When IMA is active, unpacking file or pack-from tar archives fails when the content include files where security.ima is set to a hash. That's because Linux kernel commit c68ed80 "ima: limit file hash setting by user to fix and log modes" prevents that based on the assumption that it isn't necessary. That assumption is wrong (see [Linux-ima-user] copying files with security.ima xattr). In the swupd/bsdtar case, bsdtar doesn't know that setting the security.ima xattr is redundant. In fact, it is useful - probably faster than local hashing. Older swupd-client ignored tar errors, 3.6.0 doesn't. Unpacking pack-from archives in download_pack() just fails (no errors) and the probably falls back to downloading individual files (untested). Unpacking individual files in untar_full_download() claims to ignore errors, but the error isn't cleared and therefore errors are still fatal. Several changes should be done: - fix untar_full_download() to behave as intended - revert the problematic c68ed80, which then will also make pack-from archives work
Kernel patch is getting reverted upstream and meta-integrity has a pending patch which also reverts it in older kernels. The swupd team decided to keep tar errors as fatal, but that's fine once the kernel patch is reverted.
Resolved in meta-intel-iot-security baac71e.