mokutil ignores timeout parameter
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| mokutil (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
| Bionic |
New
|
Undecided
|
Unassigned | ||
| Eoan |
Won't Fix
|
Undecided
|
Unassigned | ||
| Focal |
Confirmed
|
Undecided
|
Unassigned | ||
| Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
| shim-signed (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
| Bionic |
Fix Released
|
High
|
Matthieu Clemenceau | ||
| Eoan |
Won't Fix
|
High
|
Unassigned | ||
| Focal |
Fix Released
|
High
|
Unassigned | ||
| Groovy |
Fix Released
|
High
|
Unassigned | ||
Bug Description
This section is for Bionic SRU purpose
[Impact]
Because mokutil ignores the timeout parameter in /usr/sbin/
it becomes impossible to sign dkms-built modules with secure boot enable
[Test Case]
With a bionic with secureboot enabled (tested in a VM)
Make sure Secure Boot is enable (should return : SecureBoot enabled)
# mokutil --sb-state
Then install a dkms driver
# sudo apt install fwts-efi-
This should prompt mok manager menu to setup Secure Boot password
The key details will be under
# mokutil --list-new
# reboot
Without the patch nothing happen upon reboot. System boots fully
and the driver isn't installed
With the solution installed, a menu will pop up on reboot to enroll the key
Once the key is enrolled it will show up under
# mokutil --list-enrolled
[Regression Potential]
This change is fairly minimal and has been shipping with Focal.
Possible regression could involve inability to sign other drivers.
[Other Info]
It appears the issue describe here happens in bionic-proposed rather than bionic-updates. This is resolved with shim-signed 1.37~18.04.6
End SRU
------
Version info:
Description: Ubuntu Focal Fossa (development branch)
Release: 20.04
Done upgrade and dist-upgrade on March 26th, just before reporting this.
mokutil:
Installed: 0.3.0+153871043
dkms:
Installed: 2.8.1-5ubuntu1
shim-signed:
Installed: 1.41+15+
Dell precision M3800, secure boot on (obviously)
The backstory of it, is that in development version of 20.04 it became impossible to sign dkms-built modules with secure-boot enabled. The ncurses-based interfaces opens normally and prompts for the password twice (as usual), but after reboot the key-enrollment menu does not appear. After comparing all the packages involved into this process with the ones from 19.04, I managed to pinpoint the culprit, namely:
/usr/sbin/
Removing that argument like this:
111c111
< printf '%s\n%s\n' "$key" "$again" | mokutil --enable-validation >/dev/null || true
---
> printf '%s\n%s\n' "$key" "$again" | mokutil --timeout -1 --enable-validation >/dev/null || true
120c120
< printf '%s\n%s\n' "$key" "$again" | mokutil --import "$SB_KEY" >/dev/null || true
---
> printf '%s\n%s\n' "$key" "$again" | mokutil --timeout -1 --import "$SB_KEY" >/dev/null || true
fixes the problem, yet to me it does not eliminate its root cause.
Picking up those trails, I decided to fiddle with mokutil itself. In my case, adding any --timeout param (not only -1, but any integer really) triggers it to display help/usage message, nothing more. For that reason I am quite convinced that my actions related to update-
I am fully aware, that: https:/
ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: mokutil 0.3.0+153871043
ProcVersionSign
Uname: Linux 5.4.0-18-generic x86_64
ApportVersion: 2.20.11-0ubuntu21
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Thu Mar 26 12:08:06 2020
InstallationDate: Installed on 2020-03-16 (9 days ago)
InstallationMedia: Ubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200316)
SourcePackage: mokutil
UpgradeStatus: No upgrade log present (probably fresh install)
Related branches
- Steve Langasek: Pending requested
-
Diff: 39 lines (+11/-2)2 files modifieddebian/changelog (+7/-0)
update-secureboot-policy (+4/-2)
- Jean-Baptiste Lallement: Approve
-
Diff: 27 lines (+8/-0)2 files modifieddebian/changelog (+7/-0)
scripts/simple-plugins (+1/-0)
| Aleksander Miera (amiera) wrote | #1 |
| Aleksander Miera (amiera) wrote | #2 |
| information type: | Public → Public Security |
| information type: | Public Security → Public |
| Ubuntu Foundations Team Bug Bot (crichton) wrote | #3 |
| tags: | added: patch |
| tags: | added: rls-ff-incoming |
| Changed in shim-signed (Ubuntu Focal): | |
| status: | New → Triaged |
| importance: | Undecided → High |
| tags: | removed: rls-ff-incoming |
| Aleksander Miera (amiera) wrote | #4 |
| Changed in shim-signed (Ubuntu Focal): | |
| status: | Triaged → Invalid |
| Changed in shim-signed (Ubuntu Focal): | |
| status: | Invalid → Triaged |
| Aleksander Miera (amiera) wrote | #5 |
| Launchpad Janitor (janitor) wrote | #6 |
| Changed in shim-signed (Ubuntu Focal): | |
| status: | Triaged → Fix Released |
| tags: | added: id-5e86040cabc56e279d442ddb |
| Launchpad Janitor (janitor) wrote | #7 |
| Changed in mokutil (Ubuntu Focal): | |
| status: | New → Confirmed |
| Changed in mokutil (Ubuntu): | |
| status: | New → Confirmed |
| Changed in shim-signed (Ubuntu Bionic): | |
| importance: | Undecided → High |
| Changed in shim-signed (Ubuntu Eoan): | |
| importance: | Undecided → High |
| Changed in mokutil (Ubuntu Eoan): | |
| status: | New → Won't Fix |
| Changed in shim-signed (Ubuntu Eoan): | |
| status: | New → Won't Fix |
| Changed in shim-signed (Ubuntu Bionic): | |
| assignee: | nobody → Matthieu Clemenceau (mclemenceau) |
| description: | updated |
| description: | updated |
| Łukasz Zemczak (sil2100) wrote Please test proposed package | #9 |
| Changed in shim-signed (Ubuntu Bionic): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed verification-needed-bionic |
| Matthieu Clemenceau (mclemenceau) wrote | #10 |
| tags: |
added: verification-done verification-done-bionic removed: verification-needed verification-needed-bionic |
| Launchpad Janitor (janitor) wrote | #11 |
| Changed in shim-signed (Ubuntu Bionic): | |
| status: | Fix Committed → Fix Released |
| Steve Langasek (vorlon) wrote Update Released | #12 |
| Julian Andres Klode (juliank) wrote | #13 |
| Changed in shim-signed (Ubuntu Groovy): | |
| status: | Fix Released → Triaged |
| Changed in shim-signed (Ubuntu Groovy): | |
| status: | Triaged → Fix Committed |
| Launchpad Janitor (janitor) wrote | #14 |
| Changed in shim-signed (Ubuntu Groovy): | |
| status: | Fix Committed → Fix Released |
| Brian Murray (brian-murray) wrote | #15 |
| Changed in mokutil (Ubuntu Groovy): | |
| status: | Confirmed → Won't Fix |
Ok, I have analyzed mokutil's src code and from what I understood, timeout has to be a single parameter. Of course, it can be changed there, but calling it several times in a row should do not harm either.
Splitting its invocation in two seems to fix the problem; the bug can be reassigned to shim-signed if needed, as the the patch actually modifies that package.