Activity log for bug #1574727

Date Who What changed Old value New value Message
2016-04-25 15:53:20 Mathieu Trudel-Lapierre bug added bug
2016-04-25 15:53:40 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu)
2016-04-25 15:53:50 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu)
2016-04-25 15:54:01 Mathieu Trudel-Lapierre bug task added shim (Ubuntu)
2016-04-25 16:04:15 Mario Limonciello bug added subscriber Mario Limonciello
2016-04-26 14:58:14 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu)
2016-04-26 15:14:54 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre nominated for series Ubuntu Precise
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added dkms (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added shim (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu Precise)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre nominated for series Ubuntu Wily
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added dkms (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added shim (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu Wily)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre nominated for series Ubuntu Yakkety
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added dkms (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added shim (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu Yakkety)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre nominated for series Ubuntu Trusty
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added dkms (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added shim (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu Trusty)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre nominated for series Ubuntu Xenial
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2 (Ubuntu Xenial)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added dkms (Ubuntu Xenial)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added shim (Ubuntu Xenial)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added grub2-signed (Ubuntu Xenial)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added mokutil (Ubuntu Xenial)
2016-04-26 15:15:39 Mathieu Trudel-Lapierre bug task added efivar (Ubuntu Xenial)
2016-04-26 15:16:08 Mathieu Trudel-Lapierre efivar (Ubuntu Wily): status New Fix Released
2016-04-26 15:16:24 Mathieu Trudel-Lapierre efivar (Ubuntu Xenial): status New Fix Released
2016-04-26 15:16:36 Mathieu Trudel-Lapierre efivar (Ubuntu Yakkety): status New Fix Released
2016-04-26 15:16:52 Mathieu Trudel-Lapierre dkms (Ubuntu Xenial): status New Fix Released
2016-04-26 15:17:05 Mathieu Trudel-Lapierre bug task deleted dkms (Ubuntu Yakkety)
2016-04-26 15:17:19 Mathieu Trudel-Lapierre bug task deleted efivar (Ubuntu Yakkety)
2016-04-26 15:17:28 Mathieu Trudel-Lapierre bug task deleted grub2 (Ubuntu Yakkety)
2016-04-26 15:17:40 Mathieu Trudel-Lapierre bug task deleted grub2-signed (Ubuntu Yakkety)
2016-04-26 15:18:40 Mathieu Trudel-Lapierre bug task deleted mokutil (Ubuntu Yakkety)
2016-04-26 15:20:19 Mathieu Trudel-Lapierre bug task deleted shim (Ubuntu Yakkety)
2016-04-26 15:20:44 Mathieu Trudel-Lapierre mokutil (Ubuntu Xenial): status New Fix Released
2016-04-26 15:21:03 Mathieu Trudel-Lapierre mokutil (Ubuntu): status New Fix Released
2016-04-26 15:21:25 Mathieu Trudel-Lapierre dkms (Ubuntu): status New Fix Released
2016-04-26 22:40:31 Steve Langasek efivar (Ubuntu Trusty): status New Fix Committed
2016-05-04 16:45:26 Chris J Arges mokutil (Ubuntu Trusty): status New Fix Committed
2016-05-04 16:45:45 Chris J Arges bug added subscriber Ubuntu Stable Release Updates Team
2016-05-04 16:45:47 Chris J Arges bug added subscriber SRU Verification
2016-05-04 16:45:51 Chris J Arges tags verification-needed
2016-05-04 16:46:53 Chris J Arges mokutil (Ubuntu Wily): status New Fix Committed
2016-05-16 19:45:26 Mathieu Trudel-Lapierre bug task added shim-signed (Ubuntu)
2016-05-20 17:31:54 Mathieu Trudel-Lapierre shim-signed (Ubuntu): importance Undecided High
2016-05-20 17:31:54 Mathieu Trudel-Lapierre shim-signed (Ubuntu): status New Fix Released
2016-05-20 17:31:54 Mathieu Trudel-Lapierre shim-signed (Ubuntu): assignee Mathieu Trudel-Lapierre (cyphermox)
2016-05-25 12:48:43 Tim Gardner bug added subscriber Tim Gardner
2016-05-27 14:07:20 Mathieu Trudel-Lapierre bug task added efibootmgr (Ubuntu)
2016-05-27 14:07:47 Mathieu Trudel-Lapierre efibootmgr (Ubuntu): status New Fix Released
2016-05-27 14:08:22 Mathieu Trudel-Lapierre efibootmgr (Ubuntu Xenial): status New Fix Released
2016-05-27 14:08:36 Mathieu Trudel-Lapierre efibootmgr (Ubuntu Wily): status New Fix Released
2016-06-01 12:01:24 Chris J Arges efibootmgr (Ubuntu Precise): status New Fix Committed
2016-06-01 12:03:33 Chris J Arges efibootmgr (Ubuntu Trusty): status New Fix Committed
2016-06-01 18:50:03 Steve Langasek mokutil (Ubuntu Precise): status New Fix Committed
2016-06-01 20:03:26 Steve Langasek efibootmgr (Ubuntu Precise): status Fix Committed Invalid
2016-06-01 20:03:44 Steve Langasek efibootmgr (Ubuntu Trusty): status Fix Committed Invalid
2016-06-01 20:05:51 Steve Langasek efivar (Ubuntu Trusty): status Fix Committed In Progress
2016-06-01 20:47:21 Steve Langasek efivar (Ubuntu Precise): status New Fix Committed
2016-06-01 20:56:20 Steve Langasek efivar (Ubuntu Trusty): status In Progress Fix Committed
2016-06-08 18:40:55 Chris J Arges shim-signed (Ubuntu Xenial): status New Fix Committed
2016-06-17 08:44:24 Martin Pitt grub2 (Ubuntu Xenial): status New Fix Committed
2016-06-17 08:46:21 Martin Pitt grub2-signed (Ubuntu Xenial): status New Fix Committed
2016-06-21 07:04:59 Launchpad Janitor grub2 (Ubuntu Xenial): status Fix Committed Fix Released
2016-06-21 07:05:07 Launchpad Janitor grub2-signed (Ubuntu Xenial): status Fix Committed Fix Released
2016-06-21 07:08:10 Martin Pitt grub2 (Ubuntu Xenial): status Fix Released Fix Committed
2016-06-21 07:08:21 Martin Pitt grub2-signed (Ubuntu Xenial): status Fix Released Fix Committed
2016-06-21 17:23:04 Mathieu Trudel-Lapierre shim-signed (Ubuntu Wily): status New In Progress
2016-06-21 17:23:18 Mathieu Trudel-Lapierre shim-signed (Ubuntu Trusty): status New In Progress
2016-06-21 17:23:30 Mathieu Trudel-Lapierre shim-signed (Ubuntu Precise): status New In Progress
2016-06-23 14:48:46 Mathieu Trudel-Lapierre tags verification-needed verification-done-precise verification-needed
2016-06-23 15:06:49 Mathieu Trudel-Lapierre description [Rationale] Secure Boot is good. We want to be able to validate that as much as possible of the boot process happens with signed binaries; from our shim (the part that is loaded by the EFI firmware itself), down to grub2, the kernel, and even loaded modules. [Impact] All our users booting in UEFI; on all supported releases. [Test cases] <FIXME: add more test cases> Test cases here are separated by the components that need to be changed: = grub2 = Booting signed kernels: 1) Try to boot a custom kernel 2) Verify that the kernel will not be loaded by grub (you should see an error message about the signature) Prompting on upgrade: 0) On a system that runs a dkms module (such as r8168-dkms, rtl8812au-dkms, ndiswrapper-dkms, bbswitch-dkms, etc.) 1) Make sure that validation is enabled and reboot: 'sudo mokutil --enable-validation && sudo reboot' 2) Upgrade to the new grub2 package (you may need to download the updated package beforehand) 3) Validate that grub2 prompts you to disable shim validation. = dkms = Prompting for dkms on install: 1) Install r8168-dkms 2) Verify that you're asked to disable shim validation, and walked through the process via debconf prompts. Prompting for dkms on upgrade 0) On a system that runs a dkms module (such as r8168-dkms, rtl8812au-dkms, ndiswrapper-dkms, bbswitch-dkms, etc.) 1) Make sure that validation is enabled and reboot: 'sudo mokutil --enable-validation && reboot' 2) Upgrade to the new dkms package (you may need to download the updated package beforehand) 3) Validate that dkms prompts you to disable shim validation. = shim = Booting: -> Validate that it allows booting grubx64.efi signed with the old key. -> Validate that it allows booting grubx64.efi signed with the new key. Validation toggle: 0) Boot the system; verify if /sys/firmware/efi/efivars/MokSBStateRT-* is present; If MokSBStateRT is preset: 1) sudo mokutil --enable-validation && sudo reboot 2) Validate that Mok asks you if you want to enable validation Otherwise: 1) sudo mokutil --disable-validation && sudo reboot 2) Validate that Mok asks you if you want to disable validation Finally: 3) Complete the process to toggle validation state, reboot, and verify whether MokSBStateRT is present. 4) Run mokutil again to toggle validation back to its former state. [Regression Potential] Issues to watch out for: - (dkms) not prompting on upgrade of a dkms package/dkms itself if validation is currently enabled (provided debconf does not have dkms/disable_secureboot seen and set to false) - (dkms, on new shim) prompting unnecessarily if validation is already disabled - (grub) not prompting on upgrade ... - (grub) not prompting on upgrade across releases if validation is disabled; without the applied SRU on original release. - (grub, on new shim) prompting unecessarily ... - (shim) failing to boot on some firmware that doesn't correctly follow specification - (shim) failing to load a properly-signed grub - (shim) accepting to load a badly-signed grub [Rationale] Secure Boot is good. We want to be able to validate that as much as possible of the boot process happens with signed binaries; from our shim (the part that is loaded by the EFI firmware itself), down to grub2, the kernel, and even loaded modules. [Impact] All our users booting in UEFI; on all supported releases. [Test cases] https://docs.google.com/spreadsheets/d/1GbyQDb4-sRv7OlIpbISiwVJ2ARHP3AkG2HbPTRk7p-E/edit#gid=0 Test cases here are separated by the components that need to be changed: = mokutil = Adding a MOK key: 1) Install system 2) Run 'mokutil --import <file.der>' to import a signing certificate. 3) On reboot; validate MOK prompts for new MOK key to add. Toggling Secure Boot state: 1) Install system 2) mokutil --enable-validation or mokutil --disable-validation 3) Validate that on reboot MOK prompts to change Secure Boot state. Listing keys: 1) mokutil --list-enrolled -- should list keys previously enrolled, and Microsoft keys on systems that are configured with them for factory Secure Boot. = efivar = libefivar0 gets tested via the use of mokutil. Since it is a library with no directly usable binaries; we rely on mokutil / sbsigntool / efibootmgr to do testing. 1) Run efibootmgr -v ; verify it lists BootEntries. 2) Run efibootmgr -c -L ubuntu2 -l \\EFI\\ubuntu\\shimx64.efi ; verify that on reboot; you can get into a boot menu that will list 'ubuntu2', and that picking that boot entry boots into Ubuntu. = shim-signed = 1) Install system; upgrade to new packages 1b) Verify /proc/sys/kernel/secure_boot shows 1. 1c) Verify /proc/sys/kernel/moksbstate_disabled shows 0. 2) Run 'sudo update-secureboot-policy'; validate that it prompts to disable Secure Boot if it's not already disabled. 3) Run 'sudo update-secureboot-policy'; validate you are not prompted again to disable Secure Boot. 4) Reboot; follow MOK steps to disable Secure Boot. 4b) Verify /proc/sys/kernel/secure_boot shows 1. 4c) Verify /proc/sys/kernel/moksbstate_disabled shows 1. 5) Run 'sudo update-secureboot-policy --enable'; validate you are prompted to enable Secure Boot. 6) Reboot; follow MOK steps to re-enable Secure Boot. 6b) Verify /proc/sys/kernel/secure_boot shows 1. 6c) Verify /proc/sys/kernel/moksbstate_disabled shows 0. = grub2 = Booting signed kernels: 1) Try to boot a custom kernel 2) Verify that the kernel will not be loaded by grub (you should see an error message about the signature) Prompting on upgrade: 0) On a system that runs a dkms module (such as r8168-dkms, rtl8812au-dkms, ndiswrapper-dkms, bbswitch-dkms, etc.) 1) Make sure that validation is enabled and reboot: 'sudo mokutil --enable-validation && sudo reboot' 2) Upgrade to the new grub2 package (you may need to download the updated package beforehand) 3) Validate that grub2 prompts you to disable shim validation. = dkms = Prompting for dkms on install: 1) Install r8168-dkms 2) Verify that you're asked to disable shim validation, and walked through the process via debconf prompts. Prompting for dkms on upgrade 0) On a system that runs a dkms module (such as r8168-dkms, rtl8812au-dkms, ndiswrapper-dkms, bbswitch-dkms, etc.) 1) Make sure that validation is enabled and reboot: 'sudo mokutil --enable-validation && reboot' 2) Upgrade to the new dkms package (you may need to download the updated package beforehand) 3) Validate that dkms prompts you to disable shim validation. = shim = Booting: -> Validate that it allows booting grubx64.efi signed with the old key. -> Validate that it allows booting grubx64.efi signed with the new key. Validation toggle: 0) Boot the system; verify if /sys/firmware/efi/efivars/MokSBStateRT-* is present; If MokSBStateRT is preset: 1) sudo mokutil --enable-validation && sudo reboot 2) Validate that Mok asks you if you want to enable validation Otherwise: 1) sudo mokutil --disable-validation && sudo reboot 2) Validate that Mok asks you if you want to disable validation Finally: 3) Complete the process to toggle validation state, reboot, and verify whether MokSBStateRT is present. 4) Run mokutil again to toggle validation back to its former state. [Regression Potential] Issues to watch out for: - (dkms) not prompting on upgrade of a dkms package/dkms itself if validation is currently enabled (provided debconf does not have dkms/disable_secureboot seen and set to false) - (dkms, on new shim) prompting unnecessarily if validation is already disabled - (grub) not prompting on upgrade ... - (grub) not prompting on upgrade across releases if validation is disabled; without the applied SRU on original release. - (grub, on new shim) prompting unecessarily ... - (shim) failing to boot on some firmware that doesn't correctly follow specification - (shim) failing to load a properly-signed grub - (shim) accepting to load a badly-signed grub
2016-06-23 15:42:34 Steve Langasek shim-signed (Ubuntu Wily): status In Progress Fix Committed
2016-06-23 15:47:26 Steve Langasek dkms (Ubuntu Wily): status New Fix Committed
2016-06-24 15:29:39 Martin Pitt shim-signed (Ubuntu Trusty): status In Progress Fix Committed
2016-06-24 15:30:24 Martin Pitt dkms (Ubuntu Trusty): status New Fix Committed
2016-06-24 15:30:56 Martin Pitt grub2 (Ubuntu Trusty): status New Fix Committed
2016-06-24 15:34:45 Martin Pitt grub2-signed (Ubuntu Trusty): status New Fix Committed
2016-06-24 15:38:07 Martin Pitt shim-signed (Ubuntu Precise): status In Progress Fix Committed
2016-06-25 19:35:38 Ubuntu Foundations Team Bug Bot bug added subscriber Brian Murray
2016-06-25 19:35:45 Ubuntu Foundations Team Bug Bot tags verification-done-precise verification-needed verification-done-precise verification-failed verification-needed
2016-06-27 14:11:04 Andy Whitcroft tags verification-done-precise verification-failed verification-needed verification-done-precise verification-needed
2016-06-27 19:34:57 Ubuntu Foundations Team Bug Bot tags verification-done-precise verification-needed verification-done-precise verification-failed verification-needed
2016-06-28 12:30:00 Martin Pitt tags verification-done-precise verification-failed verification-needed verification-done-precise verification-needed
2016-06-28 18:59:37 Steve Langasek grub2-signed (Ubuntu Wily): status New Invalid
2016-06-28 19:19:59 Steve Langasek grub2-signed (Ubuntu Xenial): status Fix Committed In Progress
2016-06-28 19:20:42 Steve Langasek grub2 (Ubuntu Wily): status New Invalid
2016-06-28 19:21:28 Steve Langasek grub2 (Ubuntu Xenial): status Fix Committed In Progress
2016-06-28 19:25:33 Steve Langasek grub2 (Ubuntu Trusty): status Fix Committed Invalid
2016-06-28 19:30:47 Steve Langasek grub2-signed (Ubuntu Trusty): status Fix Committed Invalid
2016-06-28 19:33:17 Ubuntu Foundations Team Bug Bot tags verification-done-precise verification-needed verification-done-precise verification-failed verification-needed
2016-06-28 21:24:59 Steve Langasek grub2-signed (Ubuntu Precise): status New Invalid
2016-06-28 21:27:39 Steve Langasek grub2 (Ubuntu Precise): status New Invalid
2016-06-30 07:29:48 Martin Pitt tags verification-done-precise verification-failed verification-needed verification-done-precise verification-needed
2016-06-30 19:36:16 Ubuntu Foundations Team Bug Bot tags verification-done-precise verification-needed verification-done-precise verification-failed verification-needed
2016-06-30 20:16:52 Steve Langasek tags verification-done-precise verification-failed verification-needed verification-done-precise verification-needed
2016-06-30 20:31:04 Launchpad Janitor mokutil (Ubuntu Precise): status Fix Committed Fix Released
2016-06-30 20:31:11 Launchpad Janitor efivar (Ubuntu Precise): status Fix Committed Fix Released
2016-06-30 20:37:36 Steve Langasek tags verification-done-precise verification-needed verification-needed
2016-07-01 07:45:18 Gianfranco Costamagna tags verification-needed verification-done
2016-07-01 15:15:37 Steve Langasek tags verification-done verification-needed
2016-07-05 19:34:14 Ubuntu Foundations Team Bug Bot tags verification-needed verification-failed verification-needed
2016-07-08 00:36:59 Steve Langasek tags verification-failed verification-needed verification-needed
2016-07-08 17:33:36 Mathieu Trudel-Lapierre tags verification-needed verification-done-trusty verification-needed
2016-07-08 17:46:25 Mathieu Trudel-Lapierre tags verification-done-trusty verification-needed verification-done-trusty verification-done-wily verification-needed
2016-07-08 17:46:33 Mathieu Trudel-Lapierre tags verification-done-trusty verification-done-wily verification-needed verification-done-trusty verification-done-wily verification-done-xenial verification-needed
2016-07-14 01:06:39 Launchpad Janitor mokutil (Ubuntu Trusty): status Fix Committed Fix Released
2016-07-14 01:08:48 Launchpad Janitor dkms (Ubuntu Trusty): status Fix Committed Fix Released
2016-07-14 01:10:39 Launchpad Janitor shim-signed (Ubuntu Trusty): status Fix Committed Fix Released
2016-07-14 01:11:50 Launchpad Janitor mokutil (Ubuntu Wily): status Fix Committed Fix Released
2016-07-14 01:12:26 Launchpad Janitor dkms (Ubuntu Wily): status Fix Committed Fix Released
2016-07-14 01:12:45 Launchpad Janitor shim-signed (Ubuntu Wily): status Fix Committed Fix Released
2016-07-14 01:15:16 Launchpad Janitor shim-signed (Ubuntu Xenial): status Fix Committed Fix Released
2016-07-14 04:11:34 Launchpad Janitor grub2 (Ubuntu Xenial): status In Progress Fix Released
2016-07-14 04:11:38 Launchpad Janitor grub2-signed (Ubuntu Xenial): status In Progress Fix Released
2016-07-15 14:12:21 Shane Synan bug added subscriber Shane Synan
2016-09-09 18:44:37 Mathieu Trudel-Lapierre efivar (Ubuntu Trusty): status Fix Committed Fix Released
2016-09-09 19:20:50 Steve Langasek efivar (Ubuntu Trusty): status Fix Released Invalid
2016-09-15 13:13:14 Mathieu Trudel-Lapierre tags verification-done-trusty verification-done-wily verification-done-xenial verification-needed verification-done-precise verification-done-trusty verification-done-wily verification-done-xenial
2016-09-15 18:03:08 Launchpad Janitor shim-signed (Ubuntu Precise): status Fix Committed Fix Released
2017-03-30 19:50:58 Mathieu Trudel-Lapierre grub2-signed (Ubuntu): status New Invalid
2017-03-30 19:51:15 Mathieu Trudel-Lapierre grub2 (Ubuntu): status New Invalid