group.of.nepali.translators team mailing list archive

[Mathieu Trudel-Lapierre <mathieu.tl@xxxxxxxxx>]

I had forgotten that MokManager and fallback binaries changed their
installed filenames, dropping the .signed in shim 13. grub2 and
grub2-signed need a tiny update for it too; but that doesn't change the
test cases.

** Also affects: grub2 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: grub2-signed (Ubuntu)
   Importance: Undecided
       Status: New

** Changed in: grub2 (Ubuntu)
       Status: New => In Progress

** Changed in: grub2-signed (Ubuntu)
       Status: New => In Progress

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1708245

Title:
  shim can't enable validation and enroll keys in one sitting

Status in grub2 package in Ubuntu:
  In Progress
Status in grub2-signed package in Ubuntu:
  In Progress
Status in shim package in Ubuntu:
  New
Status in shim-signed package in Ubuntu:
  Fix Released
Status in grub2 source package in Xenial:
  New
Status in grub2-signed source package in Xenial:
  New
Status in shim source package in Xenial:
  New
Status in shim-signed source package in Xenial:
  New
Status in grub2 source package in Zesty:
  New
Status in grub2-signed source package in Zesty:
  New
Status in shim source package in Zesty:
  New
Status in shim-signed source package in Zesty:
  New
Status in grub2 source package in Artful:
  New
Status in grub2-signed source package in Artful:
  New
Status in shim source package in Artful:
  New
Status in shim-signed source package in Artful:
  New

Bug description:
  [Impact]

  
  [Test cases]
  First, update shim to the newest version.

  = Boot test =
  1) Reboot.
  2) Validate that the system boots correctly in UEFI mode.

  
  = Key enrollment =
  1) Create a new x.509 certificate to import into MOK.
  2) Run 'mokutil --import cert.der'
  3) Reboot
  4) Execute the steps described on screen to enroll the new key.

  
  = Toggling validation =
  1) Run 'mokutil --disable-validation'
  2) Reboot.
  3) Follow the steps on screen to toggle validation.
  4) Boot to the system, validate that validation is disabled:
  $ sudo hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The output should read the last byte as a 1.

  5) Run 'mokutil --enable-validation'
  6) Reboot.
  7) Follow the steps on screen to toggle validation.
  8) Boot to the system, validate that validation is enabled again:
  $ hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The file should not exist.

  
  = Toggling validation and enrolling =
  1) Disable validation, as above, and reboot into the system.
  2) Create a new x.509 certificate to import into MOK.
  3) Run 'mokutil --import cert.der'
  4) Run 'mokutil --enable-validation'
  5) Reboot.
  6) Follow the steps on screen to proceed through toggling validation in shim.
  Once that step is done, you should be returned to the MokManager menu to complete further steps.
  7) Follow the steps on screen to enroll the new key.
  Once completed, you should have the option at the bottom of the menu to Reboot.
  8) Reboot into the system.
  9) Validate that MOK validation is enabled and the new key is enrolled:

  Run:

  $ sudo hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The file should not exist.

  Then run:
  $ sudo cat /proc/keys

  And make sure the key you enrolled is present.

  
  [Regression potential]
  Failure to boot or validate validly signed EFI binaries (bootloader) might be possible regressions. The shim update modifies the enrollment process for new keys, and as such it might also be possible for the enrollment of a new key to fail in MokManager, rendering the validation process unstable: it may fail to validate validly signed EFI binaries signed by keys already present in the database or that were to be enrolled.

  
  ---

  We want to enable validation and enroll a new key in shim all at the
  same time on upgrade from previous releases.

  Curently, shim will wipe out all pending variables when it's done
  processing one of them (because it wants to reboot immediately after
  that action). That means if we re-enable validation, we lose the
  request to enroll the key, and vice-versa.

  This needs fixing as it would otherwise badly impact upgrades from
  zesty and earlier; where we might have walked users through disabling
  validation.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1708245/+subscriptions