Bugzilla – Bug 1159205
Wrong GRUB default entry when booting snapshot in our KIWI images
Last modified: 2023-05-11 06:48:45 UTC
With our KIWI images, when selecting an older snapshot in the GRUB menu ("Start bootloader from a read-only snapshot" -> any entry), then the first entry "Help on bootable snapshot #<num>" will be selected instead of the actual bootable entry. For regular users this will just be an inconvenience compared to systems installed with YaST, but on automated systems, e.g. when using health-checker to automatically select an older snapshot if the default kernel or initrd did not boot correctly, this will break the boot completely - the system will be stuck in the help text. On systems installed with YaST, https://github.com/yast/yast-bootloader/blob/53bed387ab933f635fa3c557716131643aa209a5/src/lib/bootloader/sections.rb#L48 will set the default entry by using the entry's name (e.g. "openSUSE MicroOS" or "openSUSE Leap 15.1"). KIWI would need a similar mechanism to get this working.
Digging deeper into the problem I'm meanwhile not convinced that this should be resolved in KIWI any more. GRUB already contains "grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch", which is supposed to solve exactly this problem: It it supposed to set the default entry to the next entry if the help text is shown. Unfortunately the menu entry title, originally introduced in "grub2-btrfs-05-grub2-mkconfig.patch", is later changed by "grub2-btrfs-help-on-snapper-rollback.patch" - and the code is doing a string comparison against the old string. The obvious fix would be to change use the new string in the GRUB patch, but maybe we could be using a better mechanism than string comparison? (Would setting a certain class or id for the menuentry work?)
*** Bug 1194574 has been marked as a duplicate of this bug. ***
Increasing severity as it blocks core functionality of SLE Micro/openSUSE MicroOS
Thank you Ignaz and Richard. I will have a look tomorrow and update asap. (Sorry but now is a bit late to work in my timezone).
Hi Ignaz and Richard Could you please verify test package in this project works for you or not ? https://build.opensuse.org/package/show/home:michael-chang:bsc:1159205/grub2 Thanks in advanced.
Hi Michael, I can confirm it works..now I just need to get my system running secureboot again ;)
(In reply to Richard Brown from comment #6) > Hi Michael, I can confirm it works..now I just need to get my system running > secureboot again ;) Hi Richard, Thank you! I will carry it out the submission to openSUSE and SLE maintenance update. Set needinfo to myself.
SUSE-RU-2022:0513-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1159205,1190395 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): grub2-2.04-150300.22.12.2 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 (src): grub2-2.04-150300.22.12.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): grub2-2.04-150300.22.12.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-RU-2022:0513-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1159205,1190395 CVE References: JIRA References: Sources used: openSUSE Leap 15.3 (src): grub2-2.04-150300.22.12.2
SUSE-SU-2022:2073-1: An update that solves 7 vulnerabilities and has 14 fixes is now available. Category: security (important) Bug References: 1071559,1159205,1179981,1189769,1189874,1191184,1191185,1191186,1191504,1191974,1192522,1192622,1193282,1193532,1195204,1197948,1198460,1198493,1198495,1198496,1198581 CVE References: CVE-2021-3695,CVE-2021-3696,CVE-2021-3697,CVE-2022-28733,CVE-2022-28734,CVE-2022-28735,CVE-2022-28736 JIRA References: Sources used: SUSE Linux Enterprise Micro 5.1 (src): grub2-2.04-150300.3.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Bulk-re-assigning to the new bootloader-maintainers@suse.de group.