secboot: UUID generator error instead of panic
The randutil.RandomKernelUUID() used to generate a panic on failure.
The process of consolidating common code used by Pebble and Snapd
(e.g. randutil) highlighted the fact that an error return, as relied on by
Pebble, is a more flexibie approach and allows application code to decide
the severity, instead of the library function.
- Make secboot unlock code to deal with an error that can now be returned
from the UUID generator.
- Add unit tests to cover the new error paths in the code.
Signed-off-by: Fred Lotter <email address hidden>
interfaces/builtin: fix custom-device default udev kernel rules (#12833)
* interfaces/builtin: fix custom-device default udev kernel rules
The KERNEL value in udev rules must be the basename of the device path.
For devices for which there is not a matching kernel value specified in
the custom-device `udev-tagging` section, a default udev kernel rule is
generated. Previously, https://github.com/snapcore/snapd/pull/12734
(and prior) generated these default rules by using the complete device
path relative to `/dev/`. However, for device paths which are in
subdirectories of `/dev/`, this means that the kernel values were not
basenames, which violates the udev spec.
This commit changes this behavior to instead generate udev kernel rules
using the basename of each specified device.
Since ambiguity would arise if multiple devices had the same basename,
this change introduces a check to ensure that all the specified devices
have unique basenames.
Additionally, this commit introduces a check to ensure that all
specified kernel values in the `udev-tagging` section are basenames.
It is still the case that each specified kernel value must match one of
the specified devices.
There are currently problems with `vet` where it is claimed that several
of the `[]string` variables in `validateUDevDevicesUniqueBasenames()`
are unused. These variables are used in a several ways, so further
investigation is required as to why this is the case.
Signed-off-by: Oliver Calder <email address hidden>
* prompting/storage: fixed missing variable assignment from append()
Signed-off-by: Oliver Calder <email address hidden>
* prompting/storage: fixed custom device duplicate basename error message
Signed-off-by: Oliver Calder <email address hidden>
* interfaces/builtin: fixed custom-device unit tests introduced by commas in filepaths PR
Signed-off-by: Oliver Calder <email address hidden>
* interfaces/builtin: adjusted custom-device comment for kernel not matching any devices
Signed-off-by: Oliver Calder <email address hidden>
* interfaces/builtin: fixed unit test for when custom-device kernel does not match any device
Signed-off-by: Oliver Calder <email address hidden>
* interfaces/builtin: moved custom-device unique basename check
This change moves the check for whether all specified devices have
unique basenames out of `validateUDevTaggingRule()` (which is called
once for each udev rule) into `BeforePrepareSlot()`, immediately after
the list of device paths is assembled and each path validated. Thus, it
is only called once, before any rule validation begins.
Signed-off-by: Oliver Calder <email address hidden>
---------
Signed-off-by: Oliver Calder <email address hidden>
