[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
This bug was fixed in the package grub2-signed - 1.93.15 --- grub2-signed (1.93.15) bionic; urgency=medium * Rebuild against grub2 2.02-2ubuntu8.14. (LP: #1851190) (LP: #1851897) -- dann frazier Sat, 09 Nov 2019 08:50:43 -0700 ** Changed in: grub2-signed (Ubuntu Bionic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
This bug was fixed in the package grub2 - 2.02-2ubuntu8.14 --- grub2 (2.02-2ubuntu8.14) bionic; urgency=medium * Fix kexec on ACPI/UEFI ARM systems w/ crashkernel reserved memory beyond the 4GiB boundary. (LP: #1851190) * Apply patch from Peter Jones to forbid the "devicetree" command when Secure Boot is enabled. (LP: #1851897) -- dann frazier Sun, 10 Nov 2019 22:52:35 -0700 ** Changed in: grub2 (Ubuntu Bionic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
This bug was fixed in the package grub2-signed - 1.115.1 --- grub2-signed (1.115.1) disco; urgency=medium * Rebuild against grub2 2.02+dfsg1-12ubuntu2.1. (LP: #1851897) -- dann frazier Sat, 09 Nov 2019 08:44:52 -0700 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
This bug was fixed in the package grub2 - 2.02+dfsg1-12ubuntu2.1 --- grub2 (2.02+dfsg1-12ubuntu2.1) disco; urgency=medium * Apply patch from Peter Jones to forbid the "devicetree" command when Secure Boot is enabled. (LP: #1851897) -- dann frazier Sun, 10 Nov 2019 11:17:51 -0700 ** Changed in: grub2 (Ubuntu Disco) Status: Fix Committed => Fix Released ** Changed in: grub2-signed (Ubuntu Disco) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
bionic verification: GNU GRUB version 2.02 Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists possible device or file completions. ESC at any time exits. grub> device-tree foo error: can't find command `device-tree'. grub> devicetree foo error: Secure Boot forbids loading devicetree from foo. grub> ** Tags removed: verification-needed verification-needed-bionic ** Tags added: verification-done verification-done-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
disco verification: GNU GRUB version 2.02 Minimal BASH-like line editing is supported. For the first word, TAB lists possible command completions. Anywhere else TAB lists possible device or file completions. grub> devicetree x error: Secure Boot forbids loading devicetree from x. grub> ** Tags removed: verification-needed-disco ** Tags added: verification-done-disco -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
Hello dann, or anyone else affected, Accepted grub2 into disco-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02+dfsg1-12ubuntu2.1 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-disco to verification-done-disco. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-disco. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Tags added: verification-needed verification-needed-disco -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
** Changed in: grub2 (Ubuntu Disco) Status: In Progress => Fix Committed ** Changed in: grub2 (Ubuntu Bionic) Status: In Progress => Fix Committed ** Changed in: grub2 (Ubuntu Disco) Assignee: (unassigned) => dann frazier (dannf) ** Changed in: grub2 (Ubuntu Bionic) Assignee: (unassigned) => dann frazier (dannf) ** Description changed: [Impact] A devicetree command could be used to load an unsigned device tree file, which will override the hardware configuration exposed to the kernel. This could potentially be used to subvert Secure Boot. [Test Case] grub> devicetree foo error: Secure Boot forbids loading devicetree from foo. [Regression Risk] The idea of Secure Boot and externally provided devicetree are inherently incompatible - there's no known system that requires this config, but it is of course possible someone somewhere is doing it. + + The code involved is restricted to devicetree code, so impact would be + restricted to ARM systems. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1851897] Re: devicetree command should be disabled in Secure Boot mode
** Changed in: grub2 (Debian) Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1851897 Title: devicetree command should be disabled in Secure Boot mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1851897/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
