Repository: freedomofpress/securedrop

Issue:
fwupd error in syslog, ossec alert for Focal
## Description

On both a Mac mini and a NUC5PYH running Ubuntu Focal, I receive the following ossec alerts (and associated syslog entries)

1. On the mac mini, 2 errors
```
OSSEC HIDS Notification.
2021 Mar 01 13:22:55

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar  1 13:22:53 app fwupd[133921]: 13:22:53:0576 FuEngine             Failed to load SMBIOS: invalid DMI data size, got 2527 bytes, expected 2745



 --END OF NOTIFICATION



OSSEC HIDS Notification.
2021 Mar 01 13:22:55

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar  1 13:22:53 app fwupd[133921]: 13:22:53:0883 FuPluginUefi         Error opening directory â€œ/sys/firmware/efi/esrt/entriesâ€: No such file or directory



 --END OF NOTIFICATION

```

2. On the NUC, only 1 of the two errors
```

OSSEC HIDS Notification.
2021 Mar 01 11:51:47

Received From: mon->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar  1 11:51:46 mon fwupd[133502]: 11:51:46:0509 FuPluginUefi         Error opening directory â€œ/sys/firmware/efi/esrt/entriesâ€: No such file or directory



 --END OF NOTIFICATION
```

## Comments

The errors observed are likely a result of my machines either not supported by fwupd or perhaps legacy boot enabled. We should ensure fwupd is properly configured or supported on the hosts on which it is running, or remove the package entirely.


Discussion:
reproducible on nuc7:
```

Received From: mon->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Mar  4 14:03:02 mon fwupd[134631]: 14:03:02:0629 FuPluginUefi         Error opening directory â€œ/sys/firmware/efi/esrt/entriesâ€: No such file or directory

```
Seeing this in my prod logs as well on Ubuntu 20.04 (haven't checked OSSEC alerts yet). 

Resolving patch:
diff --git a/install_files/ansible-base/roles/backup/files/backup.py b/install_files/ansible-base/roles/backup/files/backup.py
--- a/install_files/ansible-base/roles/backup/files/backup.py
+++ b/install_files/ansible-base/roles/backup/files/backup.py
@@ -1,8 +1,11 @@
 #!/opt/venvs/securedrop-app-code/bin/python
 """
-This script is copied to the App server and run by the Ansible playbook. When
-run (as root), it collects all of the necessary information to backup the 0.3
-system and stores it in /tmp/sd-backup-0.3-TIME_STAMP.tar.gz.
+This script is copied to the App server (to /tmp) and run by the Ansible playbook,
+typically via `securedrop-admin`.
+
+The backup file in the format sd-backup-$TIMESTAMP.tar.gz is then copied to the
+Admin Workstation by the playbook, and removed on the server. For further
+information and limitations, see https://docs.securedrop.org/en/stable/backup_and_restore.html
 """
 
 from datetime import datetime
@@ -19,14 +22,17 @@ def main():
 
     sd_code = '/var/www/securedrop'
     sd_config = os.path.join(sd_code, "config.py")
-    sd_custom_logo = os.path.join(sd_code, "static/i/logo.png")
+    sd_custom_logo = os.path.join(sd_code, "static/i/custom_logo.png")
 
     tor_hidden_services = "/var/lib/tor/services"
     torrc = "/etc/tor/torrc"
 
     with tarfile.open(backup_filename, 'w:gz') as backup:
         backup.add(sd_config)
-        backup.add(sd_custom_logo)
+
+        # If no custom logo has been configured, the file will not exist
+        if os.path.exists(sd_custom_logo):
+            backup.add(sd_custom_logo)
         backup.add(sd_data)
         backup.add(tor_hidden_services)
         backup.add(torrc)
diff --git a/securedrop/version.py b/securedrop/version.py
--- a/securedrop/version.py
+++ b/securedrop/version.py
@@ -1 +1 @@
-__version__ = '1.8.0'
+__version__ = '1.8.1~rc1'
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -4,7 +4,7 @@
 
 setuptools.setup(
     name="securedrop-app-code",
-    version="1.8.0",
+    version="1.8.1~rc1",
     author="Freedom of the Press Foundation",
     author_email="securedrop@freedom.press",
     description="SecureDrop Server",


Test patch:
diff --git a/molecule/builder-xenial/tests/vars.yml b/molecule/builder-xenial/tests/vars.yml
--- a/molecule/builder-xenial/tests/vars.yml
+++ b/molecule/builder-xenial/tests/vars.yml
@@ -1,5 +1,5 @@
 ---
-securedrop_version: "1.8.0"
+securedrop_version: "1.8.1~rc1"
 ossec_version: "3.6.0"
 keyring_version: "0.1.4"
 config_version: "0.1.4"