update database on each boot, not just on package install
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
secureboot-db (Ubuntu) |
Fix Released
|
Low
|
Unassigned | ||
Xenial |
Won't Fix
|
Undecided
|
Unassigned | ||
Bionic |
Won't Fix
|
Undecided
|
Unassigned | ||
Disco |
Won't Fix
|
Undecided
|
Unassigned | ||
Eoan |
Fix Released
|
Low
|
Unassigned |
Bug Description
[Impact]
Currently the secureboot databases are only updated at the time the secureboot-db package is installed or upgraded, but this may not be the point in time that the firmware needs to be updated.
- New OS install: the secureboot-db package was installed during the image mastering, not when Ubuntu is written to the target disk.
- Package installed while the system is booted in BIOS mode, later switched to UEFI mode
- Hard drive moved to a new computer which doesn't yet have the updates
We should ship a systemd unit to re-apply these revocations as necessary on each boot.
The unit should be
ConditionPathEx
(don't use dbx for the condition, since if dbx is empty this variable may be absent.)
[Test case]
- Ensure unit runs at boot
- Ensure unit runs in postinst on upgrade
[Regression potential]
Biggest potential is in the postinst, which now relies on dh to start the systemd oneshot service, rather than doing all the work itself. So if that's not working, things might act differently.
Regression potential at boot is barely existent. If the service fails, nothing bad happens except your system booting in degraded state. There might be a minor slow down, but should not be much.
Changed in secureboot-db (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → Low |
tags: | added: id-5b92dcef18769e2342a07c92 |
tags: | added: patch |
description: | updated |
description: | updated |
Changed in secureboot-db (Ubuntu Disco): | |
status: | New → Fix Committed |
Changed in secureboot-db (Ubuntu Bionic): | |
status: | New → In Progress |
Changed in secureboot-db (Ubuntu Disco): | |
status: | Fix Committed → In Progress |
Changed in secureboot-db (Ubuntu Xenial): | |
status: | New → In Progress |
Patch for review