14.04 trousers version 0.3.11.2-1 fails to start with TPM device

[Ryan Savino]

[Impact]

This leaves the trousers package in a half-config state, preventing deployment of TPM.

# DPKG output
...
iF trousers 0.3.11.2-1 amd64 open-source TCG Software Stack (daemon)
...

# APT output
...
Setting up trousers (0.3.11.2-1) ...
 * Starting Trusted Computing daemon tcsd [fail]
invoke-rc.d: initscript trousers, action "start" failed.
dpkg: error processing package trousers (--configure):
 subprocess installed post-installation script returned error exit status 137
Processing triggers for ureadahead (0.100.0-16) ...
Errors were encountered while processing:
 trousers
E: Sub-process /usr/bin/dpkg returned an error code (1)

# /var/log/apt/history.log
Start-Date: 2016-06-08 12:30:12
Commandline: apt-get install opencryptoki trousers
Install: trousers:amd64 (0.3.11.2-1)
Error: Sub-process /usr/bin/dpkg returned an error code (1)
End-Date: 2016-06-08 12:30:12

# /var/log/syslog
Jun 8 12:30:12 <HOSTNAME> TCSD TDDL[14101]: TrouSerS ERROR: Could not find a device to open!

[Test Case]

Installing trousers (<= 0.3.11.2-1) package on Trusty (14.04 LTS) using TPM device (Trusted Platform Module)

# Check for TPM device
$ ls /dev/tpm?

# Install trousers
$ sudo apt-get install trouser

[Regression Potential]

None expected.
The postinst script is already in Wily/Xenial and in the upstream debian package.

# Xenial changelog :

trousers (0.3.13-1) unstable; urgency=medium
...
* Try to workaround systemd/udev names when reloading rules (Closes: #739485)
...

# Debian bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739485

[Original Description]

Ubuntu Version:
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu 14.04.2 LTS"
NAME="Ubuntu"
VERSION="14.04.2 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.2 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"

the standard apt repositories are downloading an old broken version of trousers: 0.3.11.2-1

during trousers installation, the service fails to start:
apt-get install trousers
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  trousers
0 upgraded, 1 newly installed, 0 to remove and 125 not upgraded.
Need to get 0 B/137 kB of archives.
After this operation, 412 kB of additional disk space will be used.
Selecting previously unselected package trousers.
(Reading database ... 74822 files and directories currently installed.)
Preparing to unpack .../trousers_0.3.11.2-1_amd64.deb ...
Unpacking trousers (0.3.11.2-1) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Processing triggers for ureadahead (0.100.0-16) ...
Setting up trousers (0.3.11.2-1) ...
 * Starting Trusted Computing daemon tcsd [fail]
invoke-rc.d: initscript trousers, action "start" failed.
dpkg: error processing package trousers (--configure):
 subprocess installed post-installation script returned error exit status 137
Processing triggers for ureadahead (0.100.0-16) ...
Errors were encountered while processing:
 trousers
E: Sub-process /usr/bin/dpkg returned an error code (1)

can the apt repositories for 14.04.2 LTS be updated to include the latest version of trousers 0.3.13-3? this issue does not exist if i install the package manually.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Edmund Rhudy (erhudy)]

I had this problem and hacked around this grunchiness by unpacking the package, rewriting the postinst script, and then configuring it:

https://github.com/bloomberg/chef-bcpc/blob/master/cookbooks/bcpc/recipes/tpm.rb#L40-L50

[Eric Desrochers (slashd)]

I'm currently investigation this bug...

Debian bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739485

Eric

[Eric Desrochers (slashd)]

Could you please try this hotfix package of trousers. This will help determine if the patch fix the problem.

Instructions
---
$ sudo add-apt-repository ppa:slashd/lp1484740
$ sudo apt-get update
$ sudo apt-get install trousers=0.3.11.2-1ubuntu1+hf20160806lp1484740 -y
---

Eric

[Eric Desrochers (slashd)]

Explanation :

The bug is found in debian/trouser.postinst at line :19[1].
It tries to perform a "pidof udevd" on a machine where it is "systemd-udevd".

Because "pidof udevd" return nothing, than the if statement fails.

As mentioned, above by Edmond, changing the from "pidof udevd" to "pidof systemd-udevd" works... but I think the best approach is what is found on Wily/Xenial and Debian upstream which is to use "udevadm --version"[2] instead.

[1] # ask udev to check for new udev rules (and fix device permissions)
==> if [ -x /etc/init.d/udev ] && pidof udevd > /dev/null; then
        udevadm control --reload-rules
        udevadm trigger --sysname-match="tpm[0-9]*"
fi
;;

[2] # ask udev to check for new udev rules (and fix device permissions)
==> if [ -e /dev/tpm0 ] && udevadm --version > /dev/null; then
            udevadm control --reload-rules ||:
            udevadm trigger --sysname-match="tpm[0-9]*" ||:
    fi
    ;;

Eric

[Eric Desrochers (slashd)]

Additionally, to continue my previous comment

The new if statement is also looking for the existence of /dev/tmp* device then do the "udevadm --version command" prior to perform an udevadm task, so this condition will only succeed if TPM device and udevadm is found on the system.

[Evan Hoffman (ehoffman24)]

Tested the hotfix package and trousers installed cleanly for me on 14.04.3.

[Eric Desrochers (slashd)]

Here's a positive feedback for my hotfix package ....

It has been brought to my attention :

---
That appears to have done the trick. trousers installed cleanly with this package and opencryptoki & tpm-tools installed normally from our local mirror after that.

# APT output :
Selecting previously unselected package trousers.
(Reading database ... 132632 files and directories currently installed.)
Preparing to unpack trousers_0.3.11.2-1ubuntu1+hf20160806lp1484740_amd64.deb ...
Unpacking trousers (0.3.11.2-1ubuntu1+hf20160806lp1484740) ...
Setting up trousers (0.3.11.2-1ubuntu1+hf20160806lp1484740) ...
* Starting Trusted Computing daemon tcsd [ OK ]
Processing triggers for ureadahead (0.100.0-16) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
---

Eric

[Eric Desrochers (slashd)]

Patch: lp1484740_trusty.debdiff

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "lp1484740_trusty.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Brian Murray (brian-murray)]

Hello Ryan, or anyone else affected,

Accepted trousers into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/trousers/0.3.11.2-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Eric Desrochers (slashd)]

It has been brought to my attention that the package has been tested on an affected system and the test was successful.

Eric

[Robie Basak (racb)]

Unsubscribing ~ubuntu-sponsors as it looks like this has already been uploaded.

[Martin Pitt (pitti)]

The verification of the Stable Release Update for trousers has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package trousers - 0.3.11.2-1ubuntu1

---------------
trousers (0.3.11.2-1ubuntu1) trusty; urgency=medium

  * Try to workaround systemd/udev names when reloading rules (LP: #1484740)
    - debian/trousers.postinst (Closes: #739485)

 -- Eric Desrochers <email address hidden> Tue, 14 Jun 2016 16:22:35 +0300