ initrd-core-tmpfiles-setup.service on every boot. The unit fails because
+ core-writable.conf does not exist on a classic (cloudimg-rootfs) system.
+ Boot completes normally, but the failed unit is carried into the running
+ system, which then reports degraded.
- **Environment**
+ Environment
- - Ubuntu 24.04 LTS, Azure Confidential VM (AMD SEV-SNP,
`Standard_NCC40ads_H100_v5`), Secure Boot and vTPM enabled,
`DiskWithVMGuestState`
- - Kernel: `6.17.0-1018-azure-fde`
- - Kernel command line contains `snapd_recovery_mode=cloudimg-rootfs`
- - Boot path: shim → `/boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde`,
managed by `nullboot 0.5.3-0ubuntu0.24.04.1`
- - `ubuntu-core-initramfs` is not installed; the UKI is not rebuilt locally
+ Ubuntu 24.04 LTS, Azure Confidential VM (AMD SEV-SNP,
Standard_NCC40ads_H100_v5), Secure Boot and vTPM enabled, DiskWithVMGuestState
+ Kernel: 6.17.0-1018-azure-fde
+ Kernel command line contains snapd_recovery_mode=cloudimg-rootfs
+ Boot path: shim → /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde,
managed by nullboot 0.5.3-0ubuntu0.24.04.1
+ ubuntu-core-initramfs is not installed; the UKI is not rebuilt locally
+ Provenance of the booted UKI
- **Provenance of the booted UKI**
-
- ```
$ dpkg -L linux-image-6.17.0-1018-azure-fde | grep efi
/usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde
$ cmp /usr/lib/linux/efi/kernel.efi-6.17.0-1018-azure-fde \
- /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde && echo identical
+ /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde && echo identical
identical
$ sbverify --list /boot/efi/EFI/ubuntu/kernel.efi-6.17.0-1018-azure-fde
signature 1
image signature issuers:
- - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master
Certificate Authority
+ - /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master
Certificate Authority
image signature certificates:
- - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical
Ltd. Secure Boot Signing (2022 v1)
- ```
+ - subject: /C=GB/ST=Isle of Man/O=Canonical Ltd./OU=Secure Boot/CN=Canonical
Ltd. Secure Boot Signing (2022 v1)
- **Observed behaviour (every boot, unit attempted twice per boot)**
+ Observed behaviour (every boot, unit attempted twice per boot)
- ```
systemd[1]: Starting initrd-core-tmpfiles-setup.service - Create initial
writable directories...
systemd-tmpfiles[626]: Failed to open 'core-writable.conf': No such file or
directory
systemd[1]: initrd-core-tmpfiles-setup.service: Main process exited,
code=exited, status=1/FAILURE
systemd[1]: initrd-core-tmpfiles-setup.service: Failed with result
'exit-code'.
systemd[1]: Failed to start initrd-core-tmpfiles-setup.service - Create
initial writable directories.
- ```
After switch-root:
- ```
$ systemctl --failed
- UNIT LOAD ACTIVE SUB DESCRIPTION
+ UNIT LOAD ACTIVE SUB DESCRIPTION
● initrd-core-tmpfiles-setup.service not-found failed failed
initrd-core-tmpfiles-setup.service
- ```
- **Reproducible from the very first boot**
+ Reproducible from the very first boot
The failure is already present on the first boot of the image, before
any package was installed, upgraded or removed (first apt transaction is
- ~6 minutes later). It occurs identically on all later boots. No
- `linux-*`, `nullboot`, `shim` or `grub` package was changed between the
- first and the current boot.
+ ~6 minutes later). It occurs identically on all later boots. No linux-*,
+ nullboot, shim or grub package was changed between the first and the
+ current boot.
- **Expected behaviour**
+ Expected behaviour
- On a classic root filesystem booted with `snapd_recovery_mode=cloudimg-
- rootfs`, Ubuntu Core–specific initrd units should not run, or should be
- skipped cleanly, so that the system does not end up `degraded`.
+ On a classic root filesystem booted with snapd_recovery_mode=cloudimg-
+ rootfs, Ubuntu Core–specific initrd units should not run, or should be
+ skipped cleanly, so that the system does not end up degraded.
- **Analysis (not verified against the shipped UKI contents)**
+ Analysis (not verified against the shipped UKI contents)
- In `core-initrd` (snapd repository), the unit is:
+ In core-initrd (snapd repository), the unit is:
- ```
ConditionPathExists=!/sysroot/etc/system-image/writable-paths
ExecStart=/usr/bin/systemd-tmpfiles --root=/sysroot --create
core-writable.conf
SuccessExitStatus=DATAERR CANTCREAT
- ```
- On a classic system `/etc/system-image/writable-paths` never exists, so
- the condition always passes. `core-writable.conf` is not present, and
- the resulting exit status 1 is not covered by `SuccessExitStatus`.
- Possible fixes: also condition the unit on the presence of `core-
- writable.conf` or on the boot mode not being `cloudimg-rootfs`, or
- exclude the unit when building the azure-fde UKI.
+ On a classic system /etc/system-image/writable-paths never exists, so
+ the condition always passes. core-writable.conf is not present, and the
+ resulting exit status 1 is not covered by SuccessExitStatus. Possible
+ fixes: also condition the unit on the presence of core-writable.conf or
+ on the boot mode not being cloudimg-rootfs, or exclude the unit when
+ building the azure-fde UKI.
- **Impact**
+ Impact
- Cosmetic for boot, but `systemctl is-system-running` reports `degraded`
+ Cosmetic for boot, but systemctl is-system-running reports degraded
permanently, which triggers health checks and monitoring on confidential
VM fleets.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170424
Title:
initrd-core-tmpfiles-setup.service fails on every boot of classic
Ubuntu 24.04 Azure CVM (linux-azure-fde UKI, cloudimg-rootfs mode)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-azure-fde-6.17/+bug/2170424/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
