Updated bug statuses for Zesty; as well as the statuses for the shim
binary copies to all the releases which is part of this SRU.

** Changed in: shim (Ubuntu)
       Status: New => Fix Released

** Changed in: shim (Ubuntu Xenial)
       Status: New => Fix Committed

** Changed in: shim (Ubuntu Zesty)
       Status: New => Won't Fix

** Changed in: shim (Ubuntu Artful)
       Status: New => Fix Committed

** Changed in: grub2 (Ubuntu Zesty)
       Status: New => Won't Fix

** Changed in: grub2-signed (Ubuntu Zesty)
       Status: New => Won't Fix

** Changed in: shim-signed (Ubuntu Zesty)
       Status: New => Won't Fix

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1708245

Title:
  shim can't enable validation and enroll keys in one sitting

Status in grub2 package in Ubuntu:
  Fix Released
Status in grub2-signed package in Ubuntu:
  Fix Released
Status in shim package in Ubuntu:
  Fix Released
Status in shim-signed package in Ubuntu:
  Fix Released
Status in grub2 source package in Xenial:
  Fix Committed
Status in grub2-signed source package in Xenial:
  Fix Committed
Status in shim source package in Xenial:
  Fix Committed
Status in shim-signed source package in Xenial:
  Fix Committed
Status in grub2 source package in Zesty:
  Won't Fix
Status in grub2-signed source package in Zesty:
  Won't Fix
Status in shim source package in Zesty:
  Won't Fix
Status in shim-signed source package in Zesty:
  Won't Fix
Status in grub2 source package in Artful:
  Fix Committed
Status in grub2-signed source package in Artful:
  Fix Committed
Status in shim source package in Artful:
  Fix Committed
Status in shim-signed source package in Artful:
  Fix Committed

Bug description:
  [Impact]

  
  [Test cases]
  First, update shim to the newest version.

  = Boot test =
  1) Reboot.
  2) Validate that the system boots correctly in UEFI mode.

  
  = Key enrollment =
  1) Create a new x.509 certificate to import into MOK.
  2) Run 'mokutil --import cert.der'
  3) Reboot
  4) Execute the steps described on screen to enroll the new key.

  
  = Toggling validation =
  1) Run 'mokutil --disable-validation'
  2) Reboot.
  3) Follow the steps on screen to toggle validation.
  4) Boot to the system, validate that validation is disabled:
  $ sudo hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The output should read the last byte as a 1.

  5) Run 'mokutil --enable-validation'
  6) Reboot.
  7) Follow the steps on screen to toggle validation.
  8) Boot to the system, validate that validation is enabled again:
  $ hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The file should not exist.

  
  = Toggling validation and enrolling =
  1) Disable validation, as above, and reboot into the system.
  2) Create a new x.509 certificate to import into MOK.
  3) Run 'mokutil --import cert.der'
  4) Run 'mokutil --enable-validation'
  5) Reboot.
  6) Follow the steps on screen to proceed through toggling validation in shim.
  Once that step is done, you should be returned to the MokManager menu to 
complete further steps.
  7) Follow the steps on screen to enroll the new key.
  Once completed, you should have the option at the bottom of the menu to 
Reboot.
  8) Reboot into the system.
  9) Validate that MOK validation is enabled and the new key is enrolled:

  Run:

  $ sudo hexdump -Cv /sys/firmware/efi/efivars/MokSBStateRT-*

  The file should not exist.

  Then run:
  $ sudo cat /proc/keys

  And make sure the key you enrolled is present.

  
  [Regression potential]
  Failure to boot or validate validly signed EFI binaries (bootloader) might be 
possible regressions. The shim update modifies the enrollment process for new 
keys, and as such it might also be possible for the enrollment of a new key to 
fail in MokManager, rendering the validation process unstable: it may fail to 
validate validly signed EFI binaries signed by keys already present in the 
database or that were to be enrolled.

  
  ---

  We want to enable validation and enroll a new key in shim all at the
  same time on upgrade from previous releases.

  Curently, shim will wipe out all pending variables when it's done
  processing one of them (because it wants to reboot immediately after
  that action). That means if we re-enable validation, we lose the
  request to enroll the key, and vice-versa.

  This needs fixing as it would otherwise badly impact upgrades from
  zesty and earlier; where we might have walked users through disabling
  validation.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1708245/+subscriptions

_______________________________________________
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to     : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help   : https://help.launchpad.net/ListHelp

Reply via email to