vmware: kernel_lockdown breaks guestinfo fetching
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 974
- Forks
- 296
- Avg merge
- 6d 14h
- Merged PRs (30d)
- 9
Description
Operating System Version
RHCOS 4.6 nightly (likely recent FCOS too, haven't directly checked)
Ignition Version
2.6.0
Environment
VMware vSphere 7.0, with EFI and Secure Boot enabled.
Reproduction Steps
- Before booting a VM for the first boot, follow https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-898217D4-689D-4EB5-866C-888353FE241C.html
Actual Behavior
Enabling Secure Boot turns on kernel_lockdown, which in turn blocks the iopl call. Ignition performs that in order to get access to the I/O ports for hypervisor backdoor.
Symptoms are:
- fetch stages failing with
operation not permitted - kernel logging
Lockdown: iopl is restrictedon the console
Here below is a screenshot from the emergency console.
Ref:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure on RHCOS or FCOS with VMware vSphere 7.0, EFI, and Secure Boot enabled, then trace Ignition's VMware guestinfo fetch and its iopl use. Review the linked kernel_lockdown, Red Hat Bugzilla, and vmw_backdoor-rs references; done means guestinfo fetching succeeds without the operation-not-permitted failure under Secure Boot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100