enable config for fixing 5.17 kernel won't load mok

[Ivan Hu]

[Impact]
Mok keys is not trusted after kernel 5.17

[Fix]
Enable the CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT and CONFIG_IMA_ARCH_POLICY for fixing the patch
"[patch] integrity: Do not load MOK and MOKx when secure boot be disabled" was added to check if secureboot enabled for trusting the MOK key

[Test]
Enroll Mok key and use it to sign kernel modules, make sure secure boot is on and load the kernel module by either modprobe or insmod.

[Where problems could occur]
Low. only affect the checking secureboot enable function.

[Yuan-Chen Cheng (ycheng-twn)]

install 5.17-oem 1005 kernel from jammy-proposed, it's not fixed yet.

# grep CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT /boot/config-5.1*
/boot/config-5.17.0-1004-oem:# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
/boot/config-5.17.0-1005-oem:# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set

# grep CONFIG_IMA_ARCH_POLICY /boot/config-5.1*
/boot/config-5.17.0-1004-oem:# CONFIG_IMA_ARCH_POLICY is not set
/boot/config-5.17.0-1005-oem:# CONFIG_IMA_ARCH_POLICY is not set

[Yuan-Chen Cheng (ycheng-twn)]

5.17-oem-1007 kernel have the fix, wait it's landing and then do verification.

[Yuan-Chen Cheng (ycheng-twn)]

bug verified passed with linux-oem-22.04 5.17.0.1009.9 in jammy-proposed

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-5.17 - 5.17.0-1011.12

---------------
linux-oem-5.17 (5.17.0-1011.12) jammy; urgency=medium

  * CVE-2022-1972
    - netfilter: nf_tables: sanitize nft_set_desc_concat_parse()

  * CVE-2022-1966
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier

 -- Thadeu Lima de Souza Cascardo <email address hidden> Fri, 03 Jun 2022 14:17:23 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.19.0-15.15

---------------
linux (5.19.0-15.15) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-15.15 -proposed tracker (LP: #1983335)

  * Miscellaneous Ubuntu changes
    - [Config] update annotations to support both gcc-11 and gcc-12

 -- Andrea Righi <email address hidden> Tue, 02 Aug 2022 09:23:01 +0200