[Bug 1938635] [NEW] update-grub fails when having multiple encrypted zfs root datasets

[Ubuntu]

Public bug reported:

== Test Case ==
1. Have a multi-boot linux setup installed on zfs
2. Use external boot partition 
3. Use encryption (using diffent keys) for each zfs root dataset
4. Boot into one environment without loading key of other dataset
5. Run update-grub

In our case we have 2 root datasets. We're booted into /legion/work/root
/legion/personal/root
/legion/work/root

* Expected Result *
update-grub succeeds updating grub config file with (at least) currently booted environment in configuration file.

* Actual Result *
update-grub fails, effectively updating config file removing currently booted environment from grub config.

update-grub output:

$ sudo update-grub           
Sourcing file `/etc/default/grub'
Sourcing file `/etc/default/grub.d/init-select.cfg'
Generating grub configuration file ...
filesystem 'legion/personal/root' can not be mounted: Permission denied
Adding boot menu entry for UEFI Firmware Settings
done

* Workaround / Fix *
A nice fix would be to add flag to either ignore datasets without loaded key. As I'm not interested in having personal root dataset listed in grub I added a workaround in "/etc/grub.d/10_linux_zfs" modifying function "get_root_datasets()".

Original expression: zfs list -H -o name,canmount,mountpoint -t
filesystem | grep -E
'^'"${p}"'(\s|/[[:print:]]*\s)(on|noauto)\s'"${rel_pool_root}"'$' | awk
'{print $1}'

Modified expression: zfs list -H -o name,canmount,mountpoint,keystatus
-t filesystem | grep -E
'^'"${p}"'(\s|/[[:print:]]*\s)(on|noauto)\s'"${rel_pool_root}"'\savailable$'
| awk '{print $1}'

** Affects: grub2 (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/1938635

Title:
  update-grub fails when having multiple encrypted zfs root datasets

Status in grub2 package in Ubuntu:
  New

Bug description:
  == Test Case ==
  1. Have a multi-boot linux setup installed on zfs
  2. Use external boot partition 
  3. Use encryption (using diffent keys) for each zfs root dataset
  4. Boot into one environment without loading key of other dataset
  5. Run update-grub

  In our case we have 2 root datasets. We're booted into /legion/work/root
  /legion/personal/root
  /legion/work/root

  * Expected Result *
  update-grub succeeds updating grub config file with (at least) currently booted environment in configuration file.

  * Actual Result *
  update-grub fails, effectively updating config file removing currently booted environment from grub config.

  update-grub output:

  $ sudo update-grub           
  Sourcing file `/etc/default/grub'
  Sourcing file `/etc/default/grub.d/init-select.cfg'
  Generating grub configuration file ...
  filesystem 'legion/personal/root' can not be mounted: Permission denied
  Adding boot menu entry for UEFI Firmware Settings
  done

  * Workaround / Fix *
  A nice fix would be to add flag to either ignore datasets without loaded key. As I'm not interested in having personal root dataset listed in grub I added a workaround in "/etc/grub.d/10_linux_zfs" modifying function "get_root_datasets()".

  Original expression: zfs list -H -o name,canmount,mountpoint -t
  filesystem | grep -E
  '^'"${p}"'(\s|/[[:print:]]*\s)(on|noauto)\s'"${rel_pool_root}"'$' |
  awk '{print $1}'

  Modified expression: zfs list -H -o name,canmount,mountpoint,keystatus
  -t filesystem | grep -E
  '^'"${p}"'(\s|/[[:print:]]*\s)(on|noauto)\s'"${rel_pool_root}"'\savailable$'
  | awk '{print $1}'

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1938635/+subscriptions