Broken in Jammy until we can depend on swtpm-tools

Bug #1951975 reported by Christian Ehrhardt 
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Fix Released
Undecided
Christian Ehrhardt 

Bug Description

While fixing bug 1948880 this created a harder dependency on swtpm than intended.
We can't yet depend on swtpm-tools (waiting for the MIR in 1948748).
But due to that on a Jammy install without swtpm libvirt will end up not starting.

That is due to the user swtpm being missing without the package swtpm-tools.
And without that the service fails like:

$ systemctl status libvirtd
× libvirtd.service - Virtualization daemon
     Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
     Active: failed (Result: start-limit-hit) since Tue 2021-11-23 14:21:58 UTC; 21min ago
TriggeredBy: × libvirtd-ro.socket
             × libvirtd.socket
             × libvirtd-admin.socket
       Docs: man:libvirtd(8)
             https://libvirt.org
    Process: 25147 ExecStart=/usr/sbin/libvirtd $libvirtd_opts (code=exited, status=0/SUCCESS)
   Main PID: 25147 (code=exited, status=0/SUCCESS)
      Tasks: 2 (limit: 32768)
     Memory: 7.4M
        CPU: 319ms
     CGroup: /system.slice/libvirtd.service
             ├─24164 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             └─24165 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

Nov 23 14:21:58 testkvm-jammy-from libvirtd[25147]: Initialization of QEMU state driver failed: invalid argument: Failed to parse user 'swtpm'
Nov 23 14:21:58 testkvm-jammy-from libvirtd[25147]: Driver state initialization failed
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Deactivated successfully.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Unit process 24164 (dnsmasq) remains running after unit stopped.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Unit process 24165 (dnsmasq) remains running after unit stopped.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Start request repeated too quickly.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Failed with result 'start-limit-hit'.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Unit process 24164 (dnsmasq) remains running after unit stopped.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: libvirtd.service: Unit process 24165 (dnsmasq) remains running after unit stopped.
Nov 23 14:21:58 testkvm-jammy-from systemd[1]: Failed to start Virtualization daemon.

That breaks usage until swtpm-tools (or actually that user) is ready.
Then it would restart and/or install/upgrade fine.

The right solution options are:
- correctly express a Depends (not even a Recommends) as we depend on that user to be present
- create the user swtpm if not created by swtpm or anything else

The former would prevent removing swtpm for anyone that does not want to use it.

The latter would kind of mess with a user from two packages.
But the latter would have the benefit of not entangling the packages too hard and to have a chance to complete before the swtpm MIR is done (which can take a while).

The option of a changing default depending on swtpm to be around on install is even worse and not worth to consider further IMHO.

None seems perfect, I need to get a few opinions on this to avoid reverting/changing this a few more times.

Tags: server-next

Related branches

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

@vorlon - I subscribed you as you have worked on swtpm, would you be ok that I create the user in libvirt if it is missing? Are there better options I miss like moving the user to another package completely?

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Gladly this is broken "only" in -proposed which might explain why there have been no complains.
That is the one reason why it was good that so many entangled transitions have held it back.

Revision history for this message
Steve Langasek (vorlon) wrote : Re: [Bug 1951975] Re: Broken in Jammy until we can depend on swtpm-tools

On Tue, Nov 23, 2021 at 02:52:54PM -0000, Christian Ehrhardt  wrote:
> @vorlon - I subscribed you as you have worked on swtpm, would you be ok
> that I create the user in libvirt if it is missing? Are there better
> options I miss like moving the user to another package completely?

Having both packages create the user as needed is IMHO completely
reasonable.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thank you Steve, uploaded that to Jammy now to un-break the version in -proposed.

Changed in libvirt (Ubuntu):
status: New → Fix Committed
tags: added: server-next
Changed in libvirt (Ubuntu):
assignee: nobody → Christian Ehrhardt  (paelzer)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 7.6.0-0ubuntu3

---------------
libvirt (7.6.0-0ubuntu3) jammy; urgency=medium

  * d/libvirt-daemon-system.postinst: create user/group swtpm if not present
    due to swtpm-tools (LP: #1951975)

 -- Christian Ehrhardt <email address hidden> Wed, 24 Nov 2021 07:50:53 +0100

Changed in libvirt (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.