Bug 10665

Summary: swupd + tar extraction errors + IMA
Product: [Build System, Metadata & Runtime] Other YP Layers Reporter: Patrick Ohly <patrick.ohly>
Component: meta-swupdAssignee: Patrick Ohly <patrick.ohly>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: richard.purdie
Version: unspecified   
Target Milestone: 2.3 M1   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Patrick Ohly 2016-11-15 12:47:12 UTC 
When IMA is active, unpacking file or pack-from tar archives fails when the content include files where security.ima is set to a hash. That's because Linux kernel commit c68ed80 "ima: limit file hash setting by user to fix and log
modes" prevents that based on the assumption that it isn't necessary.

That assumption is wrong (see [Linux-ima-user] copying files with security.ima xattr). In the swupd/bsdtar case, bsdtar doesn't know that setting the security.ima xattr is redundant. In fact, it is useful - probably faster than local hashing.

Older swupd-client ignored tar errors, 3.6.0 doesn't. Unpacking pack-from archives in download_pack() just fails (no errors) and the probably falls back to downloading individual files (untested).

Unpacking individual files in untar_full_download() claims to ignore errors, but the error isn't cleared and therefore errors are still fatal.

Several changes should be done:
- fix untar_full_download() to behave as intended
- revert the problematic c68ed80, which then will also make pack-from archives work
Comment 1 Patrick Ohly 2016-11-28 19:26:36 UTC 
Kernel patch is getting reverted upstream and meta-integrity has a pending patch which also reverts it in older kernels.

The swupd team decided to keep tar errors as fatal, but that's fine once the kernel patch is reverted.
Comment 2 Patrick Ohly 2016-12-08 17:40:01 UTC 
Resolved in meta-intel-iot-security baac71e.