action #152455
closed[security][15-SP6] GRUB now passes through unlocking, test needs to be changed
100%
Description
This is not a test failure ticket, but a behavior change since we earlier learned 15-SP6 GRUB will obtain a feature to pass-through decryption the Linux kernel for the / partition. This request contained it: https://smelt.suse.de/request/313295/
So the test likely needs to behave differently on >= 15-SP6 where this new feature is implemented.
openQA test in scenario sle-15-SP6-Online-x86_64-create_hdd_gnome_encrypt_separate_boot@64bit fails in
boot_encrypt
Last good: 40.1 (or more recent)
Acceptance Criteria¶
- Change the test to now expect this new behavior on 15-SP6, and fail if the pass-through does not work
- Older SLE versions should behave as before
Further Information¶
This information I got from the developers:
Yes it should work for SP6 if the new grub version is accepted. By the way grub will only handle the key for the root partition being unlocked by bootloader (grub). It will not handle the key for swap and other partitions systemd may ask to unlock from the initrd or bootsplash. If those (separate) encrypted partition shares the same key with root partition, the /etc/crypttab has to be modifed with the same key location as root so that systemd can know where to look up the key file.
Updated by openqa_review 11 months ago
This is an autogenerated message for openQA integration by the openqa_review script:
This bug is still referenced in a failing openQA test: create_hdd_gnome_encrypt_separate_boot
https://openqa.suse.de/tests/13085400#step/boot_encrypt/1
To prevent further reminder comments one of the following options should be followed:
- The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
- The openQA job group is moved to "Released" or "EOL" (End-of-Life)
- The bugref in the openQA scenario is removed or replaced, e.g.
label:wontfix:boo1234
Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.
Updated by pstivanin 11 months ago
- Related to action #120459: [security] luks1_decrypt_ssh_server fails on tumbleweed; test-logic: unlock_via_ssh_server seems flawed added
Updated by pstivanin 11 months ago
- Status changed from In Progress to Resolved
- % Done changed from 0 to 100
- Estimated time changed from 24.00 h to 1.00 h
as discussed with Richard, we can remove those tests:
https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/18433
https://github.com/os-autoinst/opensuse-jobgroups/pull/412
https://gitlab.suse.de/qe-security/osd-sle15-security/-/merge_requests/205