Add final-checks to check certificates
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Hirsute |
Fix Released
|
Undecided
|
Unassigned | ||
Impish |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
* As part of landing builtin revocation certificates work https:/
* As part fips validation work final-checks got added to check and assert that correct things are turned on.
* It has been agreed that having a final-check for builtin system trusted & revocation certificates would be a good thing. If packaging declares that certain certificates should be built-in trusted or revoked, the kernel must be configured pointing at the packaging generated .pem bundle in the config.
[Test Plan]
* Kernel should build
* If trusted or revocation are configured in packaging but the config option is misconfigured (i.e. typo or not set), the kernel build and cranky close should fail
[Where problems could occur]
* This is a packaging change only, thus may result in valid kernels ftbfs but should be easy to rectify.
[Other Info]
* Also see
https:/
and kernels that derived from a primary kernel that had that fixed, and the subsequently failed boot testing due to not enabling those options.
CVE References
Changed in linux (Ubuntu Impish): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Hirsute): | |
status: | New → In Progress |
Changed in linux (Ubuntu Focal): | |
status: | New → In Progress |
Changed in linux (Ubuntu Bionic): | |
status: | New → In Progress |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Focal): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Hirsute): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Impish): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu): | |
status: | Fix Committed → Fix Released |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1947174
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.