Expose built-in trusted and revoked certificates
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
linux (Ubuntu) | Status tracked in Lunar | |||||
Bionic |
Fix Released
|
Low
|
Unassigned | |||
Focal |
Fix Released
|
Low
|
Unassigned | |||
Jammy |
Fix Released
|
Low
|
Unassigned | |||
Kinetic |
Fix Released
|
Low
|
Unassigned | |||
Lunar |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[ Impact ]
* Kernels have a set of builtin trusted and revoked certificates as a bundle
* It is not very easy to access them, one needs to either download linux kernel package source code; or boot the kernel look up builtin hashes; and then find certificates externally
* It would be more convenient for inspection to expose these in the buildinfo package, which already exposes auxiliary kernel information
[ Test Plan ]
* sudo apt install linux-buildinfo
* check that /usr/lib/
* check that /usr/lib/
Example output:
$ grep Subject: -r usr/lib/linux
usr/lib/
usr/lib/
usr/lib/
[ Where problems could occur ]
* buildinfo is an auxiliary package not installed by default, but used by developer tooling and packaging.
description: | updated |
Changed in linux (Ubuntu Bionic): | |
status: | Incomplete → Confirmed |
Changed in linux (Ubuntu Focal): | |
status: | Incomplete → Confirmed |
Changed in linux (Ubuntu Jammy): | |
status: | Incomplete → Confirmed |
Changed in linux (Ubuntu Kinetic): | |
status: | Incomplete → Confirmed |
Changed in linux (Ubuntu Lunar): | |
status: | Incomplete → Confirmed |
Changed in linux (Ubuntu Kinetic): | |
importance: | Undecided → Low |
Changed in linux (Ubuntu Jammy): | |
importance: | Undecided → Low |
Changed in linux (Ubuntu Focal): | |
importance: | Undecided → Low |
Changed in linux (Ubuntu Bionic): | |
importance: | Undecided → Low |
Changed in linux (Ubuntu Kinetic): | |
status: | Confirmed → Fix Committed |
Changed in linux (Ubuntu Jammy): | |
status: | Confirmed → Fix Committed |
Changed in linux (Ubuntu Focal): | |
status: | Confirmed → Fix Committed |
Changed in linux (Ubuntu Bionic): | |
status: | Confirmed → Fix Committed |
tags: |
added: verification-done-bionic removed: verification-needed-bionic |
tags: |
added: verification-done-focal removed: verification-needed-focal |
tags: |
added: verification-done-focal verification-done-jammy verification-done-kinetic removed: verification-needed-focal verification-needed-jammy verification-needed-kinetic |
tags: | added: kernel-stable-tracking-bug |
tags: | removed: verification-done-kinetic |
tags: | removed: verification-done-jammy |
tags: | removed: verification-done-focal |
tags: | removed: verification-done-bionic |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1996892
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.