[Bug 1013012] Re: regression with sendmail and Android clients

2022-05-23 Thread Kees Cook
No current issues with modern android and modern ubuntu

** Changed in: openssl (Ubuntu)
   Status: Incomplete => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1013012

Title:
  regression with sendmail and Android clients

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1013012/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1972043] Re: Please add -ftrivial-auto-var-init=zero to default build flags

2022-05-12 Thread Kees Cook
Adding it to the compiler means *all* builds benefit, which is the
reason this was done on the other options. People build their local
projects, newer versions of tools from GitHub, etc etc.

This needs to be in the compiler directly.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1972043

Title:
  Please add -ftrivial-auto-var-init=zero to default build flags

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1972043/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1972043] Re: Please add -ftrivial-auto-var-init=zero to default build flags

2022-05-07 Thread Kees Cook
Yes, -Wuninitialized continues to warn, even if they were auto-
initialized.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1972043

Title:
  Please add -ftrivial-auto-var-init=zero to default build flags

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-12/+bug/1972043/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1972043] [NEW] Please add -ftrivial-auto-var-init=zero to default build flags

2022-05-06 Thread Kees Cook
Public bug reported:

Please add "-ftrivial-auto-var-init=zero" for GCC 12 (which is the first
release of GCC to provide this flag).

It goes well with the other important security flaw mitigation flags already 
enabled in Ubuntu for GCC:
https://wiki.ubuntu.com/ToolChain/CompilerFlags

While many variables are initialized (due to -Wuninitialized), there is
a blind spot for variables passed by reference, padding, and cases where
-Wuninitialized just fails to track it. Universally wiping the variables
eliminates nearly the entire class of uninitialized stack variable use
(https://cwe.mitre.org/data/definitions/457.html) with nearly no
overhead (e.g. any duplicate assignments will already be squashed during
dead store elimination, etc).

** Affects: gcc-12 (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1972043

Title:
  Please add -ftrivial-auto-var-init=zero to default build flags

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-12/+bug/1972043/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1814012] Re: netplan type wifis needs a device option

2021-10-12 Thread Kees Cook
See https://github.com/canonical/netplan/pull/240

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1814012

Title:
  netplan type wifis needs a device option

To manage notifications about this bug go to:
https://bugs.launchpad.net/netplan/+bug/1814012/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1814012] Re: netplan type wifis needs a device option

2021-10-12 Thread Kees Cook
For example, fallback (-Dnl80211,wext) is used for the wpa_supplicant systemd 
service:

https://salsa.debian.org/debian/wpa/-/blob/debian/unstable/debian/patches/networkd-
driver-fallback.patch

But it isn't present in the netplan networkd renderer.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1814012

Title:
  netplan type wifis needs a device option

To manage notifications about this bug go to:
https://bugs.launchpad.net/netplan/+bug/1814012/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1814012] Re: netplan type wifis needs a device option

2021-10-12 Thread Kees Cook
> What is the range of possible values for this -D option, and why would
you ever want to specify it in the netplan yaml instead of inferring it?

It would be best if wpa_supplicant selected the correct driver, but it
seems it doesn't do a good job with this. It does support fallbacks,
though, which seems like a reasonable default behavior for
wpa_supplicant ("-Dnl80211,wext"), but sometimes different drivers have
different behaviors/abilities, so explicitly choosing one is useful.

I see two issues:
- wpa_supplicant makes no attempt to automatically pick a working driver
- netplan doesn't have a way to choose a driver if wpa_supplicant's default 
(nl80211) doesn't work

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1814012

Title:
  netplan type wifis needs a device option

To manage notifications about this bug go to:
https://bugs.launchpad.net/netplan/+bug/1814012/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1943049] Re: Docker ubuntu:impish: Problem executing scripts DPkg::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'

2021-09-09 Thread Kees Cook
Host dockers need this:
https://github.com/moby/moby/pull/42681

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1943049

Title:
  Docker ubuntu:impish: Problem executing scripts DPkg::Post-Invoke 'rm
  -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb
  /var/cache/apt/*.bin || true'

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/1943049/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1943049] Re: Docker ubuntu:impish: Problem executing scripts DPkg::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'

2021-09-09 Thread Kees Cook
I hit this too. Host is hirsute.

It went so far as blowing up docker itself, with:

runtime/cgo: pthread_create failed: Operation not permitted

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1943049

Title:
  Docker ubuntu:impish: Problem executing scripts DPkg::Post-Invoke 'rm
  -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb
  /var/cache/apt/*.bin || true'

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/1943049/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1360912] Re: ScanTool included on the repos does not connect

2021-07-14 Thread Kees Cook
Version 2.1 works with clones and presents a correct list of ports.
Please open a new bug if problems persist. :)

** Changed in: scantool (Ubuntu)
   Status: Confirmed => Won't Fix

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1360912

Title:
  ScanTool included on the repos does not connect

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/scantool/+bug/1360912/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1914685] Re: Please enable CONFIG_UBSAN_BOUNDS

2021-02-04 Thread Kees Cook
This is a CONFIG request, do no apport collection required. :)

** Changed in: linux (Ubuntu)
   Status: Incomplete => Confirmed

** Also affects: linux (Ubuntu Groovy)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Hirsute)
   Importance: Undecided
   Status: Confirmed

** Changed in: linux (Ubuntu Groovy)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1914685

Title:
  Please enable CONFIG_UBSAN_BOUNDS

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1914685/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1914685] [NEW] Please enable CONFIG_UBSAN_BOUNDS

2021-02-04 Thread Kees Cook
Public bug reported:

Enabling CONFIG_UBSAN_BOUNDS is fast and provides good coverage for out-
of-bounds array indexing (i.e. it catchings the things that
CONFIG_FORTIFY doesn't).

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1914685

Title:
  Please enable CONFIG_UBSAN_BOUNDS

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1914685/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] Re: grub2 fails to install/probe into md device when drives have moved around

2021-01-16 Thread Kees Cook
** Summary changed:

- grub2 fails to install/probe into md device with first drive not active (i.e. 
hot spare)
+ grub2 fails to install/probe into md device when drives have moved around

** Description changed:

  grub2 appears to _sometimes_ ignore md devices with a hot spare:
  
  $ cat /proc/mdstat
- Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] 
[raid10] 
- md5 : active raid1 sda2[2](S) sdb2[3] sde2[4]
-   2925939136 blocks super 1.2 [2/2] [UU]
-   bitmap: 2/22 pages [8KB], 65536KB chunk
+ Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] 
[raid10]
+ md5 : active raid1 sda2[0](S) sdb2[1] sde2[2]
+   2925939136 blocks super 1.2 [2/2] [UU]
+   bitmap: 2/22 pages [8KB], 65536KB chunk
  
  md6 : active raid1 sdf2[0] sdd2[2](S) sdk2[1]
-   3902691136 blocks super 1.2 [2/2] [UU]
-   bitmap: 1/30 pages [4KB], 65536KB chunk
+   3902691136 blocks super 1.2 [2/2] [UU]
+   bitmap: 1/30 pages [4KB], 65536KB chunk
  
  unused devices: 
  
  $ sudo grub-probe -vvv / 2>&1 | grep -E 'info: Inserting md/|error'
  grub-probe: info: Inserting md/6 (+0,7805382272) into systemvg (lvm)
  grub-probe: error: disk 
`lvmid/5R9E1M-V0xL-pEsR-74zV-3oOm-JorM-hb2Erw/WHUtMx-lZcd-2RmH-WVSk-Z0Et-qiqS-hFBd4u'
 not found.
  
  If I remove the hotspare from md5, everything works normally and I can
- install grub again. But md6 has a spare too... ?!
+ install grub again.
+ 
+ And if devices have moved around enough internally that the internal
+ index doesn't match the max count any more, they also become invisible
+ to grub. For example:
+ 
+ $ cat /proc/mdstat
+ Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] 
[raid10]
+ md5 : active raid1 sdb2[3] sde2[4]
+   2925939136 blocks super 1.2 [2/2] [UU]
+   bitmap: 2/22 pages [8KB], 65536KB chunk
+ 
+ Note the "[3]" and "[4]". Unlike mdadm, grub was not checking beyond the
+ array size. This needs fixing as well.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device when drives have moved
  around

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] Re: grub2 fails to install/probe into md device with first drive not active (i.e. hot spare)

2021-01-16 Thread Kees Cook
Also need to fix the indexing.

** Patch added: "fix-md-array-enumeration.patch"
   
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+attachment/5453745/+files/fix-md-array-enumeration.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device when drives have moved
  around

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] Re: grub2 fails to install/probe into md device with first drive not active (i.e. hot spare)

2021-01-16 Thread Kees Cook
https://savannah.gnu.org/bugs/index.php?59887

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device with first drive not
  active (i.e. hot spare)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] Re: grub2 fails to install/probe into md device with first drive not active (i.e. hot spare)

2021-01-16 Thread Kees Cook
** Patch added: "fix-md-array-list-truncation.patch"
   
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+attachment/5453655/+files/fix-md-array-list-truncation.patch

** Bug watch added: GNU Savannah Bug Tracker #59887
   http://savannah.gnu.org/bugs/?59887

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device with first drive not
  active (i.e. hot spare)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] Re: grub2 fails to install/probe into md device with first drive not active (i.e. hot spare)

2021-01-16 Thread Kees Cook
** Summary changed:

- grub2 fails to install/probe into md device with hot spare
+ grub2 fails to install/probe into md device with first drive not active (i.e. 
hot spare)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device with first drive not
  active (i.e. hot spare)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1912043] [NEW] grub2 fails to install/probe into md device with hot spare

2021-01-16 Thread Kees Cook
Public bug reported:

grub2 appears to _sometimes_ ignore md devices with a hot spare:

$ cat /proc/mdstat
Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] 
[raid10] 
md5 : active raid1 sda2[2](S) sdb2[3] sde2[4]
  2925939136 blocks super 1.2 [2/2] [UU]
  bitmap: 2/22 pages [8KB], 65536KB chunk

md6 : active raid1 sdf2[0] sdd2[2](S) sdk2[1]
  3902691136 blocks super 1.2 [2/2] [UU]
  bitmap: 1/30 pages [4KB], 65536KB chunk

unused devices: 

$ sudo grub-probe -vvv / 2>&1 | grep -E 'info: Inserting md/|error'
grub-probe: info: Inserting md/6 (+0,7805382272) into systemvg (lvm)
grub-probe: error: disk 
`lvmid/5R9E1M-V0xL-pEsR-74zV-3oOm-JorM-hb2Erw/WHUtMx-lZcd-2RmH-WVSk-Z0Et-qiqS-hFBd4u'
 not found.

If I remove the hotspare from md5, everything works normally and I can
install grub again. But md6 has a spare too... ?!

** Affects: grub2 (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1912043

Title:
  grub2 fails to install/probe into md device with hot spare

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1475337] Re: grub-probe can't probe large logical volumes (LVM)

2021-01-15 Thread Kees Cook
This particular problem appears fixed is latest grub2, though I'm seeing
a similar failure, which may need a new bug report.

** Also affects: grub2 (Ubuntu Precise)
   Importance: Undecided
   Status: New

** Changed in: grub2 (Ubuntu)
   Status: New => Fix Released

** Bug watch added: GNU Savannah Bug Tracker #45562
   http://savannah.gnu.org/bugs/?45562

** Also affects: grub via
   http://savannah.gnu.org/bugs/?45562
   Importance: Unknown
   Status: Unknown

** Changed in: grub2 (Ubuntu Precise)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1475337

Title:
  grub-probe can't probe large logical volumes (LVM)

To manage notifications about this bug go to:
https://bugs.launchpad.net/grub/+bug/1475337/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1027363] Re: grub-install fails with "out of disk" error

2021-01-15 Thread Kees Cook
*** This bug is a duplicate of bug 1475337 ***
https://bugs.launchpad.net/bugs/1475337

** This bug has been marked a duplicate of bug 1475337
   grub-probe can't probe large logical volumes (LVM)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1027363

Title:
  grub-install fails with "out of disk" error

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1027363/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1466150] Re: grub-install breaks when ESP is on raid

2020-11-29 Thread Kees Cook
(This may have only been present on older firmware versions, though, as
I no longer see the behavior on a newer T30.)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1466150

Title:
  grub-install breaks when ESP is on raid

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub-installer/+bug/1466150/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1466150] Re: grub-install breaks when ESP is on raid

2020-11-29 Thread Kees Cook
https://outflux.net/blog/archives/2018/04/19/uefi-booting-and-raid1/

The UEFI on the Dell T30 I was testing on would write a "boot variable
cache" file to the ESP. :(

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1466150

Title:
  grub-install breaks when ESP is on raid

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub-installer/+bug/1466150/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1466150] Re: grub-install breaks when ESP is on raid

2020-11-29 Thread Kees Cook
The only reference I could find was
https://github.com/tianocore/tianocore.github.io/wiki/UEFI-Variable-
Runtime-Cache which hints at a "device storage" for variables...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1466150

Title:
  grub-install breaks when ESP is on raid

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub-installer/+bug/1466150/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1905975] Re: kernel: Enable CONFIG_BPF_LSM on Ubuntu

2020-11-27 Thread Kees Cook
(This is a feature request, so no log needed.)

** Changed in: linux (Ubuntu)
   Status: Incomplete => Confirmed

** Also affects: linux (Ubuntu Hirsute)
   Importance: Undecided
   Status: Confirmed

** Also affects: linux (Ubuntu Groovy)
   Importance: Undecided
   Status: New

** Changed in: linux (Ubuntu Groovy)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1905975

Title:
  kernel: Enable CONFIG_BPF_LSM on Ubuntu

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1905975/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1892526] Re: dpkg-reconfigure grub-pc no longer prompts for grub-pc/install_devices

2020-11-04 Thread Kees Cook
I can confirm this fixes the issue on Bionic on amd64. Thanks for the
SRU!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1892526

Title:
  dpkg-reconfigure grub-pc no longer prompts for grub-pc/install_devices

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1892526/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 386558]

2020-07-28 Thread Kees Cook
commit a0f33f996f7986dbf37631a4577f8565b42df29e
Author: Ulrich Drepper 
Date:   Thu Sep 8 19:48:47 2011 -0400

Add range checking for FD_SET, FD_CLR, and FD_ISSET

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/386558

Title:
  RLIMIT_NOFILE > FD_SETSIZE seems to cause select() to corrupt the
  stack

To manage notifications about this bug go to:
https://bugs.launchpad.net/glibc/+bug/386558/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1880250] [NEW] disk check progress no longer visible

2020-05-22 Thread Kees Cook
Public bug reported:

It seems the transition to bgrt lost something with Ubuntu's disk check
details. The only thing I see on my screen during a long disk check is
the "press Ctrl-C to stop all in progress disk checks" with no progress.

** Affects: plymouth (Ubuntu)
 Importance: Undecided
 Status: New


** Tags: champagne rls-ff-incoming rls-gg-incoming

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1880250

Title:
  disk check progress no longer visible

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/plymouth/+bug/1880250/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773859] Re: upgrades to 18.04 fail

2019-09-30 Thread Kees Cook
Hmm, I don't have any systems left with systemd-shim installed, so I
can't do a "real world" test of this. The test case is the description
seems reasonable, so if that passes, I would consider this bug fixed. :)
Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773859

Title:
  upgrades to 18.04 fail

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1773859/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1767172] Re: Regression: /etc/modules checked against blacklist or it's really hard to load blacklisted watchdog modules when one really wants one

2019-05-20 Thread Kees Cook
I think it's fine. It sounds like there will just be no way to override
package-installed blacklists any more. That's unfortunate, but it's a
very rare situation.

** Changed in: systemd (Ubuntu)
   Status: Incomplete => Won't Fix

** Changed in: linux (Ubuntu)
   Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1767172

Title:
  Regression: /etc/modules checked against blacklist or it's really hard
  to load blacklisted watchdog modules when one really wants one

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1767172/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 305901]

2019-02-22 Thread Kees Cook
So I'd like to bring this back up and reiterate the issue: there is no
benefit to the early truncation, and it actively breaks lots of existing
software (which is why Debian and Ubuntu have had this fix for 10 years
now).

What is the _benefit_ of early truncation that justifies breaking so
many existing cases?

Can glibc please take this patch? http://paste.ubuntu.com/p/CbrxmSfKD4/

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/305901

Title:
  Intrepid gcc -O2 breaks string appending with sprintf(), due to
  fortify source patch

To manage notifications about this bug go to:
https://bugs.launchpad.net/glibc/+bug/305901/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 305901]

2019-02-22 Thread Kees Cook
It's not defined in POSIX, but it has worked a certain way in glibc for
decades. There's no _reason_ to break it for _FORTIFY_SOURCE. Pre-
truncating just silently breaks programs and does weird stuff. If you
want to expose it with _FORITFY_SOURCE then have vsprintf notice that
the target and first format argument are the same variable, and refuse
to build.

Either pretruncation should be eliminated, or the undefined behavior
should be explicitly detected and dealt with. Just having programs lose
data while running with no indication of the cause seems like a terrible
user experience.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/305901

Title:
  Intrepid gcc -O2 breaks string appending with sprintf(), due to
  fortify source patch

To manage notifications about this bug go to:
https://bugs.launchpad.net/glibc/+bug/305901/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 305901]

2019-02-22 Thread Kees Cook
I'd still like to have this patch applied -- while we can claim the
behavior is "undefined", it is not, in fact, undefined. It behaves one
way without -D_FORTIFY_SOURCE=2, and differently with it. And that
difference doesn't need to exist. Ubuntu carried this patch for quite a
while.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/305901

Title:
  Intrepid gcc -O2 breaks string appending with sprintf(), due to
  fortify source patch

To manage notifications about this bug go to:
https://bugs.launchpad.net/glibc/+bug/305901/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1640208] Re: Confusion between "scantool" and "freediag

2019-01-13 Thread Kees Cook
I have no idea how that connection happened. Seems like something
automatic in Launchpad? I've dropped the linkage on the scantool side
now. Weird!

** Changed in: scantool (Ubuntu)
   Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1640208

Title:
  Confusion between "scantool" and "freediag

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/scantool/+bug/1640208/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1771650] Re: openvpn startup script isn't working in ubuntu 18.04

2018-11-27 Thread Kees Cook
It shouldn't be necessary to do explicit "enable" calls to make this
work. The generator _should_ be finding all the .conf files
automatically:

/lib/systemd/system-generators/openvpn-generator

However, it is NOT working for me...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1771650

Title:
  openvpn startup script isn't working in ubuntu 18.04

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-release-notes/+bug/1771650/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1783651] Re: Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
Oh no, leave CONFIG_PAGE_POISONING_NO_SANITY=y. Things get REALLY slow
without that, and the default kernel is built with hibernation, so I
would expect to do =y for that option.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1783651] Re: Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
To clarify, I'm suggesting:

CONFIG_PAGE_POISONING=y
CONFIG_PAGE_POISONING_ZERO=y
CONFIG_PAGE_POISONING_NO_SANITY=y

this should have no impact on regular boots, and if someone boots with
"page_poison=1" then they get page wiping when page_alloc pages are
freed (and then GFP_ZERO is a no-op since it was already freed), so it
becomes a reasonable trade-off on performance vs gaining the wipe-on-
free ability of the buddy allocator.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1783651] [NEW] Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
Public bug reported:

I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING is
not enabled on Ubuntu. (This option itself has a near-zero performance
impact since it must be combined with the boot option "page_poison=1" to
actually enable the poisoning.)

To make the poisoning (when enabled) less of an impact, I'd also like to
see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can be
skipped.

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773859] Re: upgrades to 18.04 fail

2018-06-12 Thread Kees Cook
# dpkg -L systemd-shim
/.
/usr
/usr/lib
/usr/lib/i386-linux-gnu
/usr/lib/i386-linux-gnu/systemd-shim
/usr/lib/i386-linux-gnu/systemd-shim-cgroup-release-agent
/usr/lib/systemd
/usr/lib/systemd/ntp-units.d
/usr/lib/systemd/ntp-units.d/systemd-shim.list
/usr/share
/usr/share/dbus-1
/usr/share/dbus-1/system-services
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service
package diverts others to: 
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd
/usr/share/doc
/usr/share/doc/systemd-shim
/usr/share/doc/systemd-shim/copyright
/usr/share/doc/systemd-shim/changelog.Debian.gz


# cat /var/lib/dpkg/info/systemd-shim.postrm 
#!/bin/sh

set -e

if [ "$1" = remove -o "$1" = purge ]; then
dpkg-divert --package systemd-shim --remove --rename --divert \

/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd \

/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service
fi

# Automatically added by dh_installdeb
dpkg-maintscript-helper rm_conffile 
/etc/dbus-1/system.d/org.freedesktop.systemd-shim.conf 8-4 systemd-shim -- "$@"
# End automatically added section
# Automatically added by dh_installdeb
dpkg-maintscript-helper rm_conffile 
/etc/dbus-1/system.d/org.freedesktop.systemd1.conf 6-2 systemd-shim -- "$@"
# End automatically added section


The error was:

Removing systemd-shim (9-1bzr4ubuntu1) ...
Removing 'diversion of 
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service to 
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd by 
systemd-shim'
dpkg-divert: error: rename involves overwriting 
'/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service' with
  different file 
'/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd', 
not allowed


I have no idea what the dpkg-divert error means there, but I assume there's 
some interaction I'm not following with the divert...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773859

Title:
  upgrades to 18.04 fail

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1773859/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773859] Re: upgrades to 18.04 fail

2018-06-12 Thread Kees Cook
# cat /usr/share/dbus-1/system-services/org.freedesktop.systemd1.service
[D-BUS Service]
Name=org.freedesktop.systemd1
User=root
Exec=/usr/lib/x86_64-linux-gnu/systemd-shim

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773859

Title:
  upgrades to 18.04 fail

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1773859/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1593924] Re: systemd-shim was not installed in 16.10 and now cannot purge or remove

2018-05-28 Thread Kees Cook
** Package changed: libjpeg-turbo (Ubuntu) => systemd-shim (Ubuntu)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1593924

Title:
  systemd-shim was not installed in 16.10 and now cannot purge or remove

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd-shim/+bug/1593924/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1773859] [NEW] upgrades to 18.04 fail

2018-05-28 Thread Kees Cook
Public bug reported:

$ sudo apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be REMOVED:
  systemd-shim
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 71.7 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 63 files and directories currently installed.)
Removing systemd-shim (9-1bzr4ubuntu1) ...
Removing 'diversion of 
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service to 
/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd by 
systemd-shim'
dpkg-divert: error: rename involves overwriting 
'/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service' with
  different file 
'/usr/share/dbus-1/system-services/org.freedesktop.systemd1.service.systemd', 
not allowed
dpkg: error processing package systemd-shim (--remove):
 subprocess installed post-removal script returned error exit status 2
Errors were encountered while processing:
 systemd-shim
E: Sub-process /usr/bin/dpkg returned an error code (1)

Commenting out the dpkg-divert in systemd-shim's postrm solved this for
me and I was about to continue the upgrade.

** Affects: systemd (Ubuntu)
 Importance: Undecided
 Status: New

** Affects: systemd-shim (Ubuntu)
 Importance: Undecided
 Status: New

** Affects: systemd (Ubuntu Bionic)
 Importance: Undecided
 Status: New

** Affects: systemd-shim (Ubuntu Bionic)
 Importance: Undecided
 Status: New

** Also affects: systemd (Ubuntu)
   Importance: Undecided
   Status: New

** Also affects: systemd (Ubuntu Bionic)
   Importance: Undecided
   Status: New

** Also affects: systemd-shim (Ubuntu Bionic)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1773859

Title:
  upgrades to 18.04 fail

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1773859/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-05-09 Thread Kees Cook
ping...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1767172] Re: Regression: /etc/modules checked against blacklist

2018-04-26 Thread Kees Cook
https://github.com/systemd/systemd/pull/8830

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1767172

Title:
  Regression: /etc/modules checked against blacklist

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1767172/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1767172] [NEW] Regression: /etc/modules checked against blacklist

2018-04-26 Thread Kees Cook
Public bug reported:

Before systemd-modules-load, /etc/init.d/kmod would load modules
directly with "modprobe" (and _not_ "modprobe -b"):

load_module() {
  local module args
  module="$1"
  args="$2"

  if [ "$VERBOSE" != no ]; then
log_action_msg "Loading kernel module $module"
modprobe $module $args || true
  else
modprobe $module $args > /dev/null 2>&1 || true
  fi
}

However, under 18.04, systemd-modules-load will _ignore_ modules that
are manually listed in /etc/modules and process them with the blacklist
(the same as "modprobe -b" would). This means that it is not possible to
manually load modules that are blacklisted (like watchdog modules):

systemd-238/src/modules-load/modules-load.c:

static int load_module(struct kmod_ctx *ctx, const char *m) {
const int probe_flags = KMOD_PROBE_APPLY_BLACKLIST;
...
default:
err = kmod_module_probe_insert_module(mod, probe_flags,
  NULL, NULL, NULL, 
NULL);

if (err == 0)
log_info("Inserted module '%s'", 
kmod_module_get_name(mod));
else if (err == KMOD_PROBE_APPLY_BLACKLIST)
log_info("Module '%s' is blacklisted", 
kmod_module_get_name(mod));

Blacklists should _not_ be applied by systemd-modules-load.

** Affects: systemd (Ubuntu)
 Importance: Undecided
 Status: New


** Tags: regression-release

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1767172

Title:
  Regression: /etc/modules checked against blacklist

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1767172/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-04-26 Thread Kees Cook
Oops, I missed the "|" ... fixed here:

https://lists.ubuntu.com/archives/kernel-team/2018-April/092002.html

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1759369] Re: kernel build fails on arm64

2018-04-24 Thread Kees Cook
** Also affects: gcc-7 (Ubuntu Bionic)
   Importance: Undecided
   Status: Fix Released

** Also affects: gcc-7-cross (Ubuntu Bionic)
   Importance: High
   Status: Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1759369

Title:
  kernel build fails on arm64

To manage notifications about this bug go to:
https://bugs.launchpad.net/gcc-linaro/+bug/1759369/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-04-22 Thread Kees Cook
This should fix it:

https://lists.ubuntu.com/archives/kernel-team/2018-April/091890.html

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1766052] [NEW] Incorrect blacklist of bcm2835_wdt

2018-04-21 Thread Kees Cook
Public bug reported:

Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
down. This needs to be removed from the automatic blacklist generated by
the kernel build that ends up in /lib/modprobe.d/blacklist_linux_$(uname
-r).conf

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

** Affects: linux (Ubuntu Artful)
 Importance: Undecided
 Status: New

** Affects: linux (Ubuntu Bionic)
 Importance: Undecided
 Status: New

** Also affects: linux (Ubuntu Bionic)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Artful)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1765484] Re: grub-install should handle /boot/efi on RAID1

2018-04-19 Thread Kees Cook
The error, specifically, is:


Installing for x86_64-efi platform.
efibootmgr: option requires an argument -- 'd'
...
grub-install: error: efibootmgr failed to register the boot entry: Operation 
not permitted.
Failed: grub-install --target=x86_64-efi  
WARNING: Bootloader is not properly installed, system may not be bootable

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1765484

Title:
  grub-install should handle /boot/efi on RAID1

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1765484/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1765484] [NEW] grub-install should handle /boot/efi on RAID1

2018-04-19 Thread Kees Cook
Public bug reported:

I am using grub-efi. I have /boot/efi as a RAID1 with metadata=1.0 at
the _end_ of the partition so it can still be seen by UEFI boot firmware
as a FAT32 filesystem. grub-install calls efibootmgr with and empty -d
argument:

efibootmgr -c -d "" ...

since it can't figure out what drive /boot/efi is on. With grub-pc, when
/boot was on a RAID1, grub-install would get run via the grub-pc
postinst for each component of the raid (and/or as a list presented to
the user via debconf).

For example, with this:

# cat /proc/mdstat
Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] 
[raid10] 
md0 : active raid1 sda1[2] sdb1[0]
  524224 blocks super 1.0 [2/2] [UU]

if /dev/md0 was mounted on /boot, grub-pc's postinst would run grub-
install on /dev/sda and /dev/sdb.

In the UEFI case, if /dev/md0 is mounted on /boot/efi, I would expect
efibootmgr to be run multiple times for each component:

efibootmgr -c -d /dev/sda1 -L ubuntu-sda1 ...
efibootmgr -c -d /dev/sdb1 -L ubuntu-sdb1 ...

Dunno about boot ordering, etc. I'm not actually using efibootmgr
currently. As a work-around, I ran "dpkg-reconfigure -p low grub-efi"
and disabled the NVRAM setting in debconf (to avoid efibootmgr failing
grub-install and causing package installs/upgrades to fail).

** Affects: grub2 (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1765484

Title:
  grub-install should handle /boot/efi on RAID1

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1765484/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1750465] Re: package plymouth-theme-ubuntu-text 0.9.2-3ubuntu17 failed to install/upgrade: dependency problems - leaving triggers unprocessed

2018-03-04 Thread Kees Cook
I hit this too (on arm64).

** Attachment added: "apt-term.log"
   
https://bugs.launchpad.net/ubuntu/+source/plymouth/+bug/1750465/+attachment/5069501/+files/apt-term.log

** Changed in: plymouth (Ubuntu)
   Status: Incomplete => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1750465

Title:
  package plymouth-theme-ubuntu-text 0.9.2-3ubuntu17 failed to
  install/upgrade: dependency problems - leaving triggers unprocessed

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/plymouth/+bug/1750465/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1747711] Re: file mis-identifies modern executables as application/x-sharedlib

2018-02-17 Thread Kees Cook
This is (sort of) a bug in file. The problem is not being able to
distinguish between shared objects and PIE binaries. (The latter have
INTERP ELF sections and can be run directly.)

$ readelf -l /bin/true
...
Elf file type is EXEC (Executable file)
...
  INTERP 0x0238 0x00400238 0x00400238
 0x001c 0x001c  R  1
  [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
...


$ readelf -l /usr/lib/x86_64-linux-gnu/libmagic.so.1.0.0
...
Elf file type is DYN (Shared object file)
...[no INTERP]...


$ readelf -l /usr/bin/ssh
...
Elf file type is DYN (Shared object file)
...
  INTERP 0x0238 0x0238 0x0238
 0x001c 0x001c  R  1
  [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]

So for mime types to distinguish, "file" needs to grow reporting of the
INTERP presence.

This has become an issue in bionic due to PIE-by-default.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1747711

Title:
  file mis-identifies modern executables as application/x-sharedlib

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/file/+bug/1747711/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1659801] Re: apparmor rules block ejabberdctl

2017-04-22 Thread Kees Cook
** Bug watch added: Debian Bug tracker #860951
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860951

** Also affects: ejabberd (Debian) via
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860951
   Importance: Unknown
   Status: Unknown

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1659801

Title:
  apparmor rules block ejabberdctl

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ejabberd/+bug/1659801/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1659801] Re: apparmor rules block ejabberdctl

2017-04-22 Thread Kees Cook
Add "m" to /etc/apparmor.d/usr.sbin.ejabberdctl's "su" subprofile on
/bin/su line:

/bin/su rm,

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1659801

Title:
  apparmor rules block ejabberdctl

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ejabberd/+bug/1659801/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1580323] Re: Pull/merge 2016.05~rc3+dfsg1-1 from Debian experimental

2017-04-17 Thread Kees Cook
Bump. Please get this merged from Debian unstable. I'd like an arm64
rpi3 :)

** Also affects: u-boot (Ubuntu Zesty)
   Importance: Undecided
   Status: Confirmed

** Also affects: u-boot (Ubuntu Aa-series)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1580323

Title:
  Pull/merge 2016.05~rc3+dfsg1-1 from Debian experimental

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/u-boot/+bug/1580323/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1680315] [NEW] Disable CONFIG_SECURITY_SELINUX_DISABLE

2017-04-05 Thread Kees Cook
Public bug reported:

In the v4.12 kernel, CONFIG_SECURITY_SELINUX_DISABLE (which allows
disabling selinux after boot) will conflict with read-only LSM
structures. Since Ubuntu is primarily using AppArmor for its LSM, and
SELinux is disabled by default, it makes sense to drop this feature in
favor of the protections offered by __ro_after_init markings on the LSM
structures.

https://patchwork.kernel.org/patch/9571911/

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1680315

Title:
  Disable CONFIG_SECURITY_SELINUX_DISABLE

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680315/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-27 Thread Kees Cook
... why aren't all the kernels just signed? Why does this need to be a
separate package at all?

I can confirm installing the -signed package fixes it for me. Where in
the kernel source does this signature effect the output of
/proc/sys/kernel/secure_boot, though? I can't find that...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
the proc handler does:
secure_boot_enabled = efi_enabled(EFI_SECURE_BOOT);
this feature flag is set at boot:
#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
if (boot_params.secure_boot == EFI_SECURE_BOOT) {
set_bit(EFI_SECURE_BOOT, );
enforce_signed_modules();
pr_info("Secure boot enabled\n");
}

And since I don't see the pr_info, nor the flag, nor the module
enforcement, the boot_params is probably missing?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
And that must be doing something wrong, since:

sudo efivar -p -n $(efivar --list | grep SecureBoot)

shows "1"

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
And it looks like this is specific to the 4.8 kernel. 4.4 thinks secure
boot is enabled.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
Oh, and that's not set up by the bootloader, it's in
arch/x86/boot/compressed/eboot.c:

boot_params->secure_boot = get_secure_boot();

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
(Hm, dmesg WARN on IOMMU seems to think I need
910170442944e1f8674fd5ddbeeb8ccd1877ea98, but that's unrelated...)


** Attachment added: "dmesg.txt"
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+attachment/4809482/+files/dmesg.txt

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658233] Re: missing apparmor rules

2017-01-26 Thread Kees Cook
I added this to the base profile, since other processes tripped over
that one. (It's in a separate bug report)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658233

Title:
  missing apparmor rules

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mysql-5.7/+bug/1658233/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-24 Thread Kees Cook
$ cat /proc/sys/kernel/secure_boot
0

That seems weird. Everything else thinks it's enabled. What sets this
one (and what does it represent)?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1639180] Re: no login possible after update to nvidia 304.132

2017-01-22 Thread Kees Cook
Is this fixed in Xenial?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1639180

Title:
  no login possible after update to nvidia 304.132

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers-304/+bug/1639180/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658255] [NEW] Kernel not enforcing module signatures under SecureBoot

2017-01-20 Thread Kees Cook
Public bug reported:

$ sudo mokutil --sbstate
SecureBoot enabled
$ cat /proc/sys/kernel/moksbstate_disabled
0
$ sudo insmod ./hello.ko
$ echo $?
0
$ dmesg | grep Hello
[00112.530866] Hello, world!
$ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
~Module signature appended~
$ strings hello.ko | grep signature
$ uname -r
4.8.0-34-generic

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658236] Re: php abstraction not updated for php7

2017-01-20 Thread Kees Cook
This creates an upgrade burden on anyone already including the php5
abstraction. I think there should be a single abstraction (named php)
but a symlink back to php5 that includes 5 and current...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658236

Title:
  php abstraction not updated for php7

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1658236/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658239] [NEW] base abstraction missing glibc /proc/$pid/ things

2017-01-20 Thread Kees Cook
Public bug reported:

There are yet more glibc-needed files missing from the base abstraction:

--- base2017-01-20 15:37:50.0 -0800
+++ /etc/apparmor.d/abstractions/base   2016-12-06 14:13:58.0 -0800
@@ -92,7 +92,7 @@
   /sys/devices/system/cpu/online r,

   # glibc's *printf protections read the maps file
-  @{PROC}/@{pid}/mapsr,
+  @{PROC}/@{pid}/{maps,auxv,status}r,

   # libgcrypt reads some flags from /proc
   @{PROC}/sys/crypto/*   r,

** Affects: apparmor (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658239

Title:
  base abstraction missing glibc /proc/$pid/ things

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1658239/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658238] [NEW] apache2 abstraction incomplete

2017-01-20 Thread Kees Cook
Public bug reported:

Apache2 needs updates for proper signal handling, optional saslauth, and
OCSP stapling...


--- apache2-common  2014-06-24 11:06:06.0 -0700
+++ /etc/apparmor.d/abstractions/apache2-common 2015-05-21 07:51:49.0 
-0700
@@ -8,6 +8,8 @@
   signal (receive) peer=unconfined,
   # Allow apache to send us signals by default
   signal (receive) peer=/usr/sbin/apache2,
+  # Allow other hats to signal by default
+  signal peer=/usr/sbin/apache2//*,
   # Allow us to signal ourselves
   signal peer=@{profile_name},

@@ -25,3 +27,12 @@

   /dev/urandomr,

+  # sasl-auth
+  /run/saslauthd/mux rw,
+
+  # OCSP stapling
+  /var/log/apache2/stapling-cache rw,

** Affects: apparmor (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658238

Title:
  apache2 abstraction incomplete

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1658238/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658236] [NEW] php abstraction not updated for php7

2017-01-20 Thread Kees Cook
Public bug reported:

The php abstraction (also wrongly named php5 now) was not updated for
php7. Attached is a diff I used...

** Affects: apparmor (Ubuntu)
 Importance: Undecided
 Status: New

** Patch added: "php.diff"
   https://bugs.launchpad.net/bugs/1658236/+attachment/4806929/+files/php.diff

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658236

Title:
  php abstraction not updated for php7

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1658236/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1658233] [NEW] missing apparmor rules

2017-01-20 Thread Kees Cook
Public bug reported:

Missing from apparmor rules:

  /sys/devices/system/node/ r,
  /sys/devices/system/node/** r,

** Affects: mysql-5.7 (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1658233

Title:
  missing apparmor rules

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mysql-5.7/+bug/1658233/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1645501] Re: corefiles not created in armhf chroot on arm64 porter

2016-11-29 Thread Kees Cook
ptrace(PTRACE_GETREGSET, 27642, NT_FPREGSET, 0xffcc67f0) = -1 EINVAL
(Invalid argument)

NT_FPREGSET is "2", which the kernel calls NT_PRFPREG.

arm64 kernels don't implement this for compat processes, they only
support NT_ARM_VFP. If I understand correctly, VFP is hard float, so it
seems like this is a bug in gdb: it should only ask for NT_ARM_VFP, not
NT_PRFPREG.

If I'm mistaken, then the kernel is missing support for compat tasks to
issue NT_PRFPREG requests...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1645501

Title:
  corefiles not created in armhf chroot on arm64 porter

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gdb/+bug/1645501/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1639215] Re: After upgrade of Nvidia 304 drivers, mythfrontend.real crashed with SIGSEGV in QGLFormat::openGLVersionFlags()

2016-11-28 Thread Kees Cook
** Changed in: nvidia-graphics-drivers-304 (Ubuntu)
   Status: New => Confirmed

** Changed in: nvidia-graphics-drivers-304 (Ubuntu)
   Importance: Undecided => High

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1639215

Title:
  After upgrade of Nvidia 304 drivers, mythfrontend.real crashed with
  SIGSEGV in QGLFormat::openGLVersionFlags()

To manage notifications about this bug go to:
https://bugs.launchpad.net/mythbuntu/+bug/1639215/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1639215] Re: After upgrade of Nvidia 304 drivers, mythfrontend.real crashed with SIGSEGV in QGLFormat::openGLVersionFlags()

2016-11-20 Thread Kees Cook
** Also affects: nvidia-graphics-drivers-304 (Ubuntu)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1639215

Title:
  After upgrade of Nvidia 304 drivers, mythfrontend.real crashed with
  SIGSEGV in QGLFormat::openGLVersionFlags()

To manage notifications about this bug go to:
https://bugs.launchpad.net/mythbuntu/+bug/1639215/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1385391] Re: Carrizo : IOMMU v2.6 feature support

2016-11-03 Thread Kees Cook
What is needed to support this IOMMU? Kernel CONFIGs? New code? Can you
describe what is missing?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1385391

Title:
  Carrizo : IOMMU v2.6 feature support

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1385391/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1612790] [NEW] Provide kernel.perf_event_paranoid sysctl level 3

2016-08-12 Thread Kees Cook
Public bug reported:

The perf subsystem provides a rather large attack surface, and system
owners would like a way to disable access to non-root users. This is
already being done in Android and Debian, and I'd like to do the same on
my Ubuntu systems. :)

https://lkml.org/lkml/2016/1/11/587

** Affects: linux (Ubuntu)
 Importance: Undecided
 Assignee: Tim Gardner (timg-tpi)
 Status: Incomplete

** Changed in: linux (Ubuntu)
 Assignee: (unassigned) => Tim Gardner (timg-tpi)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1612790

Title:
  Provide kernel.perf_event_paranoid sysctl level 3

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1612790/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-25 Thread Kees Cook
Yup, but I wanted to avoid getting overwritten each time linux-firmware
gets updated. ;)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-18 Thread Kees Cook
Adding ath10k/QCA6174/hw2.1/board-pci-168c:0041:17aa:3545.bin (from the
working board.bin in this thread) seems to fix it, though:

e6adc90ecaf55edc656990c6c50193ac  board-pci-168c:0041:17aa:3545.bin

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-18 Thread Kees Cook
Hm, not fixed for me. still seeing firmware crashes. :(


** Changed in: linux-firmware (Ubuntu Xenial)
   Status: Fix Released => Confirmed

** Changed in: linux-firmware (Ubuntu)
   Status: Fix Released => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1586673] Re: Backport GCC 5.4.0 and binutils 2.26.1 to 16.04 LTS

2016-07-12 Thread Kees Cook
I'm able to use these (and I can verify they fix the problems I was
having), so +1 to promotion to -updates. Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1586673

Title:
  Backport GCC 5.4.0 and binutils 2.26.1 to 16.04 LTS

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1586673/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1593462] [NEW] purge-old-kernels doesn't handle -lts kernels

2016-06-16 Thread Kees Cook
Public bug reported:

When running an LTS kernel, purge-old-kernels should not remove the
latest non-LTS kernel (and its metapackage). For example:

$ dpkg -l 'linux-image-generic*' | grep ^.i
ii  linux-image-generic3.13.0.88.94   amd64Generic 
Linux kernel image
ii  linux-image-generic-lts-vivid  3.19.0.61.44   amd64Generic 
Linux kernel image
ii  linux-image-generic-lts-xenial 4.4.0.24.14amd64Generic 
Linux kernel image

This system has the base kernel meta package and two LTS meta packages.
Only the currently running and latest installed kernels should remain.

If this is running:

$ uname -r
3.19.0-51-generic

And these are installed:

$ dpkg -l 'linux-image-[34]*' | grep ^.i | cut -c-90
ii  linux-image-3.13.0-85-generic  3.13.0-85.129
ii  linux-image-3.13.0-86-generic  3.13.0-86.131
ii  linux-image-3.13.0-87-generic  3.13.0-87.133
ii  linux-image-3.13.0-88-generic  3.13.0-88.135
ii  linux-image-3.19.0-51-generic  3.19.0-51.58~14.04.1
ii  linux-image-3.19.0-59-generic  3.19.0-59.66~14.04.1
ii  linux-image-3.19.0-61-generic  3.19.0-61.69~14.04.1
ii  linux-image-4.4.0-22-generic   4.4.0-22.40~14.04.1
ii  linux-image-4.4.0-24-generic   4.4.0-24.43~14.04.1

The following kernels should remain:

ii  linux-image-3.13.0-88-generic  3.13.0-88.135
ii  linux-image-3.19.0-51-generic  3.19.0-51.58~14.04.1
ii  linux-image-3.19.0-61-generic  3.19.0-61.69~14.04.1
ii  linux-image-4.4.0-24-generic   4.4.0-24.43~14.04.1

** Affects: bikeshed (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1593462

Title:
  purge-old-kernels doesn't handle -lts kernels

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bikeshed/+bug/1593462/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1592628] Re: html entities are incorrectly preprocessed

2016-06-14 Thread Kees Cook
Nevermind, it's not html5lib, it's libpython3.5-stdlib, and the issue is
the new undocumented "convert_charrefs" argument to _init__.

** Package changed: html5lib (Ubuntu) => python3.5 (Ubuntu)

** Summary changed:

- html entities are incorrectly preprocessed
+ HTMLParser html entities preprocessing is undocumented

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1592628

Title:
  HTMLParser html entities preprocessing is undocumented

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python3.5/+bug/1592628/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1592628] [NEW] HTMLParser html entities preprocessing is undocumented

2016-06-14 Thread Kees Cook
Public bug reported:

The attached script does not emit HTML entities on Xenial, but works
correctly on Trusty. I don't see any difference in the html2lib package,
so I assume something must have changed in Python 3.

Trusty (correct):

$ ./test.py
Start tag: body
Named ent: uuml
End tag  : body

Xenial (incorrect):

$ ./test.py 
Start tag: body
Data : ü
End tag  : body

** Affects: python3.5 (Ubuntu)
 Importance: Undecided
 Status: New

** Attachment added: "test script"
   https://bugs.launchpad.net/bugs/1592628/+attachment/4684030/+files/test.py

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1592628

Title:
  HTMLParser html entities preprocessing is undocumented

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python3.5/+bug/1592628/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1573848] [NEW] KASLR should be enabled by default (x86)

2016-04-22 Thread Kees Cook
Public bug reported:

Kernel Address Space Layout Randomization (KASLR) can make it harder to
accomplish kernel security vulnerability exploits, especially during
remote attacks or attacks from containers. On x86, KASLR has a run-time
conflict with Hibernation, and currently the kernel selects Hibernation
instead of KASLR unless the "kaslr" kernel command line option is given
at boot time. Since the Unity desktop disabled access to Hibernation by
default and cloud images don't use Hibernation, it would make sense to
make KASLR enabled by default on Ubuntu. Those wishing to use
Hibernation could just provide the "nokaslr" kernel command line option
to flip the preference back.

A patch to implement this already exists:
https://lkml.org/lkml/2016/4/6/637

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New


** Tags: patch

** Tags added: patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573848

Title:
  KASLR should be enabled by default (x86)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1573848/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1416039] Re: Broken apparmor profile

2016-03-09 Thread Kees Cook
This is needed for trusty too, it seems.

** Also affects: squid3 (Ubuntu Trusty)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1416039

Title:
  Broken apparmor profile

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/squid3/+bug/1416039/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs


[Bug 1416039] Re: Broken apparmor profile

2016-03-09 Thread Kees Cook
This is needed for trusty too, it seems.

** Also affects: squid3 (Ubuntu Trusty)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1416039

Title:
  Broken apparmor profile

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/squid3/+bug/1416039/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1551894] Re: linux: 4.4.0-9.X fails yama ptrace restrictions tests

2016-03-01 Thread Kees Cook
Please also backport 3dfb7d8cdbc7ea0c2970450e60818bb3eefbad69 from
4.5-rc1.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1551894

Title:
  linux:  4.4.0-9.X fails yama ptrace restrictions tests

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1551894/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Changed in: openssh (Ubuntu Trusty)
   Status: New => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs


[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Changed in: openssh (Ubuntu Trusty)
   Status: New => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Patch added: "openssh_6.6p1-2ubuntu2.5.debdiff"
   
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+attachment/4550125/+files/openssh_6.6p1-2ubuntu2.5.debdiff

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1534340] [NEW] openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
Public bug reported:

Brute force attacks against openssh on Trusty will not log "max auth"
key-based attempts, leaving their brute forcing invisible to the logs
and anything that consumes logs, like fail2ban. Version 6.7 introduced
the logging, but it's missing in Trusty. Since Trusty is LTS, it would
seem sensible to have this feature backported.

[Impact] Bruce force attempts using private keys are invisible to logs,
which renders defenses like fail2ban useless.

[Test case] Create 20 SSH keys, try to log in over SSH, note lack of
logging the failures.

[Regression Potential] Very unlikely regression potential as the "max
auth" condition is already handled in code, it just wasn't logging. The
change only adds the missing logging.

** Affects: openssh (Ubuntu)
 Importance: Undecided
 Status: Fix Released

** Affects: openssh (Ubuntu Trusty)
 Importance: Undecided
 Assignee: Kees Cook (kees)
 Status: New

** Also affects: openssh (Ubuntu Trusty)
   Importance: Undecided
   Status: New

** Changed in: openssh (Ubuntu)
   Status: New => Fix Released

** Changed in: openssh (Ubuntu Trusty)
 Assignee: (unassigned) => Kees Cook (kees)

** Description changed:

  Brute force attacks against openssh on Trusty will not log "max auth"
  key-based attempts, leaving their brute forcing invisible to the logs
  and anything that consumes logs, like fail2ban. Version 6.7 introduced
  the logging, but it's missing in Trusty. Since Trusty is LTS, it would
  seem sensible to have this feature backported.
+ 
+ [Impact] Bruce force attempts using private keys are invisible to logs,
+ which renders defenses like fail2ban useless.
+ 
+ [Test case] Create 20 SSH keys, try to log in over SSH, note lack of
+ logging the failures.
+ 
+ [Regression Potential] Very unlikely regression potential as the "max
+ auth" condition is already handled in code, it just wasn't logging. The
+ change only adds the missing logging.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1534340] [NEW] openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
Public bug reported:

Brute force attacks against openssh on Trusty will not log "max auth"
key-based attempts, leaving their brute forcing invisible to the logs
and anything that consumes logs, like fail2ban. Version 6.7 introduced
the logging, but it's missing in Trusty. Since Trusty is LTS, it would
seem sensible to have this feature backported.

[Impact] Bruce force attempts using private keys are invisible to logs,
which renders defenses like fail2ban useless.

[Test case] Create 20 SSH keys, try to log in over SSH, note lack of
logging the failures.

[Regression Potential] Very unlikely regression potential as the "max
auth" condition is already handled in code, it just wasn't logging. The
change only adds the missing logging.

** Affects: openssh (Ubuntu)
 Importance: Undecided
 Status: Fix Released

** Affects: openssh (Ubuntu Trusty)
 Importance: Undecided
 Assignee: Kees Cook (kees)
 Status: New

** Also affects: openssh (Ubuntu Trusty)
   Importance: Undecided
   Status: New

** Changed in: openssh (Ubuntu)
   Status: New => Fix Released

** Changed in: openssh (Ubuntu Trusty)
 Assignee: (unassigned) => Kees Cook (kees)

** Description changed:

  Brute force attacks against openssh on Trusty will not log "max auth"
  key-based attempts, leaving their brute forcing invisible to the logs
  and anything that consumes logs, like fail2ban. Version 6.7 introduced
  the logging, but it's missing in Trusty. Since Trusty is LTS, it would
  seem sensible to have this feature backported.
+ 
+ [Impact] Bruce force attempts using private keys are invisible to logs,
+ which renders defenses like fail2ban useless.
+ 
+ [Test case] Create 20 SSH keys, try to log in over SSH, note lack of
+ logging the failures.
+ 
+ [Regression Potential] Very unlikely regression potential as the "max
+ auth" condition is already handled in code, it just wasn't logging. The
+ change only adds the missing logging.

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs


[Bug 1534340] Re: openssh server 6.6 does not report max auth failures

2016-01-14 Thread Kees Cook
** Patch added: "openssh_6.6p1-2ubuntu2.5.debdiff"
   
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+attachment/4550125/+files/openssh_6.6p1-2ubuntu2.5.debdiff

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1534340

Title:
  openssh server 6.6 does not report max auth failures

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1534340/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs


[Bug 1532911] Re: [regression] 2.12.23-12ubuntu2.4 breaks sha512 certificates

2016-01-11 Thread Kees Cook
Thanks to mdeslaur for finding that the _root_ cert is the problem, not
mine, nor a code problem with gnutls:

http://blog.cacert.org/2015/12/re-signing-root-certificate/

** Changed in: gnutls26 (Ubuntu)
   Status: New => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1532911

Title:
  [regression] 2.12.23-12ubuntu2.4 breaks sha512 certificates

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/1532911/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1532911] [NEW] [regression] 2.12.23-12ubuntu2.4 breaks sha512 certificates

2016-01-11 Thread Kees Cook
Public bug reported:

$ gnutls-cli -p 587 smtp.outflux.net -s --print-cert
STARTTLS
ctrl-D
*** Starting TLS handshake
*** Fatal error: The signature algorithm is not supported.
*** Handshake has failed

This does not happen with 2.12.23-12ubuntu2.3.

$ echo QUIT | openssl s_client -connect smtp.outflux.net:587 -starttls smtp 
-showcerts 2>/dev/null | openssl x509 -noout -text
...
Signature Algorithm: sha512WithRSAEncryption
...
Public Key Algorithm: rsaEncryption
...

There's no MD5 visible.

** Affects: gnutls26 (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1532911

Title:
  [regression] 2.12.23-12ubuntu2.4 breaks sha512 certificates

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/1532911/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-12-05 Thread Kees Cook
Still no issues for me. Yay! :)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-11-17 Thread Kees Cook
It's been 3 days running the test kernel and I've seen no problems. Very
encouraging!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Atheros wifi 168c:0041(QCA6174) is not supported

2015-09-08 Thread Kees Cook
** Attachment removed: "firmware for qca6174"
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+attachment/4450449/+files/ath10k-qca6174.tar.bz2

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6174) is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Atheros wifi 168c:0041(QCA6174) is not supported

2015-09-07 Thread Kees Cook
** Summary changed:

- Atheros wifi 168c:0041(QCA6164) is not supported
+ Atheros wifi 168c:0041(QCA6174) is not supported

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6174) is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1436940] Re: Atheros wifi 168c:0041(QCA6164) is not supported

2015-08-21 Thread Kees Cook
@jsalisbury is there a 4.2 ubuntu kernel we could test with? Here's a
tarball with the firmware files. It's unpacked as:

cd /lib/firmware
tar xf /tmp/ath10k-qca6174.tar.bz2


** Attachment added: firmware for qca6174
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+attachment/4450449/+files/ath10k-qca6174.tar.bz2

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6164) is not supported

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


  1   2   3   4   5   6   7   8   9   10   >