This fixes GCE shielded VM instances integrity monitoring failures on focal and later. Our images are built with an empty /boot/grub/grubenv file, however after the first boot `initrdless_boot_fallback_triggered` is set to 0. This change in `grubenv` results in integrity monitoring `lateBootReportEvent` error. It seems that the only thing that's checking for this `grubenv` variable is `grub-common.service`, and it is looking specifically for a `1` value: if grub-editenv /boot/grub/grubenv list | grep -q initrdless_boot_fallback_triggered=1; then echo "grub: GRUB_FORCE_PARTUUID set, initrdless boot paniced, fallback triggered."; fi Unsetting this variable instead of setting it to 0 would prevent issues with integrity monitoring.focal-iotg-bump
parent
fed7c9d481
commit
9eb9d89a60
Loading…
Reference in new issue