fwupd produces multiple alerts

[eloquence]

Example notification:

OSSEC HIDS Notification.
2021 Dec 20 19:06:01

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Dec 20 19:06:01 app fwupd[135559]: message repeated 2 times: [ 19:06:01:0220 GLib                 g_bytes_get_data: assertion 'bytes != NULL' failed]

We don't currently support fwupd and have previously silenced its alerts: #5882, #6107

[eloquence]

What's the correct long-term solution here - should/can we uninstall fwupd for now?

[conorsch]

Perhaps we can disable fwupd via systemd, via the postinst for securedrop-config. These messages are new, I only see them starting a few days ago.

[eloquence]

New alerts which can also be found in our test instance:

OSSEC HIDS Notification.
2022 Mar 30 12:04:23

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar 30 12:04:21 app fwupd[134379]: 12:04:21:0953 FuPluginTpm          failed to load eventlog: Failed to open file "/sys/kernel/security/tpm0/binary_bios_measurements": No such file or directory



 --END OF NOTIFICATION



OSSEC HIDS Notification.
2022 Mar 30 12:04:23

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar 30 12:04:22 app fwupd[134379]: 12:04:22:0151 FuEngine             failed to record HSI attributes: failed to get historical attr: json-glib version too old



 --END OF NOTIFICATION

I would suggest that we tackle this more systematically for 2.4.0 or soon after, to ensure the OSSEC signal/noise ratio doesn't drop too low.

[elfranne]

the binary_bios_measurements has been fixed upstream (v1.7.6):
fwupd/fwupd#4290

[legoktm]

When I run sudo fwupdmgr get-devices on a NUC10 or NUC11, I get:

WARNING: UEFI capsule updates not available or enabled in firmware setup
  See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information.

(it does list the internal Kingston SSD, so we can at least get updates for that)

After reading the linked wiki page, I spent a while digging through the BIOS settings and didn't see anything that obviously would enable UEFI capsule updates.

I think it would be better if we leave fwupd installed in case we do ever need to ask admins to install a firmware update via it, but we can disable the fwupd-refresh.timer that just downloads new metadata every day, sometimes triggering OSSEC alerts. If we did want people to use fwupd for whatever reason, they'd need to run fwupdmgr refresh manually.

Something like systemctl is-enabled fwupd-refresh.timer && systemctl disable fwupwd-refresh.timer should do it.

[eloquence]

That would be a nice change to get into 2.4.0 IMO, those OSSEC alerts have been catching a number of diligent admins by surprise.