Checks for u2mfn kernel module in metapackage

[conorsch]

Overview

The u2mfn kernel module is required for GUI operations in a VM. It should be built automatically via dkms, but that process can fail. We must report such errors up to the parent apt operation to notify users. The /etc/kernel/postinst.d/dkms hooks are run on installation of the linux-image-* packages, so we don't need an explicit call to dkms autoinstall (which fails silently) in the metapackage postinst.

Since we've observed VMs fail to build the u2mfn.ko dynamically in the past, let's try to recover in that situation, otherwise fail loudly.

Related issues:

• Closes Investigate DKMS autoinstall failure behavior #184
• Closes Latest kernel shows problems on some hardware securedrop-workstation#590

Test plan

Reproduce distorted GUI

In order to verify that changes here reliably resolve the garbled terminal problem, you'll need a candidate VM that exhibits the problem. That's easy enough to create:

# Clone an up-to-date SDW TemplateVM, so tests happen in an isolated VM
qvm-clone securedrop-workstation-buster sdw-kernel-test

# Open a terminal for the subsequent commands. Note that the terminal
# works, i.e. is not garbled!
qvm-run sdw-kernel-test gnome-terminal

In the domU terminal:

uname -r # should show '4.14.186-grsec-workstation'
sudo rm -v /usr/lib/modules/$(uname -r)/updates/dkms/u2mfn.ko

Now reboot the VM, and re-run qvm-run sdw-kernel-test gnome-terminal. The graphical window should be garbled, as shown in freedomofpress/securedrop-workstation#590 . If it's not, stop testing here!

Confirm resolution via new metapackage

Now we'll attempt to resolve the broken GUI via the new metapackage. Check out the new metapackage build logic locally from this branch, and run in your dev VM (e.g. sd-dev):

# Build the new package
PKG_VERSION=4.14.186+buster2 make securedrop-workstation-grsec
# Copy the new package to your test VM 'sdw-kernel-test'
# You may need to adjust tags or RPC policies in dom0 to allow this,
# e.g. 'qvm-tags sdw-kernel-test del sd-workstation' in dom0
qvm-copy /home/user/debbuild/packaging/securedrop-workstation-grsec_4.14.186+buster2_amd64.deb

Since the graphical terminal is unusable, we'll install the package via cli from dom0:

qvm-run -p sdw-kernel-test 'sudo dpkg -i ./QubesIncoming/sd-dev/securedrop-workstation-grsec_4.14.186+buster2_amd64.deb'
echo $? # should show '0'

You should see dkms output referencing the build. That's good! Reboot the VM again, and re-run gnome-terminal. The graphical display should work correctly. Finally, as a sanity check, run the following in sdw-kernel-test:

uname -r # should show '4.14.186-grsec-workstation', as before
aptitude show securedrop-workstation-grsec | grep Version # should show '4.14.186+buster2' is installed
sudo ls -1 /usr/lib/modules/$(uname -r)/updates/dkms/u2mfn.ko # should display the fullpath to the module

That's it. If all that works, we should be in a good position to proceed with building the metapackage and placing on apt-test.

[eloquence]

Reproducing garbled display

Open a terminal for the subsequent commands. Note that the terminal
works, i.e. is not garbled!

Confirmed.

Now reboot the VM, and re-run qvm-run sdw-kernel-test gnome-terminal. The graphical window should be garbled, as shown in freedomofpress/securedrop-workstation#590

Confirmed:

[conorsch]

@eloquence Excellent! Thanks for confirming. I've added the rest of the test plan, so I'm going to mark this and related PRs as "Ready for review."

[eloquence]

Confirm resolution via new metapackage

You should see dkms output referencing the build.

Confirmed. Output: https://gist.github.com/eloquence/9132c4fb69e5c828c72d13bb10469526

The graphical display should work correctly

Confirmed.

should show '4.14.186-grsec-workstation', as before
should show '4.14.186+buster2' is installed
should display the fullpath to the module

Confirmed. :)

[conorsch]

Thanks for sharing the full gist with the installation output. That looks how I'd expect. Will ping at standup tomorrow to see if more folks want to chime in on review, but I'm satisfied with moving forward with a posting a package on apt-test.

[rmol]

Looks good to me. Ran through the test plan, everything was as described.