[8.19] (backport #6907) Enhancement/6394 allow deb rpm to upgrade with endpoint tamper protection

[mergify]

• Enhancement

What does this PR do?

Updates the preinstall script for deb and rpm to stop the endpoint security service and remove the vault

Why is it important?

Currently when users upgrade their deb or rpm agents using their respective package managers, if there is endpoint running and if endpoint has tamper protection enabled, endpoint will become unhealthy. This PR fixes it by replicating what enpoint-security uninstall --uninstall-token <token> does in the deb/rpm preinstall script.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test

Disruptive User Impact

There shouldn't be anything disruptive for the users.

How to test this PR locally

• Start endpoint compatible VMs, one for deb one for rpm
• Build the agent for these two platforms
• Create an ESS deployment
• Create a policy, add endpoint integration
• Follow the "Add Agent" instructions and install the version that is shown on the instructions.
• Validate that both the agent and endpoint are healthy
• Upgrade the agent running either sudo apt install <Agent that you built> or sudo dnf install <Agent that you built>
• After the upgrade is done, validate that both the agent and the endpoint are healthy
• Just to be sure, validate that the new endpoint is still tamper protected
  • Try to uninstall agent without a token and see it fail
  • Try to uninstall agent with an uninstall token and validate that it is uninstalled
  • Beware that removing the agent using the package managers will indeed uninstall the agent but will leave endpoint. Use the elastic-agent command to uninstall.

Repeat the steps above but test same version upgrades.

• Install the agent you packaged from the branch.
• Enroll into fleet
• Install the same agent again with dpkg -i or rpm -Uvh --force
• Check the status of the agent and endpoint
• Validate that tamper protection is enabled

Note: When testing you may run into the following error

┌─ fleet
│  └─ status: (STARTING)
└─ elastic-agent
   ├─ status: (DEGRADED) 1 or more components/units in a failed state
   └─ endpoint-default
      ├─ status: (FAILED) Elastic Defend cannot run on an emulated architecture
      ├─ endpoint-default
      │  └─ status: (FAILED) Elastic Defend cannot run on an emulated architecture
      └─ endpoint-default-b73c5b0f-3b0a-4877-a531-35fdd9f9204f
         └─ status: (FAILED) Elastic Defend cannot run on an emulated architecture

This is related to the following bug #6866

Related issues

• Closes Allow DEB and RPM packages to supply an uninstall token when upgrading with Elastic Defend installed #6394
• Relates fix install prevention on Linux #6866

  ---

  This is an automatic backport of pull request Enhancement/6394 allow deb rpm to upgrade with endpoint tamper protection #6907 done by Mergify.

[mergify]

Cherry-pick of 8a6531f has failed:

On branch mergify/bp/8.19/pr-6907
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 8a6531f43.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1740166208-allow-deb-rpm-upgrade-with-tamper-protected-endpoint.yaml
	modified:   dev-tools/packaging/templates/linux/postinstall.sh.tmpl
	modified:   pkg/testing/fixture.go
	modified:   pkg/testing/fixture_install.go
	modified:   pkg/testing/tools/tools.go
	modified:   testing/integration/endpoint_security_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   dev-tools/packaging/templates/linux/preinstall.sh.tmpl

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: c7faf6d

Failed CI Steps

• x86_64:sudo: deb
• x86_64:sudo: deb
• x86_64:sudo: deb
• x86_64:sudo: deb
• x86_64:sudo:rpm
• x86_64:sudo:rpm

History

cc @kaanyalti

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[mergify]

This pull request has not been merged yet. Could you please review and merge it @kaanyalti? 🙏

[pkoutsovasilis]

let's not merge this one until #8613 is resolved. For main and 9.0 where this is merged, we are gonna have to skip it for now #8626

[pkoutsovasilis]

closing in favour of #8646