[Bug 1865515] Re: Chainbooting from grub over the network to local shim breaks chain of trust

[Lee Trager]

MAAS tries to do

(FW) -> shim(net) -> grub(net) -> shim(local) -> grub(local)

When grub(net) runs MAAS send it this[1] config which searches for the
local bootloader as we don't know where it is. It prefers chainloading
the shim but will fall back on grub if that isn't found.

The reason we chainload the local shim is because we need to support
secure boot for multiple operating systems. My understanding of the shim
is that it only stores the keys from the OS vendor that provides it, not
multiple vendors. MAAS officially supports Ubuntu, CentOS, RHEL,
Windows, and VMware. Users have gotten other operating systems to work
as well and there has been talk of adding SUSE support.

Secure boot must work for every operating system MAAS supports, not just
Ubuntu.

[1]
https://git.launchpad.net/maas/tree/src/provisioningserver/templates/uefi/config.local.amd64.template

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/1865515

Title:
  Chainbooting from grub over the network to local shim breaks chain of
  trust

Status in MAAS:
  Confirmed
Status in grub2 package in Ubuntu:
  Triaged
Status in shim-signed package in Ubuntu:
  Triaged
Status in grub2 source package in Focal:
  New
Status in shim-signed source package in Focal:
  New
Status in grub2 source package in Groovy:
  Triaged
Status in shim-signed source package in Groovy:
  Triaged

Bug description:
  MAAS (2.4.2 and 2.6.2) cannot deploy to a server with Secure Boot
  active. This appears to be a regression of bug #1711203; the symptoms
  are identical. Namely:

  1) The system can begin deployment fine.
  2) After deployment is complete except for the final reboot, the
     system will reboot.
  3) GRUB appears briefly on the screen.
  4) The system console briefly displays the message:
     Bootloader has not verified loaded image
     System is compromised.  halting.
  5) The node powers off.
  6) Eventually MAAS times out on the deployment and declares
     that it's failed.

  I've verified this on three MAAS servers and one node each (jehan, a
  Quanta QuantaGrid D52B-1U in 18T; capella, a Supermicro SYS-6028U-TR4+
  in 1SS, and brennan, an Intel NUC DC53427HYE on my home network).

  Two of the MAAS servers are running MAAS
  2.6.2-7841-ga10625be3-0ubuntu1~18.04.1; the third is on
  2.4.2-7034-g2f5deb8b8-0ubuntu1.

To manage notifications about this bug go to:
https://bugs.launchpad.net/maas/+bug/1865515/+subscriptions