This bug was fixed in the package shim-signed - 1.32~17.04.1
---------------
shim-signed (1.32~17.04.1) zesty; urgency=medium
* Backport shim-signed 1.32 to 17.04. (LP: #1700170)
shim-signed (1.32) artful; urgency=medium
* Handle cleanup of /var/lib/shim-signed on package purge.
shim-signed (1.31) artful; urgency=medium
* Fix regression in postinst when /var/lib/dkms does not exist.
(LP#1700195)
* Sort the list of dkms modules when recording.
shim-signed (1.30) artful; urgency=medium
* update-secureboot-policy: track the installed DKMS modules so we can skip
failing unattended upgrades if they hasn't changed (ie. if no new DKMS
modules have been installed, just honour the user's previous decision to
not disable shim validation). (LP: #1695578)
* update-secureboot-policy: allow re-enabling shim validation when no DKMS
packages are installed. (LP: #1673904)
* debian/source_shim-signed.py: add the textual representation of SecureBoot
and MokSBStateRT EFI variables rather than just adding the files directly;
also, make sure we include the relevant EFI bits from kernel log.
(LP: #1680279)
shim-signed (1.29) artful; urgency=medium
* Makefile: Generate BOOT$arch.CSV, for use with fallback.
* debian/rules: make sure we can do per-arch EFI files.
-- Mathieu Trudel-Lapierre <[email protected]> Mon, 10 Jul 2017
17:10:08 -0400
** Changed in: shim-signed (Ubuntu Zesty)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1673904
Title:
update-secureboot-policy --enable does not work after dkms modules
removed
Status in shim-signed package in Ubuntu:
Fix Released
Status in shim-signed source package in Trusty:
Fix Committed
Status in shim-signed source package in Xenial:
Fix Released
Status in shim-signed source package in Yakkety:
Fix Committed
Status in shim-signed source package in Zesty:
Fix Released
Bug description:
[Impact]
Re-enabling Secure Boot after DKMS packages are no longer needed is useful to
benefit from the extra security afforded by having all bits of the bootloader
and kernel signed by a proper key.
[Test Case]
(on a system with SHIM validation disabled)
1- Remove all dkms modules
2- Attempt to run 'sudo update-secureboot-policy --enable'
3- Observe the behavior.
With the fixed update-secureboot-policy script, you should be prompted
to re-enable shim validation; which is otherwise skipped with no
output with previous versions of the script in shim-signed.
[Regression Potential]
Possible regression from this update would be changes to expected behavior of
the update-secureboot-policy script; such as being unable to correctly
recognize the current state of Secure Boot and shim validation, or incorrectly
returning before prompting for the password required to toggle shim validation
when the shim validation state make sense to be changed (ie. prompting to
enable when it is disabled only, prompting to disable only if it's currently
enabled). Any change in proper prompting in a debconf non-interactive context
could also be a regression from this update.
---
If I have disabled secureboot on my system via update-secureboot-
policy due to the presence of dkms modules, but subsequently remove
these dkms modules because I decide I don't like not having
secureboot, I cannot re-enable SB by running 'update-secureboot-policy
--enable'.
I think either the check for /var/lib/dkms should only apply when
update-secureboot-policy is called without arguments, or this check
should be encoded in the shim-signed postinst so that manual calls
from the commandline DWIM.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1673904/+subscriptions
_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : [email protected]
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help : https://help.launchpad.net/ListHelp
