group.of.nepali.translators team mailing list archive

[Dimitri John Ledkov <1932029@xxxxxxxxxxxxxxxxxx>]

** Also affects: linux-azure-5.8 (Ubuntu)
   Importance: Undecided
       Status: New

** Changed in: linux-azure-5.8 (Ubuntu Hirsute)
       Status: New => Invalid

** Changed in: linux-azure-5.8 (Ubuntu Bionic)
       Status: New => Invalid

** Changed in: linux-azure-5.8 (Ubuntu Xenial)
       Status: New => Invalid

** Changed in: linux-azure-5.8 (Ubuntu)
       Status: New => Invalid

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1932029

Title:
  Support builtin revoked certificates

Status in linux package in Ubuntu:
  Fix Released
Status in linux-azure-5.8 package in Ubuntu:
  Invalid
Status in linux-oem-5.10 package in Ubuntu:
  Invalid
Status in linux source package in Xenial:
  New
Status in linux-azure-5.8 source package in Xenial:
  Invalid
Status in linux-oem-5.10 source package in Xenial:
  Invalid
Status in linux source package in Bionic:
  New
Status in linux-azure-5.8 source package in Bionic:
  Invalid
Status in linux-oem-5.10 source package in Bionic:
  Invalid
Status in linux source package in Focal:
  New
Status in linux-azure-5.8 source package in Focal:
  New
Status in linux-oem-5.10 source package in Focal:
  Fix Committed
Status in linux source package in Hirsute:
  Fix Released
Status in linux-azure-5.8 source package in Hirsute:
  Invalid
Status in linux-oem-5.10 source package in Hirsute:
  Invalid

Bug description:
  [Impact]

  Upstream linux kernel now supports configuring built-in revoked
  certificates for the .blacklist keyring.

  Add support in our kernel configuration to have built-in revoked
  certificates.

  Revoke UEFI amd64 & arm64 2012 signing certificate.

  Under UEFI Secureboot with lockdown, shim may attempt to communicate
  revoked certificates to the kernel and depending on how good EFI
  firmware is, this may or may not succeed.

  By having these built-in, it will be prohibited to kexec file_load
  older kernels that were signed with now revoked certificates, however
  one boots.

  [Test Plan]

   * Boot kernel directly, or just with grub, and without shim

   * Check that

  $ sudo keyctl list %:.blacklist

  Contains assymetric 2012 key.

  [Where problems could occur]

   * Derivative and per-arch kernels may need to revoke different keys,
  thus this should be evaluated on per arch & flavour basis as to which
  keys to revoke.

  [Other Info]

   * In theory, this only needs to be revoked on amd64 and arm64, but
  empty revocation list is not allowed by the kernel configury, thus at
  the moment revoking 2012 UEFI cert for all architectures.

   * an ubuntu kernel team regression test is being added to assert that expected revoked certificates have been revoked
  see https://lists.ubuntu.com/archives/kernel-team/2021-August/122986.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1932029/+subscriptions