The bats stub returned one exit code for every "chdef netboot=", and the
helper calls chdef twice: once to set the method to ipxe, and once to put
the saved method back. With the stub failing both, "a netboot method that
cannot be put back fails the case" passed on the FORWARD failure, so
removing restore_rc=1 from the restoring branch left all 18 tests green.
The test named a defect it could not detect.
The stub now counts its netboot calls and fails the one the test names,
so the forward chdef succeeds. The test asserts that forward call is in
the call log, and matches the message only the restoring branch prints.
Removing restore_rc=1 now fails test 8 and no other.
docs/source/advanced/ipxe/index.rst said both methods run the same boot
scripts, which stopped being true when the shim line became conditional
on the method. It now says what differs, and states that Secure Boot
reaches netboot=ipxe only: xnba.efi is unsigned, and grub2 nodes are out
of scope.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This PR adds a shim to the UEFI boot scripts of netboot=ipxe nodes, so a node
with Secure Boot on reaches its kernel.
The firmware signature database does not hold the keys of a Linux
distribution. A UEFI node with netboot=ipxe loads snponly-shim.efi and
snponly.efi, both signed, and then stops at the kernel with "Verification
failed: Security Policy Violation".
xCAT::SecureBoot::shim_url_path names a shim for one node. The shim of the
install source comes first, because its vendor certificate signs the kernel of
its own distribution. copycds keeps the names of the DVD, so the module tries
EFI/BOOT/BOOTX64.EFI, EFI/BOOT/bootx64.efi and EFI/boot/bootx64.efi: EL and
openEuler ship the first, openSUSE the second and Ubuntu the third. When no
install source carries a shim, the module names the shim of ipxe-xcat, which
verifies a kernel that a MOK key signs.
xnba.pm writes the shim line after imgload in the UEFI script of an ipxe node,
and mknb.pm writes it in the UEFI discovery scripts. iPXE fetches the shim only
when it cannot load the kernel itself, so a node with Secure Boot off reads no
shim. netboot=xnba is unchanged: no key signs xnba.efi.
The elilo and ESXi paths and the Genesis kernel stay unsigned, and the iPXE
documentation now says so. The validation matrix gets a row for a UEFI install,
a netboot image and discovery with Secure Boot on.
secureboot_ipxe_node_shim.t and secureboot_genesis_shim.t drive nodeset and
mknb into a scratch TFTP root. Four assertions of ten and two of seven fail
without this change.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
A new page describes the ipxe and xnba netboot methods: the files of the
upstream loader, UEFI Secure Boot through the shim and its limits, the
client test, the loader of nodes without a definition, the move of
nodes to the ipxe method and back, and the known limits of the upstream
loader.
The node guide, the noderes, node, group and nodeset pages list the ipxe
method, and the value lists mark xnba deprecated. The examples that
define an x86 node use netboot=ipxe. The mixed cluster and uninstall
guides name ipxe-xcat, and the DHCP validation matrix gets the iPXE
loader rows, Secure Boot included.
Daniel Hilst
Vinícius Ferrão