[canary] installation failed with "cannot seal the encryption keys"

[Jean-Baptiste Lallement]

Mantic 20230817

For some reason installation in a VM failed with:

=====
2023-08-18 08:42:55,702 ERROR root:30 finish: subiquity/Install/install/curtin_install/finish_install: FAIL: cannot perform the following tasks:
- Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
2023-08-18 08:42:55,702 ERROR root:30 finish: subiquity/Install/install/curtin_install: FAIL: cannot perform the following tasks:
- Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
2023-08-18 08:42:55,702 DEBUG subiquity.common.errorreport:394 generating crash report
2023-08-18 08:42:55,714 INFO subiquity.common.errorreport:415 saving crash report 'install failed crashed with ClientError' to /var/crash/1692348175.702773333.install_fail.crash
2023-08-18 08:42:55,714 ERROR root:30 finish: subiquity/Install/install: FAIL: cannot perform the following tasks:
- Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
2023-08-18 08:42:55,715 INFO root:30 start: subiquity/ErrorReporter/1692348175.702773333.install_fail/add_info:
2023-08-18 08:42:55,715 ERROR subiquity.server.server:414 top level error
Traceback (most recent call last):
  File "/snap/ubuntu-desktop-installer/1197/bin/subiquity/subiquity/server/controllers/shutdown.py", line 74, in _wait_install
    await self.app.controllers.Install.install_task
aiohttp.client_exceptions.ClientError: cannot perform the following tasks:
- Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
2023-08-18 08:42:55,717 ERROR subiquity.server.server:414 top level error
Traceback (most recent call last):
  File "/snap/ubuntu-desktop-installer/1197/bin/subiquity/subiquity/server/controllers/shutdown.py", line 74, in _wait_install
    await self.app.controllers.Install.install_task
aiohttp.client_exceptions.ClientError: cannot perform the following tasks:
- Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
=====

The error should be exposed to the user instead of crashing. There error is not displayed in the console of the installer either.

About the error itself, I've no clue what it means, since it's an installation from a fresh VM, straight to the live session.

[James Paton-Smith (jamesps)]

I had the same error on a Dell laptop (Latitude 7420)

"cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between"

I'm not sure what to make of this error.

[James Paton-Smith (jamesps)]

Tested again on a VM and managed to get it working. As far as I can tell, the only thing I changed was the EFI boot order.

I simply made sure that CD/DVD was the first boot option and made sure to shutdown the VM before booting into the ISO image.

So potentially, having other boot options before the CD/DVD option, even if they don't succeed (e.g disk is unformatted), could be causing the issue.

[Paddy Landau (paddy-landau)]

@jamesps — Which VM did you use? I used VirtualBox (version 7.0), and I had also changed the EFI boot order before booting: DVD first, hard disk second, with no other drives attached.

[Henry Coggill (hcoggillhome)]

I encountered this issue whilst using a QEMU VM, as per the instructions for booting Ubuntu Core 22 with TPM: https://ubuntu.com/core/docs/testing-with-qemu

The boot process did take me to the EFI shell, from which I exited, and selected the Mantic DVD (ISO) as the boot device.

[James Paton-Smith (jamesps)]

@paddy-landau - I was using QEMU VM and virt-manager. As far as I can tell, that was the only difference between my tests.

I also deleted, then recreated the TPM device on the VM, but that was to make sure there was nothing stored from the previous attempt.

[Chris Coulson (chrisccoulson)]

This should be fixed when:

- https://github.com/snapcore/secboot/pull/249 has landed, and snapd is using it.
- https://docs.google.com/document/d/1s-XJ56Ur6mQdJ3gVtWdJs12odgknM_2nqQ72RzWUDho/edit is implemented

[Balázs Börcsök (minefserver)]

I am pretty sure that this is connected to https://bugs.launchpad.net/ubuntu/+source/subiquity/+bug/2049999

In my case I think it is about TPM PCR bank capabilities (SHA-512 VS SHA-1).

It is an other question whether this is handled gracefully or checked against.

I see no problem allowing SHA-1 banks to be used as long as the user is notified about possible security risks. Also, for disk encryption, maybe add a PIN as well, systemd-cryptenroll supports it.

I think this is a developer oversight.