Re: [pve-devel] trousers error in latest test repo?

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

On 06.10.21 00:51, Victor Hooi wrote:
> Hi,
> 
> I just installed a new box (Intel NUC7i5BNK) with Proxmox 7.0-2, and then
> ran an apt update/dist-upgrade, using the PVE test repos:
> 
> There seems to be some error whilst upgrading some "trousers" module:
> 
> Setting up trousers (0.3.14+fixed1-1.2) ...
>> Job for trousers.service failed because the control process exited with
>> error code.
>> See "systemctl status trousers.service" and "journalctl -xe" for details.
>> invoke-rc.d: initscript trousers, action "start" failed.
>> ● trousers.service - LSB: starts tcsd
>>      Loaded: loaded (/etc/init.d/trousers; generated)
>>      Active: failed (Result: exit-code) since Tue 2021-10-05 15:43:15 PDT;
>> 4ms ago
>>        Docs: man:systemd-sysv-generator(8)
>>     Process: 32424 ExecStart=/etc/init.d/trousers start (code=exited,
>> status=30)
>>         CPU: 10ms
> 
> 
> Oct 05 15:43:15 mgmt1 systemd[1]: Starting LSB: starts tcsd...
>> Oct 05 15:43:15 mgmt1 trousers[32424]: Starting Trusted Computing daemon:
>> tcsd/etc/init.d/trousers: 32: [: /dev/tpm0: unexpected operator
>> Oct 05 15:43:15 mgmt1 TCSD[32429]: TrouSerS resetting mode of /var/lib/tpm
>> from 40755 to: 700
>> Oct 05 15:43:15 mgmt1 tcsd[32429]: TCSD TDDL[32429]: TrouSerS ioctl: (25)
>> Inappropriate ioctl for device
>> Oct 05 15:43:15 mgmt1 tcsd[32429]: TCSD TDDL[32429]: TrouSerS Falling back
>> to Read/Write device support.
>> Oct 05 15:43:15 mgmt1 tcsd[32429]: TCSD TCS[32429]: TrouSerS ERROR: TCS
>> GetCapability failed with result = 0x1e
>> Oct 05 15:43:15 mgmt1 trousers[32430]:  failed!
>> Oct 05 15:43:15 mgmt1 systemd[1]: trousers.service: Control process
>> exited, code=exited, status=30/n/a
>> Oct 05 15:43:15 mgmt1 systemd[1]: trousers.service: Failed with result
>> 'exit-code'.
>> Oct 05 15:43:15 mgmt1 systemd[1]: Failed to start LSB: starts tcsd.
>> dpkg: error processing package trousers (--configure):
>>  installed trousers package post-installation script subprocess returned
>> error exit status 1
> 
> 
> However, this also then causes issues when attempting to finalise other
> packages as well:
> 
> dpkg: dependency problems prevent configuration of swtpm-tools:
>>  swtpm-tools depends on trousers (>= 0.3.9); however:
>>   Package trousers is not configured yet.
> 
> 
> dpkg: error processing package swtpm-tools (--configure):
>>  dependency problems - leaving unconfigured
>> Setting up swtpm (0.6.99+1) ...
>> Setting up pve-firewall (4.2-3) ...
>> Setting up libzpool5linux (2.1.1-pve1) ...
>> Setting up gnutls-bin (3.7.1-5) ...
>> Setting up corosync (3.1.5-pve1) ...
>> dpkg: dependency problems prevent configuration of qemu-server:
>>  qemu-server depends on swtpm-tools; however:
>>   Package swtpm-tools is not configured yet.
> 
> 
> dpkg: error processing package qemu-server (--configure):
>>  dependency problems - leaving unconfigured
>> Setting up zfsutils-linux (2.1.1-pve1) ...
>> Installing new version of config file /etc/zfs/zfs-functions ...
>> Setting up zfs-initramfs (2.1.1-pve1) ...
>> dpkg: dependency problems prevent configuration of pve-manager:
>>  pve-manager depends on qemu-server (>= 6.2-17); however:
>>   Package qemu-server is not configured yet.
> 
> 
> dpkg: error processing package pve-manager (--configure):
>>  dependency problems - leaving unconfigured
>> Setting up zfs-zed (2.1.1-pve1) ...
>> Installing new version of config file /etc/zfs/zed.d/zed-functions.sh ...
>> dpkg: dependency problems prevent processing triggers for pve-ha-manager:
>>  pve-ha-manager depends on qemu-server (>= 6.0-15); however:
>>   Package qemu-server is not configured yet.
> 
> 
> dpkg: error processing package pve-ha-manager (--configure):
>>  dependency problems - leaving triggers unprocessed
>> Processing triggers for initramfs-tools (0.140) ...
>> update-initramfs: Generating /boot/initrd.img-5.11.22-5-pve
>> Running hook script 'zz-proxmox-boot'..
>> Re-executing '/etc/kernel/postinst.d/zz-proxmox-boot' in new private mount
>> namespace..
>> Copying and configuring kernels on /dev/disk/by-uuid/5994-C1A0
>> Copying kernel and creating boot-entry for 5.11.22-4-pve
>> Copying kernel and creating boot-entry for 5.11.22-5-pve
>> Processing triggers for libc-bin (2.31-13) ...
>> Processing triggers for man-db (2.9.4-2) ...
>> Processing triggers for mailcap (3.69) ...
>> Errors were encountered while processing:
>>  trousers
>>  swtpm-tools
>>  qemu-server
>>  pve-manager
>>  pve-ha-manager
>> E: Sub-process /usr/bin/dpkg returned an error code (1)
> 
> 
> Does anybody know what this is?

It's related to TPM, swtmp-tools pulls it in and that in turn gets pulled in by
qemu-server which now provides TPM support for guests.

It seems it init script was a bit borked[0], but that only shows up on some systems,
FWICT ones that where updated from pre PVE 6 or even older.

I re-build the upstream package with a more resilient postinst and init script and
uploaded that to pvetest as `trousers` in version `0.3.14+fixed1-1.2+pve1` (fwiw,
the "fixed" part in the version was already there and not my invention ;)

An error may still get printed on update, but it should not fail the whole update
itself anymore (which has no use on its own).

[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895201

hope that helps,
Thomas