linux: Implement secure boot state variables

Bug #1593075 reported by Tim Gardner on 2016-06-16
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Medium
Unassigned
Trusty
Medium
Unassigned
Xenial
Medium
Unassigned

Bug Description

User space needs a way to determine the state of secure boot and MOKSBState.

Changed in linux (Ubuntu):
importance: Undecided → Medium
Changed in linux (Ubuntu Xenial):
importance: Undecided → Medium
status: New → Triaged
Changed in linux (Ubuntu):
status: New → Triaged
tags: added: kernel-da-key xenial
Changed in linux (Ubuntu Xenial):
status: Triaged → Fix Committed
Kamal Mostafa (kamalmostafa) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-xenial
Tim Gardner (timg-tpi) wrote :

$ cat /proc/sys/kernel/secure_boot
0
$ cat /proc/sys/kernel/moksbstate_disabled
0

tags: added: verification-done-xenial
removed: verification-needed-xenial
Launchpad Janitor (janitor) wrote :
Download full text (24.7 KiB)

This bug was fixed in the package linux - 4.4.0-27.46

---------------
linux (4.4.0-27.46) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1594906

  * Support Edge Gateway's Bluetooth LED (LP: #1512999)
    - Revert "UBUNTU: SAUCE: Bluetooth: Support for LED on Marvell modules"

linux (4.4.0-26.45) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1594442

  * linux: Implement secure boot state variables (LP: #1593075)
    - SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl

  * failures building userspace packages that include ethtool.h (LP: #1592930)
    - ethtool.h: define INT_MAX for userland

linux (4.4.0-25.44) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1591289

  * Xenial update to v4.4.13 stable release (LP: #1590455)
    - MIPS64: R6: R2 emulation bugfix
    - MIPS: math-emu: Fix jalr emulation when rd == $0
    - MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC
    - MIPS: Don't unwind to user mode with EVA
    - MIPS: Avoid using unwind_stack() with usermode
    - MIPS: Fix siginfo.h to use strict posix types
    - MIPS: Fix uapi include in exported asm/siginfo.h
    - MIPS: Fix watchpoint restoration
    - MIPS: Flush highmem pages in __flush_dcache_page
    - MIPS: Handle highmem pages in __update_cache
    - MIPS: Sync icache & dcache in set_pte_at
    - MIPS: ath79: make bootconsole wait for both THRE and TEMT
    - MIPS: Reserve nosave data for hibernation
    - MIPS: Loongson-3: Reserve 32MB for RS780E integrated GPU
    - MIPS: Use copy_s.fmt rather than copy_u.fmt
    - MIPS: Fix MSA ld_*/st_* asm macros to use PTR_ADDU
    - MIPS: Prevent "restoration" of MSA context in non-MSA kernels
    - MIPS: Disable preemption during prctl(PR_SET_FP_MODE, ...)
    - MIPS: ptrace: Fix FP context restoration FCSR regression
    - MIPS: ptrace: Prevent writes to read-only FCSR bits
    - MIPS: Fix sigreturn via VDSO on microMIPS kernel
    - MIPS: Build microMIPS VDSO for microMIPS kernels
    - MIPS: lib: Mark intrinsics notrace
    - MIPS: VDSO: Build with `-fno-strict-aliasing'
    - affs: fix remount failure when there are no options changed
    - ASoC: ak4642: Enable cache usage to fix crashes on resume
    - Input: uinput - handle compat ioctl for UI_SET_PHYS
    - ARM: mvebu: fix GPIO config on the Linksys boards
    - ARM: dts: at91: fix typo in sama5d2 PIN_PD24 description
    - ARM: dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats
    - ARM: dts: imx35: restore existing used clock enumeration
    - ath9k: Add a module parameter to invert LED polarity.
    - ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.
    - ath10k: fix debugfs pktlog_filter write
    - ath10k: fix firmware assert in monitor mode
    - ath10k: fix rx_channel during hw reconfigure
    - ath10k: fix kernel panic, move arvifs list head init before htt init
    - ath5k: Change led pin configuration for compaq c700 laptop
    - hwrng: exynos - Fix unbalanced PM runtime put on timeout error path
    - rtlwifi: rtl8723be: Add antenna select module parameter
    - rtlwifi: btcoexist: Implement antenna selection
    ...

Changed in linux (Ubuntu):
status: Triaged → Fix Released
Launchpad Janitor (janitor) wrote :
Download full text (26.1 KiB)

This bug was fixed in the package linux - 4.4.0-28.47

---------------
linux (4.4.0-28.47) xenial; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1595874

  * Linux netfilter local privilege escalation issues (LP: #1595350)
    - netfilter: x_tables: don't move to non-existent next rule
    - netfilter: x_tables: validate targets of jumps
    - netfilter: x_tables: add and use xt_check_entry_offsets
    - netfilter: x_tables: kill check_entry helper
    - netfilter: x_tables: assert minimum target size
    - netfilter: x_tables: add compat version of xt_check_entry_offsets
    - netfilter: x_tables: check standard target size too
    - netfilter: x_tables: check for bogus target offset
    - netfilter: x_tables: validate all offsets and sizes in a rule
    - netfilter: x_tables: don't reject valid target size on some architectures
    - netfilter: arp_tables: simplify translate_compat_table args
    - netfilter: ip_tables: simplify translate_compat_table args
    - netfilter: ip6_tables: simplify translate_compat_table args
    - netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
    - netfilter: x_tables: do compat validation via translate_table
    - netfilter: x_tables: introduce and use xt_copy_counters_from_user

  * Linux netfilter IPT_SO_SET_REPLACE memory corruption (LP: #1555338)
    - netfilter: x_tables: validate e->target_offset early
    - netfilter: x_tables: make sure e->next_offset covers remaining blob size
    - netfilter: x_tables: fix unconditional helper

linux (4.4.0-27.46) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1594906

  * Support Edge Gateway's Bluetooth LED (LP: #1512999)
    - Revert "UBUNTU: SAUCE: Bluetooth: Support for LED on Marvell modules"

linux (4.4.0-26.45) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1594442

  * linux: Implement secure boot state variables (LP: #1593075)
    - SAUCE: UEFI: Add secure boot and MOK SB State disabled sysctl

  * failures building userspace packages that include ethtool.h (LP: #1592930)
    - ethtool.h: define INT_MAX for userland

linux (4.4.0-25.44) xenial; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1591289

  * Xenial update to v4.4.13 stable release (LP: #1590455)
    - MIPS64: R6: R2 emulation bugfix
    - MIPS: math-emu: Fix jalr emulation when rd == $0
    - MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC
    - MIPS: Don't unwind to user mode with EVA
    - MIPS: Avoid using unwind_stack() with usermode
    - MIPS: Fix siginfo.h to use strict posix types
    - MIPS: Fix uapi include in exported asm/siginfo.h
    - MIPS: Fix watchpoint restoration
    - MIPS: Flush highmem pages in __flush_dcache_page
    - MIPS: Handle highmem pages in __update_cache
    - MIPS: Sync icache & dcache in set_pte_at
    - MIPS: ath79: make bootconsole wait for both THRE and TEMT
    - MIPS: Reserve nosave data for hibernation
    - MIPS: Loongson-3: Reserve 32MB for RS780E integrated GPU
    - MIPS: Use copy_s.fmt rather than copy_u.fmt
    - MIPS: Fix MSA ld_*/st_* asm macros to use PTR_ADDU
    - MIPS: Prevent "restoration" of MSA c...

Changed in linux (Ubuntu Xenial):
status: Fix Committed → Fix Released
Kamal Mostafa (kamalmostafa) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-trusty
tags: added: verification-needed-vivid
Kamal Mostafa (kamalmostafa) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-wily
Kamal Mostafa (kamalmostafa) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-wily' to 'verification-done-wily'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Tim Gardner (timg-tpi) on 2016-07-05
tags: added: verification-done-trusty
removed: verification-needed-trusty
Tim Gardner (timg-tpi) on 2016-07-05
tags: added: verification-done-vivid
removed: verification-needed-vivid
Tim Gardner (timg-tpi) on 2016-07-05
tags: added: verification-done-wily
removed: verification-needed-wily
Seth Forshee (sforshee) on 2016-10-18
Changed in linux (Ubuntu Trusty):
importance: Undecided → Medium
status: New → Fix Committed
tags: removed: verification-done-trusty
Seth Forshee (sforshee) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-trusty
Tim Gardner (timg-tpi) on 2016-11-07
tags: added: verification-done-trusty
removed: verification-needed-trusty
Launchpad Janitor (janitor) wrote :
Download full text (12.7 KiB)

This bug was fixed in the package linux - 3.13.0-101.148

---------------
linux (3.13.0-101.148) trusty; urgency=low

  [ Seth Forshee ]

  * Release Tracking Bug
    - LP: #1635430

  * [arm64] nova instances can't boot with 3.13.0-92 (LP: #1608854)
    - Revert "efi: Disable interrupts around EFI calls, not in the epilog/prolog
      calls"
    - Revert "x86/efi: Use all 64 bit of efi_memmap in setup_e820()"
    - Revert "x86/efi: Store upper bits of command line buffer address in
      ext_cmd_line_ptr"
    - Revert "efivarfs: Ensure VariableName is NUL-terminated"
    - Revert "efi/libstub: Fix boundary checking in efi_high_alloc()"
    - Revert "arm64: efi: only attempt efi map setup if booting via EFI"
    - Revert "UBUNTU: arm64: Implement efi_enabled()"
    - Revert "efi/arm64: ignore dtb= when UEFI SecureBoot is enabled"
    - Revert "doc: arm64: add description of EFI stub support"
    - Revert "UBUNTU: Move get_dram_base to arm private file"
    - Revert "arm64: efi: add EFI stub"
    - Revert "arm64: add EFI runtime services"
    - Revert "efi: Add shared FDT related functions for ARM/ARM64"
    - Revert "efi: add helper function to get UEFI params from FDT"
    - Revert "doc: efi-stub.txt updates for ARM"
    - Revert "efi: Add get_dram_base() helper function"
    - Revert "efi: create memory map iteration helper"
    - Revert "x86, ia64: Move EFI_FB vga_default_device() initialization to
      pci_vga_fixup()"
    - Revert "firmware: Do not use WARN_ON(!spin_is_locked())"
    - Revert "efi-pstore: Fix an overflow on 32-bit builds"
    - Revert "x86/efi: Fix 32-bit fallout"
    - Revert "x86/efi: Check krealloc return value"
    - Revert "x86/efi: Runtime services virtual mapping"
    - Revert "x86/efi: Fix off-by-one bug in EFI Boot Services reservation"
    - x86/efi: Simplify EFI_DEBUG
    - x86/efi: Runtime services virtual mapping
    - x86/efi: Check krealloc return value
    - SAUCE: Merge tag 'efi-next' of
      git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into x86/efi
    - doc: Fix trivial spelling mistake in efi-stub.txt
    - x86/efi: Remove unused variables in __map_region()
    - x86/efi: Add a wrapper function efi_map_region_fixed()
    - x86/efi: Fix off-by-one bug in EFI Boot Services reservation
    - x86/efi: Cleanup efi_enter_virtual_mode() function
    - efi: Export more EFI table variables to sysfs
    - [Config] CONFIG_EFI_RUNTIME_MAP=y
    - efi: Export EFI runtime memory mapping to sysfs
    - x86/efi: Pass necessary EFI data for kexec via setup_data
    - x86/efi: Delete superfluous global variables
    - x86/efi: parse_efi_setup() build fix
    - SAUCE: Merge tag 'v3.13-rc7' into x86/efi-kexec to resolve conflicts
    - x86/efi: Allow mapping BGRT on x86-32
    - x86/efi: Fix 32-bit fallout
    - x86/efi: Check status field to validate BGRT header
    - x86/efi: Quirk out SGI UV
    - v3.14 - Bacported EFI up to v3.14
    - efi: Move facility flags to struct efi
    - efi: Set feature flags inside feature init functions
    - efivarfs: 'efivarfs_file_write' function reorganization
    - x86/efi: Delete out-of-date comments of efi_query_variable_store
    - x86/efi: Style neatening
    - x8...

Changed in linux (Ubuntu Trusty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers