2023-05-09 20:53:33 |
Luca Boccassi |
bug |
|
|
added bug |
2023-05-11 12:14:26 |
Luca Boccassi |
summary |
linux-kvm: please enable dm-verity kconfigs |
linux-*: please enable dm-verity kconfigs to allow MoK/db verified root images |
|
2023-05-11 12:15:59 |
Luca Boccassi |
bug task added |
|
linux-meta-azure (Ubuntu) |
|
2023-05-11 12:36:22 |
Christian Ehrhardt |
bug task added |
|
linux (Ubuntu) |
|
2023-05-11 13:00:05 |
Ubuntu Kernel Bot |
linux (Ubuntu): status |
New |
Incomplete |
|
2023-05-11 13:29:39 |
Luca Boccassi |
linux (Ubuntu): status |
Incomplete |
Confirmed |
|
2023-05-11 13:34:02 |
Tim Gardner |
linux-meta-azure (Ubuntu): status |
New |
Invalid |
|
2023-05-11 13:34:07 |
Tim Gardner |
linux-meta-kvm (Ubuntu): status |
New |
Invalid |
|
2023-05-11 13:34:27 |
Tim Gardner |
linux (Ubuntu): importance |
Undecided |
Medium |
|
2023-05-11 13:34:27 |
Tim Gardner |
linux (Ubuntu): status |
Confirmed |
In Progress |
|
2023-05-11 13:34:27 |
Tim Gardner |
linux (Ubuntu): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 13:34:44 |
Tim Gardner |
nominated for series |
|
Ubuntu Mantic |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux (Ubuntu Mantic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-azure (Ubuntu Mantic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-kvm (Ubuntu Mantic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
nominated for series |
|
Ubuntu Lunar |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux (Ubuntu Lunar) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-azure (Ubuntu Lunar) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-kvm (Ubuntu Lunar) |
|
2023-05-11 13:34:44 |
Tim Gardner |
nominated for series |
|
Ubuntu Kinetic |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux (Ubuntu Kinetic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-azure (Ubuntu Kinetic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-kvm (Ubuntu Kinetic) |
|
2023-05-11 13:34:44 |
Tim Gardner |
nominated for series |
|
Ubuntu Jammy |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux (Ubuntu Jammy) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-azure (Ubuntu Jammy) |
|
2023-05-11 13:34:44 |
Tim Gardner |
bug task added |
|
linux-meta-kvm (Ubuntu Jammy) |
|
2023-05-11 13:35:05 |
Tim Gardner |
linux (Ubuntu Jammy): importance |
Undecided |
Medium |
|
2023-05-11 13:35:05 |
Tim Gardner |
linux (Ubuntu Jammy): status |
New |
In Progress |
|
2023-05-11 13:35:05 |
Tim Gardner |
linux (Ubuntu Jammy): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 13:35:19 |
Tim Gardner |
linux (Ubuntu Kinetic): importance |
Undecided |
Medium |
|
2023-05-11 13:35:19 |
Tim Gardner |
linux (Ubuntu Kinetic): status |
New |
In Progress |
|
2023-05-11 13:35:19 |
Tim Gardner |
linux (Ubuntu Kinetic): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 13:35:35 |
Tim Gardner |
linux (Ubuntu Lunar): importance |
Undecided |
Medium |
|
2023-05-11 13:35:35 |
Tim Gardner |
linux (Ubuntu Lunar): status |
New |
In Progress |
|
2023-05-11 13:35:35 |
Tim Gardner |
linux (Ubuntu Lunar): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 13:37:35 |
Tim Gardner |
description |
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel. |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
[Regression Potential]
MOK keys may not be correctly read. |
|
2023-05-11 18:34:33 |
Tim Gardner |
bug task added |
|
linux-kvm (Ubuntu) |
|
2023-05-11 18:34:57 |
Tim Gardner |
linux-kvm (Ubuntu Jammy): importance |
Undecided |
Medium |
|
2023-05-11 18:34:57 |
Tim Gardner |
linux-kvm (Ubuntu Jammy): status |
New |
In Progress |
|
2023-05-11 18:34:57 |
Tim Gardner |
linux-kvm (Ubuntu Jammy): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 18:35:11 |
Tim Gardner |
linux-kvm (Ubuntu Kinetic): importance |
Undecided |
Medium |
|
2023-05-11 18:35:11 |
Tim Gardner |
linux-kvm (Ubuntu Kinetic): status |
New |
In Progress |
|
2023-05-11 18:35:11 |
Tim Gardner |
linux-kvm (Ubuntu Kinetic): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 18:35:28 |
Tim Gardner |
linux-kvm (Ubuntu Lunar): importance |
Undecided |
Medium |
|
2023-05-11 18:35:28 |
Tim Gardner |
linux-kvm (Ubuntu Lunar): status |
New |
In Progress |
|
2023-05-11 18:35:28 |
Tim Gardner |
linux-kvm (Ubuntu Lunar): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 18:35:42 |
Tim Gardner |
linux-kvm (Ubuntu Mantic): importance |
Undecided |
Medium |
|
2023-05-11 18:35:42 |
Tim Gardner |
linux-kvm (Ubuntu Mantic): status |
New |
In Progress |
|
2023-05-11 18:35:42 |
Tim Gardner |
linux-kvm (Ubuntu Mantic): assignee |
|
Tim Gardner (timg-tpi) |
|
2023-05-11 18:35:55 |
Tim Gardner |
linux-meta-azure (Ubuntu Jammy): status |
New |
Invalid |
|
2023-05-11 18:36:15 |
Tim Gardner |
linux-meta-azure (Ubuntu Kinetic): status |
New |
Invalid |
|
2023-06-15 08:40:33 |
Stefan Bader |
linux (Ubuntu Lunar): status |
In Progress |
Fix Committed |
|
2023-06-15 08:40:42 |
Stefan Bader |
linux (Ubuntu Kinetic): status |
In Progress |
Fix Committed |
|
2023-06-15 08:41:53 |
Stefan Bader |
linux (Ubuntu Jammy): status |
In Progress |
Fix Committed |
|
2023-06-19 13:06:49 |
Ubuntu Kernel Bot |
tags |
|
kernel-spammed-jammy-linux verification-needed-jammy |
|
2023-06-19 13:21:04 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux verification-needed-jammy |
kernel-spammed-jammy-linux kernel-spammed-lunar-linux verification-needed-jammy verification-needed-lunar |
|
2023-06-22 14:00:59 |
Luca Boccassi |
tags |
kernel-spammed-jammy-linux kernel-spammed-lunar-linux verification-needed-jammy verification-needed-lunar |
kernel-spammed-jammy-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-lunar |
|
2023-07-08 00:02:02 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-lunar |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-lunar verification-needed-kinetic |
|
2023-07-08 00:21:13 |
Luca Boccassi |
tags |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-lunar verification-needed-kinetic |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-kinetic verification-done-lunar |
|
2023-07-11 22:23:49 |
Launchpad Janitor |
linux (Ubuntu Lunar): status |
Fix Committed |
Fix Released |
|
2023-07-11 22:23:49 |
Launchpad Janitor |
cve linked |
|
2023-2124 |
|
2023-07-11 22:23:49 |
Launchpad Janitor |
cve linked |
|
2023-2176 |
|
2023-07-11 22:24:29 |
Launchpad Janitor |
linux-kvm (Ubuntu Lunar): status |
In Progress |
Fix Released |
|
2023-07-17 10:43:18 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux verification-done-jammy verification-done-kinetic verification-done-lunar |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
|
2023-07-19 13:14:57 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
|
2023-07-19 13:28:22 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-needed-jammy verification-needed-lunar |
|
2023-07-31 07:43:25 |
Stefan Bader |
tags |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-needed-jammy verification-needed-lunar |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
|
2023-07-31 07:43:57 |
Stefan Bader |
tags |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-needed-lunar |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-done-lunar |
|
2023-08-08 16:00:53 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-jammy verification-done-kinetic verification-done-lunar |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-jammy |
|
2023-08-08 16:01:42 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-jammy |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy |
|
2023-08-08 16:01:44 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy |
|
2023-08-10 12:48:26 |
Luca Boccassi |
description |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
[Regression Potential]
MOK keys may not be correctly read. |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
|
2023-08-10 12:51:17 |
Luca Boccassi |
description |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_INTEGRITY_MACHINE_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
|
2023-08-10 12:57:31 |
Luca Boccassi |
description |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_INTEGRITY_MACHINE_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter is needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_INTEGRITY_MACHINE_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter two are needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
|
2023-08-10 12:58:09 |
Luca Boccassi |
description |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_INTEGRITY_MACHINE_KEYRING
CONFIG_IMA_ARCH_POLICY
(The latter two are needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
SRU Justification
[Impact]
The kvm flavours currently do not enable dm-verity. This stops us from using integrity protected and verified images in VMs using this kernel flavour.
[Fix]
Please consider enabling the following kconfigs:
CONFIG_DM_VERITY
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING
CONFIG_INTEGRITY_MACHINE_KEYRING
CONFIG_IMA_ARCH_POLICY (this might not be necessary if the machine keyring implementation is patched to skip the check enabled by this kconfig)
(The latter two are needed to ensure that MoK keys can be used to verify dm-verity images too, via the machine keyring linked to the secondary keyring)
These are already enabled in the 'main' kernel config, and in other distros.
As a specific and explicit use case, in the systemd project we want to test functionality provided by systemd that needs these kconfigs on Ubuntu machines running the kvm flavour kernel.
To verify whether this works, add a certificate to MOK, boot and check the content of the secondary keyring. The machine keyring should show up under it, and it should show the certificates loaded in MOK. E.g.:
$ sudo keyctl show %:.secondary_trusted_keys
Keyring
159454604 ---lswrv 0 0 keyring: .secondary_trusted_keys
88754641 ---lswrv 0 0 \_ keyring: .builtin_trusted_keys
889010778 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
799434660 ---lswrv 0 0 | \_ asymmetric: Debian Secure Boot Signer 2022 - linux: 14011249c2675ea8e5148542202005810584b25f
541326986 ---lswrv 0 0 \_ keyring: .machine
188508854 ---lswrv 0 0 \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
475039424 ---lswrv 0 0 \_ asymmetric: sb-bluca: Secure Boot Signing: 9a61c52d07d78a76935e67bdbe3f5e6968d62479
[Regression Potential]
MOK keys may not be correctly read. |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
linux (Ubuntu Jammy): status |
Fix Committed |
Fix Released |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2022-48502 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-0597 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-3090 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-31248 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-3141 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-3389 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-3390 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-3439 |
|
2023-08-14 06:47:41 |
Launchpad Janitor |
cve linked |
|
2023-35001 |
|
2023-08-14 20:11:13 |
Launchpad Janitor |
linux-kvm (Ubuntu Jammy): status |
In Progress |
Fix Released |
|
2023-08-22 18:57:07 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy verification-needed-jammy-linux-aws |
|
2023-08-26 20:11:58 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy verification-needed-jammy-linux-aws |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy verification-needed-jammy-linux-aws verification-needed-jammy-linux-azure |
|
2023-08-26 20:33:47 |
Luca Boccassi |
tags |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal verification-needed-jammy verification-needed-jammy-linux-aws verification-needed-jammy-linux-azure |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar |
|
2023-09-09 14:18:22 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar |
kernel-spammed-focal-linux-aws-5.15-v2 kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal-linux-aws-5.15 |
|
2023-09-09 14:29:28 |
Luca Boccassi |
tags |
kernel-spammed-focal-linux-aws-5.15-v2 kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-focal-linux-aws-5.15 |
kernel-spammed-focal-linux-aws-5.15-v2 kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar |
|
2023-10-03 20:41:56 |
Ubuntu Kernel Bot |
tags |
kernel-spammed-focal-linux-aws-5.15-v2 kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar |
kernel-spammed-focal-linux-aws-5.15-v2 kernel-spammed-focal-linux-nvidia-tegra-5.15 kernel-spammed-jammy-linux kernel-spammed-jammy-linux-aws-v2 kernel-spammed-jammy-linux-azure-v2 kernel-spammed-jammy-linux-hwe-6.2 kernel-spammed-jammy-linux-nvidia-tegra kernel-spammed-jammy-linux-nvidia-tegra-igx kernel-spammed-jammy-linux-xilinx-zynqmp-v2 kernel-spammed-kinetic-linux kernel-spammed-lunar-linux kernel-spammed-lunar-linux-azure kernel-spammed-lunar-linux-riscv verification-done-kinetic verification-done-lunar verification-needed-jammy-linux-xilinx-zynqmp |
|
2023-10-04 10:04:49 |
Stefan Bader |
linux (Ubuntu Mantic): status |
In Progress |
Fix Committed |
|
2023-10-04 10:05:02 |
Stefan Bader |
linux-kvm (Ubuntu Mantic): status |
In Progress |
Invalid |
|