** Description changed: + + [ Impact ] + + * This bug will make TPM FDE systems with GRUB installed unable to boot + after running update-grub. The reason is that TPM FDE systems use a + /boot/grub/grub.cfg managed by snapd, and not GRUB, which gets + incorrectly overwritten by update-grub. + + * update-grub can be run by the user, for example after changing the + GRUB settings, or by other packages during an apt transaction. In + both cases the result is the same: on the next boot the GRUB menu + only offers "UEFI Firmware Settings" and the installed system cannot + be started. The reporter found no way to recover the system. + + * The fix is in boot-managed-by-snapd, the package that marks a system + as booting through snapd. It diverts update-grub and update-grub2 and + installs replacements that do nothing, so grub.cfg is left as snapd + wrote it. The diversions are removed again if the package is removed. + + [ Test Plan ] + + * Reproduce the bug: + + 1. Setup a VM using TPM FDE on the affected release series + + a) Get the bootstrapping script: + https://gist.githubusercontent.com/valentindavid/7a6a74e6da16a3865b88e8bdf5c0294c/raw/c44039ea65180893c640f0c91d5f65a32ea681b9/qemu.sh + + b) Get the corresponding desktop ISO for the release series + + c) In a designated directory (e.g. $HOME/temp/<series>), run: + $ ./qemu.sh clear reset cdrom <path to .iso> + + d) Go through the installation and choose "Hardware backed encryption" + as full disk encryption + + e) After rebooting, open the VM without any arguments: + $ ./qemu.sh + + f) Make a backup of the disk image: + $ cp run.img ref_run.img + + 2. In the VM, update the GRUB configuration using `update-grub`: + $ sudo update-grub + + 3. Reboot the VM + 4. Assert that the boot fails + + * Test the fix: + + 1. Restore the backed up disk image: + $ cp ref_run.img run.img + + 2. Boot the VM again: + $ ./qemu.sh + + 3. In the VM, install the fixed version from proposed: + $ sudo apt upgrade boot-managed-by-snapd + + 4. In the VM, update the GRUB configuration `update-grub`: + $ sudo update-grub + + 5. Reboot the VM + 6. Assert the boot succeeds + + [ Where problems could occur ] + + * With this change update-grub and update-grub2 do nothing and report + success on systems that have boot-managed-by-snapd installed. A user + who changes the GRUB settings and runs update-grub will see no effect + and no message explaining why. + + * The diversions are added and removed by the package's maintainer + scripts. If that went wrong, update-grub could be missing, which + would make other packages that call it fail to configure, or it + could stay diverted after boot-managed-by-snapd is removed, leaving + a system whose GRUB configuration is never regenerated. + + * Only systems with boot-managed-by-snapd installed are affected, which + are the TPM FDE installs. A regression would show there as failing + package installs or upgrades that involve GRUB, or as a boot problem + after such an upgrade. + + [ Other Info ] + + * See: + https://code.launchpad.net/~bamf0/ubuntu/+source/boot-managed-by-snapd/+git/boot-managed-by-snapd/+merge/510552 + https://code.launchpad.net/~bamf0/ubuntu/+source/boot-managed-by-snapd/+git/boot-managed-by-snapd/+merge/514009 + https://code.launchpad.net/~bamf0/ubuntu/+source/boot-managed-by-snapd/+git/boot-managed-by-snapd/+merge/514010 + + * Test packages: + https://launchpad.net/~bamf0/+archive/ubuntu/boot-snapd-lp2020466-divert-update-grub + + ---- + ---- + + ORIGINAL: + Fresh installation of Ubuntu 26.04, fully up-to-date. As discussed here: https://discourse.ubuntu.com/t/84315 and presenting this bug report as requested by @ogra (Oliver Grawert) here: https://discourse.ubuntu.com/t/84315/6 --- SUMMARY After installing Ubuntu 26.04, I checked that everything was working (including being able to reboot). Normally, I change Grub to show the menu on boot, as I always do on a fresh installation. I didn't realise that Ubuntu 26.04 has completely changed the booting and Grub mechanisms, so I used the same method as on previous releases. Apparently, the system (specifically update-grub) should have refused to try to implement my change, but instead it broke the system without the ability to restore it. --- HOW TO REPLICATE 1. Create a file /etc/default/grub.d/grubmenu.cfg (the name isn't important) with the following lines: GRUB_TIMEOUT_STYLE=menu GRUB_TIMEOUT=8 2. Run sudo update-grub 3. Reboot --- RESULTS • The Grub menu displays only one option, specifically "UEFI Firmware Settings". As expected, this option takes you to the BIOS settings. • If you interrupt the boot sequence with the Esc key, you get the new 26.04 Grub options. However, "Continue to run mode" takes you to the previous step. • There appears to be no way to restore the system to working order; I couldn't figure it out. I tried running the restore option, but it didn't work for me. • I have retried this with reliably repeatable results. --- SYSTEM $ lsb_release --all No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 26.04 LTS Release: 26.04 Codename: resolute • Fresh installation of Ubuntu 26.04, using TPM-backed full-disk encryption with EFI and Secure Boot enabled. I haven't enabled Pro. • This was done on VirtualBox (Host: Ubuntu 24.04), so it is in a VM. I have not tried this on bare metal for obvious reasons. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: grub2-common 2.14-2ubuntu2 ProcVersionSignature: Ubuntu 7.0.0-22.22-generic 7.0.0 Uname: Linux 7.0.0-22-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Sat Jun 20 14:50:54 2026 ProcEnviron: - LANG=en_US.UTF-8 - PATH=(custom, no user) - SHELL=/bin/bash - TERM=xterm-256color - XDG_RUNTIME_DIR=<set> + LANG=en_US.UTF-8 + PATH=(custom, no user) + SHELL=/bin/bash + TERM=xterm-256color + XDG_RUNTIME_DIR=<set> SourcePackage: grub2 UpgradeStatus: No upgrade log present (probably fresh install)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2157702 Title: Amending Grub on 26.04 breaks boot, with no way to fix it To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/boot-managed-by-snapd/+bug/2157702/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
