group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1571691@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package linux - 3.19.0-65.73

---------------
linux (3.19.0-65.73) vivid; urgency=low

  [ Ben Romer ]

  * Release Tracking Bug
    - LP: #1596631

  [ Josh Boyer ]

  * SAUCE: UEFI: acpi: Ignore acpi_rsdp kernel parameter when module
    loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
    - LP: #1566221
  * SAUCE: UEFI MODSIGN: Import certificates from UEFI Secure Boot
    - LP: #1571691
  * SAUCE: UEFI: efi: Disable secure boot if shim is in insecure mode
    - LP: #1571691

  [ Matthew Garrett ]

  * SAUCE: UEFI: Add secure_modules() call
    - LP: #1566221
  * SAUCE: UEFI: PCI: Lock down BAR access when module security is enabled
    - LP: #1566221
  * SAUCE: UEFI: x86: Lock down IO port access when module security is
    enabled
    - LP: #1566221
  * SAUCE: UEFI: ACPI: Limit access to custom_method
    - LP: #1566221
  * SAUCE: UEFI: asus-wmi: Restrict debugfs interface when module loading
    is restricted
    - LP: #1566221
  * SAUCE: UEFI: Restrict /dev/mem and /dev/kmem when module loading is
    restricted
    - LP: #1566221
  * SAUCE: UEFI: kexec: Disable at runtime if the kernel enforces module
    loading restrictions
    - LP: #1566221
  * SAUCE: UEFI: x86: Restrict MSR access when module loading is restricted
    - LP: #1566221
  * SAUCE: UEFI: Add option to automatically enforce module signatures when
    in Secure Boot mode
    - LP: #1566221

  [ Stefan Bader ]

  * [Config] Add pm80xx scsi driver to d-i
    - LP: #1595628

  [ Tim Gardner ]

  * [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
  * SAUCE: UEFI: Display MOKSBState when disabled
    - LP: #1571691
  * SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl
    - LP: #1593075

  [ Upstream Kernel Changes ]

  * HID: core: prevent out-of-bound readings
    - LP: #1579190
  * mm: migrate dirty page without clear_page_dirty_for_io etc
    - LP: #1581865
    - CVE-2016-3070

 -- Benjamin M Romer <benjamin.romer@xxxxxxxxxxxxx>  Mon, 27 Jun 2016
12:37:48 -0400

** Changed in: linux (Ubuntu Vivid)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1571691

Title:
  linux: MokSBState is ignored

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Trusty:
  Fix Released
Status in linux source package in Vivid:
  Fix Released
Status in linux source package in Wily:
  Fix Released
Status in linux source package in Xenial:
  Fix Released

Bug description:
  Ubuntu-4.4.0-20.36 was released with signed module enforcement
  enabled, but contained no way of disabling secure boot for DKMS.
  Without these kernel patches it is possible to get your machine in an
  unbootable state, especially if you don't have a fallback kernel.

  This patch set implements the ability to disable secure boot on demand
  from user space (with some password shennaigans). If one boots in
  secure boot mode and then installs a third party module (such as
  DKMS), then a dialog is displayed giving the user an option to disable
  secure boot, thereby also disabling module signature verification.
  Patch 1/2 is a scaffold patch of which only the GUID macros are
  actually used. The rest of the code is fenced by
  CONFIG_MODULE_SIG_UEFI which will not be enabled until a later series.
  Patch 2/2 is where MOKSBState is read and implemented. Patch 3/3
  simply prints a bit more informative state information.

  Information regarding secure boot and signed module enforcement will
  appear in the kernel log thusly:

  'Secure boot enabled' - normal secure boot operation with signed module enforcement.
  'Secure boot MOKSBState disabled' - UEFI Secure boot state has been over-ridden by MOKSBState. No signed module enforcement.

  In the absense of a 'Secure boot' string assume that secure boot is
  disabled or does not exist.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1571691/+subscriptions