Public bug reported: [ Impact ]
On an azure CVM instance, install or upgrade nullboot sometimes show the following error: final reseal failed: cannot obtain auth key from kernel: cannot read key from kernel: cannot determine size of key payload: permission denied dpkg: error processing package nullboot (--configure): installed nullboot package post-installation script subprocess returned error exit status 1 Errors were encountered while processing: nullboot needrestart is being skipped since dpkg has failed E: Sub-process /usr/bin/dpkg returned an error code (1) The issue is golang has its own go routine scheduler (pure userspace) which may schedule a go routine to a different kernel thread to run, and the keyring is linked/stored in the kernel thread. So if a go routine calls unixKeyctlInt to link the user keyring into a kernel thread it's currently running on, and then the go routine is scheduled to run on another kernel thread and calls sbGetPrimaryKeyFromKernel to read the keyring, it will return failed with permission denied We need to pin the kernel thread during linking and reading user keyring, this upstream commit fixes the issue: https://github.com/canonical/nullboot/commit/5ea1aea3017ad68108bf7fd681ed6c00cf6da1c2 [ Test Plan ] This issue can be reproduced on an azure CVM instance by running the following script: #!/bin/bash for i in {1..100}; do if ! sudo apt reinstall nullboot; then echo " ##### ITERATION #$i #####" echo "reproduced the issue" exit 1 fi echo " ##### ITERATION #$i #####" done [ Where problems could occur ] Function getPrimaryKeyFromKernel is used to link and then read the user keyring, the fix is to call runtime.LockOSThread() in the beginning to make sure the whole function is running on the same kernel thread, and call runtime.UnlockOSThread() when the function is done. There is no real change in the code path, so the risk is low. ** Affects: nullboot (Ubuntu) Importance: Undecided Status: New ** Affects: nullboot (Ubuntu Jammy) Importance: Undecided Status: In Progress ** Affects: nullboot (Ubuntu Noble) Importance: Undecided Status: In Progress ** Affects: nullboot (Ubuntu Resolute) Importance: Undecided Status: In Progress ** Also affects: nullboot (Ubuntu Jammy) Importance: Undecided Status: New ** Also affects: nullboot (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: nullboot (Ubuntu Noble) Importance: Undecided Status: New ** Changed in: nullboot (Ubuntu Jammy) Status: New => In Progress ** Changed in: nullboot (Ubuntu Noble) Status: New => In Progress ** Changed in: nullboot (Ubuntu Resolute) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167545 Title: Pin goroutine to OS thread when reading the primary key To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nullboot/+bug/2167545/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
