group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1939932@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package ubuntu-advantage-tools - 27.3~18.04.1

---------------
ubuntu-advantage-tools (27.3~18.04.1) bionic; urgency=medium

  * Backport new upstream release: (LP: #1942929) to bionic

ubuntu-advantage-tools (27.3~21.10.1) impish; urgency=medium

  * d/tools.postinst:
    - consider cloud to be "none" on any cloud-id error
    - purge old ua-messaging.timer/service files
    - keep ua-timer.timer disabled if ua-messaging.timer was disabled by
      the user
    - properly configure both ubuntu-advantage-timer and
      ubuntu-advantage-licence-check logs
  * d/tools.postrm:
    - remove ubuntu-advantage-timer and ubuntu-advantage-license-check logs
      during purge
  * systemd:
    - remove ua-messaging.timer/service
    - add new ua-timer.timer that runs every 6 hours
    - add new ua-license_check.timer that runs every 5 minutes only if
      activated by ua-license-check.path
  * New upstream release 27.3 (LP: #1942929)
    - ros:
      + add beta support to enable ros and ros-updates
      + add support for "required services" so that esm-infra and esm-apps
        get auto-enabled when enabling ros or ros-updates
      + add support for "dependent services" so that user gets prompted to
        disable ros/ros-updates if they disable esm-infra/esm-apps
    - fips:
      + allow fips on GCP bionic now that optimized kernel is ready
      + disallow enabling fips on focal on clouds until cloud-optimized focal
        fips-certified kernel is ready (LP: #1939449, LP: #1939932)
      + print warning about generic fips kernel if cloud-id fails
    - cloud:
      + rely only on cloud-id to determine cloud type (LP: #1940131)
      + catch errors when determining cloud type
        (LP: #1938207, LP: #1944676) (GH: #1541)
    - azure:
      + bump IMDS API version to support Azure published images
    - cli:
      + collect-logs command that creates a tar file with debug-relevant logs
        and status info (GH: #463)
      + clean locks on exceptions more thoroughly to avoid false "Operation in
        progress" status messages
      + retain past service state after detach
      + shows better error message when a port value in a proxy is invalid
    - non-unicode locale support:
      + remove unicode-only characters from help file
      + don't print unicode-only characters in ua fix if non-utf8 locale
        (GH: #1463)
    - logrotate:
      + add logrotate functionality for ubuntu-advantage-timer.log.
      + Fix root:root logrotate permissions.
    - ua-timer.timer:
      + introduce a single systemd timer to handle ua recurring jobs
      + timer runs every 2 hours to support most frequent timer job
      + recurring job intervals are configurable in uaclient.conf
      + individual jobs are disabled if their interval is set to 0
      - status job:
        + update ua status every 12 hours
      - messaging job:
        + update APT/MOTD ESM messaging every 6 hours
      - metering job:
        + disabled until infrastructure is ready
        + for attached machines only, periodically update contract server with
          status information for proper contract metering
    - ua-license-check.timer:
      + only runs on LTS GCP instances that are not attached
      + runs every 5 minutes to check if gcp instance has license required to
        auto-attach
    - logs:
      + fixes duplicate logging (GH: #553)
    - tests and support:
      + remove groovy integration tests
      + various improvements to integration tests

 -- Grant Orndorff <grant.orndorff@xxxxxxxxxxxxx>  Thu, 23 Sep 2021
16:41:57 -0400

** Changed in: ubuntu-advantage-tools (Ubuntu Xenial)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1939932

Title:
  Ubuntu PRO Focal on AWS and Azure should not install the generic FIPS
  kernel via ubuntu-fips metapackage

Status in ubuntu-advantage-tools package in Ubuntu:
  Fix Committed
Status in ubuntu-advantage-tools source package in Xenial:
  Fix Released
Status in ubuntu-advantage-tools source package in Bionic:
  Fix Released
Status in ubuntu-advantage-tools source package in Focal:
  Fix Released
Status in ubuntu-advantage-tools source package in Hirsute:
  Fix Released
Status in ubuntu-advantage-tools source package in Impish:
  Fix Released

Bug description:
  [Impact]

  This bug impacts users on AWS or Azure, trying to enable FIPS/FIPS
  updates on Focal images. Trying to install a non-cloud-optimized FIPS
  kernel may lead to unwanted behavior on those clouds, including
  inability to boot to the systems.

  Although Focal has a FIPS certified kernel, the AWS adapted kernel is
  not ready yet. There will be in the future a cloud-optimized version
  of the FIPS kernel, and then users will be able to install it.

  With the applied fix, UA will show a message saying that the kernel is
  not available instead of showing any error. If the user really wants
  to install FIPS, there is a feature override
  ("allow_default_fips_metapackage_on_focal_cloud") which will install
  the default kernel, but this is the user's choice, and not
  recommended.

  [Test Case]

  To verify that this issue is fixed by version 27.3, please run the
  following script:

  ------------------------------
  import os

  from pycloudlib.ec2.cloud import EC2

  api = EC2(
      tag="test-ec2",
      access_key_id=os.getenv("UACLIENT_BEHAVE_AWS_ACCESS_KEY_ID"),
      secret_access_key=os.getenv("UACLIENT_BEHAVE_AWS_SECRET_ACCESS_KEY")
  )

  image_id = "ami-0ae1f7f35ab8e62d5"  # Focal pro image
  private_key_path = "ec2-{}.pem".format("test-key")
  key_name = "test-key"

  if key_name in api.list_keys():
      api.delete_key(key_name)

  keypair = api.client.create_key_pair(KeyName=key_name)

  with open(private_key_path, "w") as stream:
      stream.write(keypair["KeyMaterial"])

  os.chmod(private_key_path, 0o600)

  api.use_key(private_key_path, private_key_path, key_name)
  vpc = api.get_or_create_vpc(name="test-ec2-pro")
  instance = api.launch(image_id, vpc=vpc)

  print("--- Creating base instance")
  print(instance.execute("lsb_release -a"))
  print(instance.execute("ua version"))
  print(instance.execute("sudo ua enable fips --assume-yes"))
  print("------------------")

  print("--- Updating ua package")
  print(instance.execute('sh -c \'echo "deb http://archive.ubuntu.com/ubuntu $(lsb_release -sc)-proposed main" | tee /etc/apt/sources.list.d/proposed.list\''))
  instance.execute("sh -c 'sudo apt-get update > /dev/null'")
  instance.execute("sh -c 'sudo apt-get install ubuntu-advantage-tools > /dev/null'")
  print(instance.execute("ua version"))
  print(instance.execute("sudo ua enable fips --assume-yes"))
  print("------------------")
  instance.delete()
  -------------------------------------------

  This script depends on pycloudlib, which can be found here:
  https://github.com/canonical/pycloudlib/tree/main/pycloudlib

  [Regression Potential]
  This change needs to make sure that we indeed prevent the installation of non-cloud-optimized kernels. If a corner case shows up, the user might end up with a wrong kernel. This is unlikely because we are using cloud-init tools, present in AWS and Azure, to detect the cloud instance and effective blocking the install. If this detection fails, it means cloud-init has some problem and then, on AWS or Azure, the instance will have more problems than this one.

  We need to make sure to keep track of the certification progress for
  the cloud adapted FIPS package, so we can enable it in the future,
  when it becomes available.

  [Original Description]
  For Ubuntu PRO on 20.04 (Focal) `ua enable fips` should only install a cloud-optimized ubuntu-aws-fips or ubuntu-azure-fips metapackage. Installing a non-cloud-optimized FIPS kernel on AWS and Azure could lead to inability to boot on certain instance types. Expectation is that Focal AWS and Azure images should disallow enabling either fips or fips-updates.

  Expected behavior on Ubuntu PRO AWS and Azure Focal:
  $ ua status | grep fips
  fips no — NIST-certified FIPS modules
  fips-updates no — Uncertified security updates to FIPS modules

  $ sudo ua enable fips-updates
  One moment, checking your subscription first
  This system will NOT be considered FIPS certified, but will include security
  and bug fixes to the FIPS packages.
  Are you sure? (y/N) y
  This subscription is not entitled to FIPS Updates.
  For more information see: https://ubuntu.com/advantage

  Actual behavior:
  $ ua status | grep fips
  fips yes disabled NIST-certified FIPS modules
  fips-updates yes disabled Uncertified security updates to FIPS modules

  $ sudo ua enable fips-updates
  One moment, checking your subscription first
  This system will NOT be considered FIPS certified, but will include security
  and bug fixes to the FIPS packages.
  Are you sure? (y/N) y
  Updating package lists
  Installing FIPS Updates packages
  FIPS Updates enabled
  A reboot is required to complete install

  # see ubuntu-fips generic get installed which potentially degrades AWS and Azure environments
  $ sudo grep install /var/log/ubuntu-advantage.log
  2021-08-13 22:19:07,344 - util.py:(506) [DEBUG]: Ran cmd: apt-get install --assume-yes -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" ubuntu-fips openssh-client openssh-client-hmac openssh-server openssh-server-hmac openssh-client openssh-client-hmac openssh-server openssh-server-hmac, rc: 0 stderr: b''

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1939932/+subscriptions