package shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

Bug #1679617 reported by Lewis Du-Pont
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
shim-signed (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

Just didnt install

ProblemType: Package
DistroRelease: Ubuntu 16.10
Package: shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1
ProcVersionSignature: Ubuntu 4.8.0-45.48-generic 4.8.17
Uname: Linux 4.8.0-45-generic x86_64
ApportVersion: 2.20.3-0ubuntu8.2
Architecture: amd64
Date: Tue Apr 4 11:10:01 2017
ErrorMessage: subprocess installed post-installation script returned error exit status 1
InstallationDate: Installed on 2017-03-11 (24 days ago)
InstallationMedia: Ubuntu 16.10 "Yakkety Yak" - Release amd64 (20161012.2)
RelatedPackageVersions:
 dpkg 1.18.10ubuntu1
 apt 1.3.4
SourcePackage: shim-signed
Title: package shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Lewis Du-Pont (lisopix) wrote :
tags: removed: need-duplicate-check
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in shim-signed (Ubuntu):
status: New → Confirmed
Revision history for this message
Steve Langasek (vorlon) wrote :

The error in your log is:

Setting up shim-signed (1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1) ...
Installing for x86_64-efi platform.
Installation finished. No error reported.
Running in non-interactive mode, doing nothing.
dpkg: error processing package shim-signed (--configure):
 subprocess installed post-installation script returned error exit status 1

This indicates that the shim package detected dkms modules present on your system, and that you have SecureBoot enabled, and therefore SecureBoot must be administratively disabled in order for you to continue booting.

And the prompt failed to be displayed, which made it impossible to configure this for you.

However, this should already have been the policy in place prior to your upgrade, so I'm not sure why you were prompted again. Could you please send the output of the following commands:
$ cat /proc/sys/kernel/moksbstate_disabled
$ od -tx1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
$ od -tx1 /sys/firmware/efi/efivars/MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23

Changed in shim-signed (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Lewis Du-Pont (lisopix) wrote : Re: [Bug 1679617] Re: package shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1
Download full text (3.3 KiB)

lewis@IHM-00260:~$ cat /proc/sys/kernel/moksbstate_disabled
0

lewis@IHM-00260:~$ od -tx1
/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
0000000 06 00 00 00 01
0000005

lewis@IHM-00260:~$ od -tx1
/sys/firmware/efi/efivars/MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23
od:
/sys/firmware/efi/efivars/MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23:
No such file or directory
lewis@IHM-00260:~$

On Thu, Apr 6, 2017 at 12:38 AM, Steve Langasek <
<email address hidden>> wrote:

> The error in your log is:
>
> Setting up shim-signed (1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1) ...
> Installing for x86_64-efi platform.
> Installation finished. No error reported.
> Running in non-interactive mode, doing nothing.
> dpkg: error processing package shim-signed (--configure):
> subprocess installed post-installation script returned error exit status 1
>
> This indicates that the shim package detected dkms modules present on
> your system, and that you have SecureBoot enabled, and therefore
> SecureBoot must be administratively disabled in order for you to
> continue booting.
>
> And the prompt failed to be displayed, which made it impossible to
> configure this for you.
>
> However, this should already have been the policy in place prior to your
> upgrade, so I'm not sure why you were prompted again. Could you please send
> the output of the following commands:
> $ cat /proc/sys/kernel/moksbstate_disabled
> $ od -tx1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-
> aa0d-00e098032b8c
> $ od -tx1 /sys/firmware/efi/efivars/MokSBStateRT-605dab50-e046-
> 4300-abb6-3dd810dd8b23
>
> ** Changed in: shim-signed (Ubuntu)
> Status: Confirmed => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1679617
>
> Title:
> package shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1
> failed to install/upgrade: subprocess installed post-installation
> script returned error exit status 1
>
> Status in shim-signed package in Ubuntu:
> Incomplete
>
> Bug description:
> Just didnt install
>
> ProblemType: Package
> DistroRelease: Ubuntu 16.10
> Package: shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1
> ProcVersionSignature: Ubuntu 4.8.0-45.48-generic 4.8.17
> Uname: Linux 4.8.0-45-generic x86_64
> ApportVersion: 2.20.3-0ubuntu8.2
> Architecture: amd64
> Date: Tue Apr 4 11:10:01 2017
> ErrorMessage: subprocess installed post-installation script returned
> error exit status 1
> InstallationDate: Installed on 2017-03-11 (24 days ago)
> InstallationMedia: Ubuntu 16.10 "Yakkety Yak" - Release amd64
> (20161012.2)
> RelatedPackageVersions:
> dpkg 1.18.10ubuntu1
> apt 1.3.4
> SourcePackage: shim-signed
> Title: package shim-signed 1.27~16.10.1+0.9+1474479173.6c180c6-1ubuntu1
> failed to install/upgrade: subprocess installed post-installation script
> returned error exit status 1
> UpgradeStatus: No upgrade log present (probably fresh install)
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/shim-signed/+
> bug/1679617/+subscriptions
>

--...

Read more...

Revision history for this message
Steve Langasek (vorlon) wrote :

Thanks. This certainly shows that:
- your system has secureboot enabled
- signature enforcement was not disabled via MOK

I guess you have dkms modules present on your system, but these are non-functional currently, probably because of the same issue of not being shown the debconf prompt.

Which package frontend are you using to manage updates to your system?

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for shim-signed (Ubuntu) because there has been no activity for 60 days.]

Changed in shim-signed (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.