Ubuntu
linux package

  1. Xenial (16.04)
  2. Bug #1932029
  3. Comment #0

Comment 0 for bug 1932029

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Upstream linux kernel now supports configuring built-in revoked certificates for the .blacklist keyring.

Add support in our kernel configuration to have built-in certificates.

Revoke UEFI amd64 & arm64 2012 signing certificate.

Under UEFI Secureboot with lockdown, shim may attempt to pass revoked certificates to the kernel and depending on how good EFI firmware is this may or may not succeed.

By having these built-in, it will be prohibited to kexec file_load older kernels that were signed with now revoked certificates.