SUSE Manager system provisioning failing with kernel/initrd not found in saltenv 'base'

This document (000021368) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Manager 4.3.11

Situation

When scheduling an auto-installation via WebUI -> Systems -> SYSTEMNAME -> Provisioning, the action fails with errors similar to the following in the event log:

file_|-mgr_copy_kernel_|-/boot/uyuni-reinstall-kernel_|-managed:
    changes: {
        }
    comment: Source file salt://bootloader/1/s15sp5_ks/linux not found in saltenv 'base'
....
....
....
file_|-mgr_copy_initrd_|-/boot/uyuni-reinstall-initrd_|-managed:
    changes: {
        }
    comment: Source file salt://bootloader/1/s15sp5_ks/initrd not found in saltenv 'base'

Resolution

To address this issue, there are two possible workarounds:

Downgrade python3-salt salt salt-api salt-bash-completion salt-master to the previous version 3006.0-150400.8.49.2
Copy files manually to /srv/susemanager/salt/bootloader/ , in other words, replace the existing links with the respective kernel and initrd files. An example bash script is available in the "Additional Information" section.

Cause

SUSE Manager 4.3.11 introduces salt-master version 3006.0-150400.8.54.1 which includes fixes for CVE-2024-22231 and CVE-2024-22232.
With these fixes included, it is not allowed to have symlinks inside "file_roots" which are point outside of the same file root, which is the situation when creating a new Distribution via SUSE Manager. For example:

lrwxrwxrwx 1 root root 51 Jan 17 16:39 /srv/susemanager/salt/bootloader/1/s15sp5_ks/initrd -> /install/sles15sp5-x86_64/boot/x86_64/loader/initrd
lrwxrwxrwx 1 root root 50 Jan 17 16:39 /srv/susemanager/salt/bootloader/1/s15sp5_ks/linux -> /install/sles15sp5-x86_64/boot/x86_64/loader/linux

Status

Reported to Engineering

Additional Information

The following script will replace links with files. It will copy the target file to linked-file.

#! /bin/bash

for I in $(find /srv/susemanager/salt/bootloader -type l) ; do
	if [ ! -e "$I" ] ; then
		echo "$I is broken link, skip"
	else
		ls -l "$I"
		FILE="$(ls -l "$I" | awk '{ print $NF }')"
		rm "$I" && cp -p "$FILE" "$I"
		ls -l "$I"
	fi
done

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.