10665 2016-11-15 12:47:12 +0000 swupd + tar extraction errors + IMA 2016-12-08 17:40:01 +0000 1 1 7 Build System, Metadata & Runtime Other YP Layers meta-swupd unspecified x86 Multiple RESOLVED FIXED Medium normal 2.3 M1 1 patrick.ohly patrick.ohly richard.purdie --- --- No (bug/feature does not impact docs) oldest_to_newest 68322 0 patrick.ohly 2016-11-15 12:47:12 +0000 When IMA is active, unpacking file or pack-from tar archives fails when the content include files where security.ima is set to a hash. That's because Linux kernel commit c68ed80 "ima: limit file hash setting by user to fix and log modes" prevents that based on the assumption that it isn't necessary. That assumption is wrong (see [Linux-ima-user] copying files with security.ima xattr). In the swupd/bsdtar case, bsdtar doesn't know that setting the security.ima xattr is redundant. In fact, it is useful - probably faster than local hashing. Older swupd-client ignored tar errors, 3.6.0 doesn't. Unpacking pack-from archives in download_pack() just fails (no errors) and the probably falls back to downloading individual files (untested). Unpacking individual files in untar_full_download() claims to ignore errors, but the error isn't cleared and therefore errors are still fatal. Several changes should be done: - fix untar_full_download() to behave as intended - revert the problematic c68ed80, which then will also make pack-from archives work 68644 1 patrick.ohly 2016-11-28 19:26:36 +0000 Kernel patch is getting reverted upstream and meta-integrity has a pending patch which also reverts it in older kernels. The swupd team decided to keep tar errors as fatal, but that's fine once the kernel patch is reverted. 68956 2 patrick.ohly 2016-12-08 17:40:01 +0000 Resolved in meta-intel-iot-security baac71e.