Merge ~arbell/grub:lp1965983 into ~ubuntu-core-dev/grub/+git/ubuntu:ubuntu

[Adam Bell]

[Adam Bell (arbell)]

Hello!

I'll try to keep an eye out for any email notifications about this merge request (since this is a public repo), but I'll be leaving Canonical in a couple of days.
If I do not respond, please ping `@certs` in ~fips on MM -- that team will be able to help.

Once this patch is merged, please contact @kylerhornor on MM; this patch is a prerequisite to a couple of other FIPS patches (which he has) in his customer case SF#00328362.

Thank you!
Adam

[Mauricio Faria de Oliveira (mfo)]

Updated MR:
https://code.launchpad.net/~mfo/grub/+git/grub/+merge/429026

[Julian Andres Klode (juliank)]

Rejected in favor of mfo's merged one.

Unmerged commits

b466085... by Adam Bell on 2022-03-23

ZFS snapshots causing grub.cfg generation failure

In the situation where ZFS snapshots do not contain a .../etc
directory, the generation of /b/g/grub.cfg silently fails, providing no
"linux" kernel lines in the /b/g/grub.cfg file. This patch prevents this
type of failure from occurring. This issue is especially apparent on
systems running in FIPS mode with ZFS boot+root pools. (LP: #1965983)

diff --git a/debian/patches/grubcfg-zfs-snapshot-generation-failure.patch b/debian/patches/grubcfg-zfs-snapshot-generation-failure.patch
new file mode 100644
index 0000000..e21827e
--- /dev/null
+++ b/debian/patches/grubcfg-zfs-snapshot-generation-failure.patch
@@ -0,0 +1,40 @@
+From: Adam Bell <[e-mail]>
+Date: Thu, 10 Mar 2022 22:22:39 +0700
+Subject: ZFS snapshots causing grub.cfg generation failure
+
+In the situation where ZFS snapshots do not contain a .../etc
+directory, the generation of /b/g/grub.cfg silently fails, providing no
+"linux" kernel lines in the /b/g/grub.cfg file. This patch prevents this
+type of failure from occurring. This issue is especially apparent on
+systems running in FIPS mode with ZFS boot+root pools. (LP: #1965983)
+
+Signed-off-by: Adam Bell <[e-mail]>
+---
+ util/grub.d/10_linux_zfs.in | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/util/grub.d/10_linux_zfs.in b/util/grub.d/10_linux_zfs.in
+index cc4f6bd..8170b46 100755
+--- a/util/grub.d/10_linux_zfs.in
++++ b/util/grub.d/10_linux_zfs.in
+@@ -529,11 +529,15 @@ get_dataset_info() {
+ 
+     umount "${mntdir}" || true
+     # We needed to look in / for snapshots on root dataset, umount the snapshot for etc before zfs lazily unmount it
+-    case "${etc_dir}" in /.zfs/snapshot/*/etc)
+-        snapshot_path="$(findmnt -n -o TARGET -T "${etc_dir}")"
+-        umount "${snapshot_path}" || true
+-        ;;
+-    esac
++    # This process only needs to run if the snapshot contains an .../etc path,
++    #  otherwise the build process may silently fail and produce no kernel lines in grub.cfg
++    if [ -e "${etc_dir}" ]; then
++        case "${etc_dir}" in /.zfs/snapshot/*/etc)
++            snapshot_path="$(findmnt -n -o TARGET -T "${etc_dir}")"
++            umount "${snapshot_path}" || true
++            ;;
++        esac
++    fi
+ }
+ 
+ # Scan available boot options and returns in a formatted list
diff --git a/debian/patches/series b/debian/patches/series
index 7c2c2d4..6c6dc90 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -123,3 +123,4 @@ efi-implement-grub_efi_run_image.patch
 fat-fix-listing-the-root-directory.patch
 efivar-check-that-efivarfs-is-writeable.patch
 linuxefi-do-not-validate-kernels-twice.patch
+grubcfg-zfs-snapshot-generation-failure.patch