[Kernel-packages] [Bug 1914685] Re: Please enable CONFIG_UBSAN_BOUNDS

2021-02-04 Thread Kees Cook
This is a CONFIG request, do no apport collection required. :)

** Changed in: linux (Ubuntu)
   Status: Incomplete => Confirmed

** Also affects: linux (Ubuntu Groovy)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Hirsute)
   Importance: Undecided
   Status: Confirmed

** Changed in: linux (Ubuntu Groovy)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1914685

Title:
  Please enable CONFIG_UBSAN_BOUNDS

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Groovy:
  Confirmed
Status in linux source package in Hirsute:
  Confirmed

Bug description:
  Enabling CONFIG_UBSAN_BOUNDS is fast and provides good coverage for
  out-of-bounds array indexing (i.e. it catchings the things that
  CONFIG_FORTIFY doesn't).

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1914685/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1914685] [NEW] Please enable CONFIG_UBSAN_BOUNDS

2021-02-04 Thread Kees Cook
Public bug reported:

Enabling CONFIG_UBSAN_BOUNDS is fast and provides good coverage for out-
of-bounds array indexing (i.e. it catchings the things that
CONFIG_FORTIFY doesn't).

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1914685

Title:
  Please enable CONFIG_UBSAN_BOUNDS

Status in linux package in Ubuntu:
  New

Bug description:
  Enabling CONFIG_UBSAN_BOUNDS is fast and provides good coverage for
  out-of-bounds array indexing (i.e. it catchings the things that
  CONFIG_FORTIFY doesn't).

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1914685/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1905975] Re: kernel: Enable CONFIG_BPF_LSM on Ubuntu

2020-11-27 Thread Kees Cook
(This is a feature request, so no log needed.)

** Changed in: linux (Ubuntu)
   Status: Incomplete => Confirmed

** Also affects: linux (Ubuntu Hirsute)
   Importance: Undecided
   Status: Confirmed

** Also affects: linux (Ubuntu Groovy)
   Importance: Undecided
   Status: New

** Changed in: linux (Ubuntu Groovy)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1905975

Title:
  kernel: Enable CONFIG_BPF_LSM on Ubuntu

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Groovy:
  Confirmed
Status in linux source package in Hirsute:
  Confirmed

Bug description:
  == Impact ==

  Enabling CONFIG_BPF_LSM in the KConfig of Ubuntu Kernels, allowing
  users to use BPF LSM programs.

  == Background ==

  The BPF LSM was merged into the Linux kernel 5.7

  
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=641cd7b06c911c5935c34f24850ea18690649917

  https://outflux.net/blog/archives/2020/09/21/security-things-in-
  linux-v5-7

  It allows users to implement MAC and Audit Policies using BPF
  programs. As a follow-up from the interest generated by the LSM on
  BPF/Linux conferences and on request from users, we’d like to request
  the enabling of CONFIG_BPF_LSM on Ubuntu starting with H.

  The LSM won't be added to the list of active LSMs by default (in
  CONFIG_LSM or lsm= on the boot parameters) yet, as it adds an indirect
  function call overhead by registering an empty LSM hook for all hooks.
  However enabling it in the kernel config will support users who wish
  to use BPF LSM programs without needing to replace their kernel image.

  The LSM can be made "active" by default when our work on getting rid
  of this overhead is merged in the kernel:

  https://lore.kernel.org/bpf/20200820164753.3256899-1-jackm...@chromium.org

  == Regression Potential ==

  None. The LSM is not active by default, so it does not have any
  performance or functional regression.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1905975/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1767172] Re: Regression: /etc/modules checked against blacklist or it's really hard to load blacklisted watchdog modules when one really wants one

2019-05-20 Thread Kees Cook
I think it's fine. It sounds like there will just be no way to override
package-installed blacklists any more. That's unfortunate, but it's a
very rare situation.

** Changed in: systemd (Ubuntu)
   Status: Incomplete => Won't Fix

** Changed in: linux (Ubuntu)
   Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1767172

Title:
  Regression: /etc/modules checked against blacklist or it's really hard
  to load blacklisted watchdog modules when one really wants one

Status in linux package in Ubuntu:
  Invalid
Status in systemd package in Ubuntu:
  Won't Fix

Bug description:
  Impossible / hard to force the system to load a watchdog module
  because it is blacklisted by the kernel auto-generated list of
  "watchdog" modules.

  /etc/modules used to "just work" before.

  e.g. bcm2835_wdt module on arm64

  ===

  Before systemd-modules-load, /etc/init.d/kmod would load modules
  directly with "modprobe" (and _not_ "modprobe -b"):

  load_module() {
    local module args
    module="$1"
    args="$2"

    if [ "$VERBOSE" != no ]; then
  log_action_msg "Loading kernel module $module"
  modprobe $module $args || true
    else
  modprobe $module $args > /dev/null 2>&1 || true
    fi
  }

  However, under 18.04, systemd-modules-load will _ignore_ modules that
  are manually listed in /etc/modules and process them with the
  blacklist (the same as "modprobe -b" would). This means that it is not
  possible to manually load modules that are blacklisted (like watchdog
  modules):

  systemd-238/src/modules-load/modules-load.c:

  static int load_module(struct kmod_ctx *ctx, const char *m) {
  const int probe_flags = KMOD_PROBE_APPLY_BLACKLIST;
  ...
  default:
  err = kmod_module_probe_insert_module(mod, 
probe_flags,
    NULL, NULL, 
NULL, NULL);

  if (err == 0)
  log_info("Inserted module '%s'", 
kmod_module_get_name(mod));
  else if (err == KMOD_PROBE_APPLY_BLACKLIST)
  log_info("Module '%s' is blacklisted", 
kmod_module_get_name(mod));

  Blacklists should _not_ be applied by systemd-modules-load.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1767172/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1783651] Re: Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
To clarify, I'm suggesting:

CONFIG_PAGE_POISONING=y
CONFIG_PAGE_POISONING_ZERO=y
CONFIG_PAGE_POISONING_NO_SANITY=y

this should have no impact on regular boots, and if someone boots with
"page_poison=1" then they get page wiping when page_alloc pages are
freed (and then GFP_ZERO is a no-op since it was already freed), so it
becomes a reasonable trade-off on performance vs gaining the wipe-on-
free ability of the buddy allocator.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

Status in linux package in Ubuntu:
  Incomplete

Bug description:
  I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING
  is not enabled on Ubuntu. (This option itself has a near-zero
  performance impact since it must be combined with the boot option
  "page_poison=1" to actually enable the poisoning.)

  To make the poisoning (when enabled) less of an impact, I'd also like
  to see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can
  be skipped.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1783651] Re: Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
Oh no, leave CONFIG_PAGE_POISONING_NO_SANITY=y. Things get REALLY slow
without that, and the default kernel is built with hibernation, so I
would expect to do =y for that option.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

Status in linux package in Ubuntu:
  Incomplete

Bug description:
  I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING
  is not enabled on Ubuntu. (This option itself has a near-zero
  performance impact since it must be combined with the boot option
  "page_poison=1" to actually enable the poisoning.)

  To make the poisoning (when enabled) less of an impact, I'd also like
  to see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can
  be skipped.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1783651] [NEW] Please enable CONFIG_PAGE_POISONING

2018-07-25 Thread Kees Cook
Public bug reported:

I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING is
not enabled on Ubuntu. (This option itself has a near-zero performance
impact since it must be combined with the boot option "page_poison=1" to
actually enable the poisoning.)

To make the poisoning (when enabled) less of an impact, I'd also like to
see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can be
skipped.

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1783651

Title:
  Please enable CONFIG_PAGE_POISONING

Status in linux package in Ubuntu:
  New

Bug description:
  I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING
  is not enabled on Ubuntu. (This option itself has a near-zero
  performance impact since it must be combined with the boot option
  "page_poison=1" to actually enable the poisoning.)

  To make the poisoning (when enabled) less of an impact, I'd also like
  to see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can
  be skipped.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1783651/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-05-09 Thread Kees Cook
ping...

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

Status in linux package in Ubuntu:
  Triaged
Status in linux source package in Artful:
  Triaged
Status in linux source package in Bionic:
  Triaged

Bug description:
  Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
  down. This needs to be removed from the automatic blacklist generated
  by the kernel build that ends up in
  /lib/modprobe.d/blacklist_linux_$(uname -r).conf

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-04-26 Thread Kees Cook
Oops, I missed the "|" ... fixed here:

https://lists.ubuntu.com/archives/kernel-team/2018-April/092002.html

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

Status in linux package in Ubuntu:
  Triaged
Status in linux source package in Artful:
  Triaged
Status in linux source package in Bionic:
  Triaged

Bug description:
  Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
  down. This needs to be removed from the automatic blacklist generated
  by the kernel build that ends up in
  /lib/modprobe.d/blacklist_linux_$(uname -r).conf

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1766052] Re: Incorrect blacklist of bcm2835_wdt

2018-04-22 Thread Kees Cook
This should fix it:

https://lists.ubuntu.com/archives/kernel-team/2018-April/091890.html

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

Status in linux package in Ubuntu:
  Incomplete
Status in linux source package in Artful:
  Incomplete
Status in linux source package in Bionic:
  Incomplete

Bug description:
  Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
  down. This needs to be removed from the automatic blacklist generated
  by the kernel build that ends up in
  /lib/modprobe.d/blacklist_linux_$(uname -r).conf

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1766052] [NEW] Incorrect blacklist of bcm2835_wdt

2018-04-21 Thread Kees Cook
Public bug reported:

Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
down. This needs to be removed from the automatic blacklist generated by
the kernel build that ends up in /lib/modprobe.d/blacklist_linux_$(uname
-r).conf

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

** Affects: linux (Ubuntu Artful)
 Importance: Undecided
 Status: New

** Affects: linux (Ubuntu Bionic)
 Importance: Undecided
 Status: New

** Also affects: linux (Ubuntu Bionic)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Artful)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1766052

Title:
  Incorrect blacklist of bcm2835_wdt

Status in linux package in Ubuntu:
  New
Status in linux source package in Artful:
  New
Status in linux source package in Bionic:
  New

Bug description:
  Without bcm2835_wdt loaded, Raspberry Pi systems cannot reboot or shut
  down. This needs to be removed from the automatic blacklist generated
  by the kernel build that ends up in
  /lib/modprobe.d/blacklist_linux_$(uname -r).conf

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1766052/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1680315] [NEW] Disable CONFIG_SECURITY_SELINUX_DISABLE

2017-04-05 Thread Kees Cook
Public bug reported:

In the v4.12 kernel, CONFIG_SECURITY_SELINUX_DISABLE (which allows
disabling selinux after boot) will conflict with read-only LSM
structures. Since Ubuntu is primarily using AppArmor for its LSM, and
SELinux is disabled by default, it makes sense to drop this feature in
favor of the protections offered by __ro_after_init markings on the LSM
structures.

https://patchwork.kernel.org/patch/9571911/

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1680315

Title:
  Disable CONFIG_SECURITY_SELINUX_DISABLE

Status in linux package in Ubuntu:
  New

Bug description:
  In the v4.12 kernel, CONFIG_SECURITY_SELINUX_DISABLE (which allows
  disabling selinux after boot) will conflict with read-only LSM
  structures. Since Ubuntu is primarily using AppArmor for its LSM, and
  SELinux is disabled by default, it makes sense to drop this feature in
  favor of the protections offered by __ro_after_init markings on the
  LSM structures.

  https://patchwork.kernel.org/patch/9571911/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680315/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-27 Thread Kees Cook
... why aren't all the kernels just signed? Why does this need to be a
separate package at all?

I can confirm installing the -signed package fixes it for me. Where in
the kernel source does this signature effect the output of
/proc/sys/kernel/secure_boot, though? I can't find that...

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
And it looks like this is specific to the 4.8 kernel. 4.4 thinks secure
boot is enabled.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
And that must be doing something wrong, since:

sudo efivar -p -n $(efivar --list | grep SecureBoot)

shows "1"

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
the proc handler does:
secure_boot_enabled = efi_enabled(EFI_SECURE_BOOT);
this feature flag is set at boot:
#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE
if (boot_params.secure_boot == EFI_SECURE_BOOT) {
set_bit(EFI_SECURE_BOOT, );
enforce_signed_modules();
pr_info("Secure boot enabled\n");
}

And since I don't see the pr_info, nor the flag, nor the module
enforcement, the boot_params is probably missing?

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
Oh, and that's not set up by the bootloader, it's in
arch/x86/boot/compressed/eboot.c:

boot_params->secure_boot = get_secure_boot();

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-26 Thread Kees Cook
(Hm, dmesg WARN on IOMMU seems to think I need
910170442944e1f8674fd5ddbeeb8ccd1877ea98, but that's unrelated...)


** Attachment added: "dmesg.txt"
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+attachment/4809482/+files/dmesg.txt

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] Re: Kernel not enforcing module signatures under SecureBoot

2017-01-24 Thread Kees Cook
$ cat /proc/sys/kernel/secure_boot
0

That seems weird. Everything else thinks it's enabled. What sets this
one (and what does it represent)?

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  In Progress
Status in linux source package in Yakkety:
  In Progress
Status in linux source package in Zesty:
  In Progress

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1658255] [NEW] Kernel not enforcing module signatures under SecureBoot

2017-01-20 Thread Kees Cook
Public bug reported:

$ sudo mokutil --sbstate
SecureBoot enabled
$ cat /proc/sys/kernel/moksbstate_disabled
0
$ sudo insmod ./hello.ko
$ echo $?
0
$ dmesg | grep Hello
[00112.530866] Hello, world!
$ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
~Module signature appended~
$ strings hello.ko | grep signature
$ uname -r
4.8.0-34-generic

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1658255

Title:
  Kernel not enforcing module signatures under SecureBoot

Status in linux package in Ubuntu:
  New

Bug description:
  $ sudo mokutil --sbstate
  SecureBoot enabled
  $ cat /proc/sys/kernel/moksbstate_disabled
  0
  $ sudo insmod ./hello.ko
  $ echo $?
  0
  $ dmesg | grep Hello
  [00112.530866] Hello, world!
  $ strings /lib/modules/$(uname -r)/kernel/lib/test_module.ko | grep signature
  ~Module signature appended~
  $ strings hello.ko | grep signature
  $ uname -r
  4.8.0-34-generic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1658255/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1385391] Re: Carrizo : IOMMU v2.6 feature support

2016-11-03 Thread Kees Cook
What is needed to support this IOMMU? Kernel CONFIGs? New code? Can you
describe what is missing?

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1385391

Title:
  Carrizo : IOMMU v2.6 feature support

Status in linux package in Ubuntu:
  Triaged

Bug description:
  Support for new features with IOMMU v2.6.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1385391/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1612790] [NEW] Provide kernel.perf_event_paranoid sysctl level 3

2016-08-12 Thread Kees Cook
Public bug reported:

The perf subsystem provides a rather large attack surface, and system
owners would like a way to disable access to non-root users. This is
already being done in Android and Debian, and I'd like to do the same on
my Ubuntu systems. :)

https://lkml.org/lkml/2016/1/11/587

** Affects: linux (Ubuntu)
 Importance: Undecided
 Assignee: Tim Gardner (timg-tpi)
 Status: Incomplete

** Changed in: linux (Ubuntu)
 Assignee: (unassigned) => Tim Gardner (timg-tpi)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1612790

Title:
  Provide kernel.perf_event_paranoid sysctl level 3

Status in linux package in Ubuntu:
  Incomplete

Bug description:
  The perf subsystem provides a rather large attack surface, and system
  owners would like a way to disable access to non-root users. This is
  already being done in Android and Debian, and I'd like to do the same
  on my Ubuntu systems. :)

  https://lkml.org/lkml/2016/1/11/587

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1612790/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-25 Thread Kees Cook
Yup, but I wanted to avoid getting overwritten each time linux-firmware
gets updated. ;)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-firmware in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux-firmware package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed
Status in linux source package in Xenial:
  Confirmed
Status in linux-firmware source package in Xenial:
  Confirmed

Bug description:
  The firmware for this card isn't included with Ubuntu.  The firmware
  provided in /lib/firmware/ath10k/QCA6174 in Ubuntu 16.04 crashes when
  used with this card.  This included firmware is likely for the QCA6174
  instead of this card, the QCA6164.

  Yes, you read that right: the files for the QCA6164 need to be a
  folder called QCA6174 in order for the card to work.  Running
  "modprobe ath10k_pci" shows that the ath10k_pci module looks for
  firmware in a folder called QCA6174, but not in any folder called
  QCA6164.

  It seems that before this issue can be resolved, the ath10k_pci module
  must be changed so that it recognizes firmware for both the QCA6164
  and QCA6174, in separate folders.

  ---

  HOW TO GET THIS CARD TO WORK:

  1) Use a kernel that supports this card

  According to WikiDevi, support for this card was added in kernel 4.3.
  If you're running Ubuntu 16.04 LTS or above, your kernel is fine; skip
  to the next step.  If you're running Ubuntu 15.10 or below, see
  https://wiki.ubuntu.com/Kernel/MainlineBuilds for info on installing a
  newer kernel.  Alternatively, you can use backports.  This is a lot
  more work, but if you really need to keep using an older kernel for
  some reason, there are some guides to installing backports in the
  comments below.

  2) Get rid of the firmware folder for this card that's included with
  Ubuntu:

  sudo rm -r /lib/firmware/ath10k/QCA6174/

  3) Download the latest firmware:

  wget https://github.com/kvalo/ath10k-firmware/archive/master.zip

  4) Unzip the downloaded file.  Inside the ath10k-firmware-master
  folder is a folder named QCA6174.  Copy the QCA6174 folder to
  /lib/firmware/ath10k:

  unzip master.zip
  sudo cp -r ath10k-firmware-master/QCA6174/ /lib/firmware/ath10k/

  5) Rename two of the firmware files like so:

  cd /lib/firmware/ath10k/QCA6174/hw2.1/
  sudo mv firmware-5.bin_SW_RM.1.1.1-00157-QCARMSWPZ-1 firmware-5.bin
  cd /lib/firmware/ath10k/QCA6174/hw3.0/
  sudo mv firmware-4.bin_WLAN.RM.2.0-00180-QCARMSWPZ-1 firmware-4.bin

  6) Reboot your computer.  Run "lshw -C network" to see if your card is
  recognized.  You can delete the files you downloaded earlier:

  cd ~
  rm master.zip
  rm -r ath10k-firmware-master/

  I've verified that this works with Ubuntu 16.04 LTS (with kernel
  4.4.0-21-generic); let me know if it doesn't work for you in the
  comments below.

  ---

  Miles Krell

  Last updated May 23, 2016

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-18 Thread Kees Cook
Adding ath10k/QCA6174/hw2.1/board-pci-168c:0041:17aa:3545.bin (from the
working board.bin in this thread) seems to fix it, though:

e6adc90ecaf55edc656990c6c50193ac  board-pci-168c:0041:17aa:3545.bin

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-firmware in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux-firmware package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed
Status in linux source package in Xenial:
  Confirmed
Status in linux-firmware source package in Xenial:
  Confirmed

Bug description:
  The firmware for this card isn't included with Ubuntu.  The firmware
  provided in /lib/firmware/ath10k/QCA6174 in Ubuntu 16.04 crashes when
  used with this card.  This included firmware is likely for the QCA6174
  instead of this card, the QCA6164.

  Yes, you read that right: the files for the QCA6164 need to be a
  folder called QCA6174 in order for the card to work.  Running
  "modprobe ath10k_pci" shows that the ath10k_pci module looks for
  firmware in a folder called QCA6174, but not in any folder called
  QCA6164.

  It seems that before this issue can be resolved, the ath10k_pci module
  must be changed so that it recognizes firmware for both the QCA6164
  and QCA6174, in separate folders.

  ---

  HOW TO GET THIS CARD TO WORK:

  1) Use a kernel that supports this card

  According to WikiDevi, support for this card was added in kernel 4.3.
  If you're running Ubuntu 16.04 LTS or above, your kernel is fine; skip
  to the next step.  If you're running Ubuntu 15.10 or below, see
  https://wiki.ubuntu.com/Kernel/MainlineBuilds for info on installing a
  newer kernel.  Alternatively, you can use backports.  This is a lot
  more work, but if you really need to keep using an older kernel for
  some reason, there are some guides to installing backports in the
  comments below.

  2) Get rid of the firmware folder for this card that's included with
  Ubuntu:

  sudo rm -r /lib/firmware/ath10k/QCA6174/

  3) Download the latest firmware:

  wget https://github.com/kvalo/ath10k-firmware/archive/master.zip

  4) Unzip the downloaded file.  Inside the ath10k-firmware-master
  folder is a folder named QCA6174.  Copy the QCA6174 folder to
  /lib/firmware/ath10k:

  unzip master.zip
  sudo cp -r ath10k-firmware-master/QCA6174/ /lib/firmware/ath10k/

  5) Rename two of the firmware files like so:

  cd /lib/firmware/ath10k/QCA6174/hw2.1/
  sudo mv firmware-5.bin_SW_RM.1.1.1-00157-QCARMSWPZ-1 firmware-5.bin
  cd /lib/firmware/ath10k/QCA6174/hw3.0/
  sudo mv firmware-4.bin_WLAN.RM.2.0-00180-QCARMSWPZ-1 firmware-4.bin

  6) Reboot your computer.  Run "lshw -C network" to see if your card is
  recognized.  You can delete the files you downloaded earlier:

  cd ~
  rm master.zip
  rm -r ath10k-firmware-master/

  I've verified that this works with Ubuntu 16.04 LTS (with kernel
  4.4.0-21-generic); let me know if it doesn't work for you in the
  comments below.

  ---

  Miles Krell

  Last updated May 23, 2016

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041] is not supported

2016-07-18 Thread Kees Cook
Hm, not fixed for me. still seeing firmware crashes. :(


** Changed in: linux-firmware (Ubuntu Xenial)
   Status: Fix Released => Confirmed

** Changed in: linux-firmware (Ubuntu)
   Status: Fix Released => Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-firmware in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Qualcomm Atheros QCA6164 802.11ac Wireless Network Adapter [168c:0041]
  is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux-firmware package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed
Status in linux source package in Xenial:
  Confirmed
Status in linux-firmware source package in Xenial:
  Confirmed

Bug description:
  The firmware for this card isn't included with Ubuntu.  The firmware
  provided in /lib/firmware/ath10k/QCA6174 in Ubuntu 16.04 crashes when
  used with this card.  This included firmware is likely for the QCA6174
  instead of this card, the QCA6164.

  Yes, you read that right: the files for the QCA6164 need to be a
  folder called QCA6174 in order for the card to work.  Running
  "modprobe ath10k_pci" shows that the ath10k_pci module looks for
  firmware in a folder called QCA6174, but not in any folder called
  QCA6164.

  It seems that before this issue can be resolved, the ath10k_pci module
  must be changed so that it recognizes firmware for both the QCA6164
  and QCA6174, in separate folders.

  ---

  HOW TO GET THIS CARD TO WORK:

  1) Use a kernel that supports this card

  According to WikiDevi, support for this card was added in kernel 4.3.
  If you're running Ubuntu 16.04 LTS or above, your kernel is fine; skip
  to the next step.  If you're running Ubuntu 15.10 or below, see
  https://wiki.ubuntu.com/Kernel/MainlineBuilds for info on installing a
  newer kernel.  Alternatively, you can use backports.  This is a lot
  more work, but if you really need to keep using an older kernel for
  some reason, there are some guides to installing backports in the
  comments below.

  2) Get rid of the firmware folder for this card that's included with
  Ubuntu:

  sudo rm -r /lib/firmware/ath10k/QCA6174/

  3) Download the latest firmware:

  wget https://github.com/kvalo/ath10k-firmware/archive/master.zip

  4) Unzip the downloaded file.  Inside the ath10k-firmware-master
  folder is a folder named QCA6174.  Copy the QCA6174 folder to
  /lib/firmware/ath10k:

  unzip master.zip
  sudo cp -r ath10k-firmware-master/QCA6174/ /lib/firmware/ath10k/

  5) Rename two of the firmware files like so:

  cd /lib/firmware/ath10k/QCA6174/hw2.1/
  sudo mv firmware-5.bin_SW_RM.1.1.1-00157-QCARMSWPZ-1 firmware-5.bin
  cd /lib/firmware/ath10k/QCA6174/hw3.0/
  sudo mv firmware-4.bin_WLAN.RM.2.0-00180-QCARMSWPZ-1 firmware-4.bin

  6) Reboot your computer.  Run "lshw -C network" to see if your card is
  recognized.  You can delete the files you downloaded earlier:

  cd ~
  rm master.zip
  rm -r ath10k-firmware-master/

  I've verified that this works with Ubuntu 16.04 LTS (with kernel
  4.4.0-21-generic); let me know if it doesn't work for you in the
  comments below.

  ---

  Miles Krell

  Last updated May 23, 2016

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1573848] [NEW] KASLR should be enabled by default (x86)

2016-04-22 Thread Kees Cook
Public bug reported:

Kernel Address Space Layout Randomization (KASLR) can make it harder to
accomplish kernel security vulnerability exploits, especially during
remote attacks or attacks from containers. On x86, KASLR has a run-time
conflict with Hibernation, and currently the kernel selects Hibernation
instead of KASLR unless the "kaslr" kernel command line option is given
at boot time. Since the Unity desktop disabled access to Hibernation by
default and cloud images don't use Hibernation, it would make sense to
make KASLR enabled by default on Ubuntu. Those wishing to use
Hibernation could just provide the "nokaslr" kernel command line option
to flip the preference back.

A patch to implement this already exists:
https://lkml.org/lkml/2016/4/6/637

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New


** Tags: patch

** Tags added: patch

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1573848

Title:
  KASLR should be enabled by default (x86)

Status in linux package in Ubuntu:
  New

Bug description:
  Kernel Address Space Layout Randomization (KASLR) can make it harder
  to accomplish kernel security vulnerability exploits, especially
  during remote attacks or attacks from containers. On x86, KASLR has a
  run-time conflict with Hibernation, and currently the kernel selects
  Hibernation instead of KASLR unless the "kaslr" kernel command line
  option is given at boot time. Since the Unity desktop disabled access
  to Hibernation by default and cloud images don't use Hibernation, it
  would make sense to make KASLR enabled by default on Ubuntu. Those
  wishing to use Hibernation could just provide the "nokaslr" kernel
  command line option to flip the preference back.

  A patch to implement this already exists:
  https://lkml.org/lkml/2016/4/6/637

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1573848/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1551894] Re: linux: 4.4.0-9.X fails yama ptrace restrictions tests

2016-03-01 Thread Kees Cook
Please also backport 3dfb7d8cdbc7ea0c2970450e60818bb3eefbad69 from
4.5-rc1.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1551894

Title:
  linux:  4.4.0-9.X fails yama ptrace restrictions tests

Status in linux package in Ubuntu:
  Incomplete

Bug description:
  15:55:46 ERROR| [stderr] FAIL: test_093_ptrace_restriction 
(__main__.KernelSecurityTest)
  15:55:46 ERROR| [stderr] ptrace allowed only on children or declared processes

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1551894/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-12-05 Thread Kees Cook
Still no issues for me. Yay! :)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Trusty:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS "Trusty Tahr" - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-11-17 Thread Kees Cook
It's been 3 days running the test kernel and I've seen no problems. Very
encouraging!

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Trusty:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS "Trusty Tahr" - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros wifi 168c:0041(QCA6174) is not supported

2015-09-08 Thread Kees Cook
** Attachment removed: "firmware for qca6174"
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+attachment/4450449/+files/ath10k-qca6174.tar.bz2

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6174) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo Z70
  Lenovo G50-45
  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Yoga 3 11
  Lenovo Flex 3-1470
  Samsung ATIV Book 9 NP930X2K

  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 "Utopic Unicorn" - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros wifi 168c:0041(QCA6174) is not supported

2015-09-07 Thread Kees Cook
** Summary changed:

- Atheros wifi 168c:0041(QCA6164) is not supported
+ Atheros wifi 168c:0041(QCA6174) is not supported

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6174) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo Z70
  Lenovo G50-45
  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Yoga 3 11
  Lenovo Flex 3-1470
  Samsung ATIV Book 9 NP930X2K

  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 "Utopic Unicorn" - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros wifi 168c:0041(QCA6164) is not supported

2015-08-21 Thread Kees Cook
@jsalisbury is there a 4.2 ubuntu kernel we could test with? Here's a
tarball with the firmware files. It's unpacked as:

cd /lib/firmware
tar xf /tmp/ath10k-qca6174.tar.bz2


** Attachment added: firmware for qca6174
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+attachment/4450449/+files/ath10k-qca6174.tar.bz2

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6164) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo Z70
  Lenovo G50-45
  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Yoga 3 11
  Lenovo Flex 3-1470
  Samsung ATIV Book 9 NP930X2K

  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 Utopic Unicorn - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros wifi 168c:0041(QCA6164) is not supported

2015-08-21 Thread Kees Cook
I have not tested these, but IIUC, this is where to get an upstream
kernel build, configured for Ubuntu, thought likely without Ubuntu-
specific patches: http://kernel.ubuntu.com/~kernel-
ppa/mainline/daily/current/

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6164) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo Z70
  Lenovo G50-45
  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Yoga 3 11
  Lenovo Flex 3-1470
  Samsung ATIV Book 9 NP930X2K

  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 Utopic Unicorn - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros wifi 168c:0041(QCA6164) is not supported

2015-08-13 Thread Kees Cook
With the new files, I still get the ath10k/QCA6174/hw2.1/firmware-4.bin
errors. Does the kernel need to be updated for a new driver that looks
for a -5 firmware?

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6164) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo G50-45
  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Z70
  Lenovo G50-45
  Lenovo Flex 3-1470
  Lenovo Yoga 3 11
  Samsung ATIV Book 9 NP930X2K

  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 Utopic Unicorn - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1436940/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-08-01 Thread Kees Cook
The debug kernels reduced the frequency of the Oopsing, but this has
made AppArmor unusable with Apache for me.

** Also affects: linux (Ubuntu Wily)
   Importance: Undecided
 Assignee: John Johansen (jjohansen)
   Status: Confirmed

** Also affects: linux (Ubuntu Trusty)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Vivid)
   Importance: Undecided
   Status: New

** Changed in: linux (Ubuntu Trusty)
   Status: New = Confirmed

** Changed in: linux (Ubuntu Vivid)
   Status: New = Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Trusty:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS Trusty Tahr - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-07-17 Thread Kees Cook
Here is the Oops from a jj-special kernel. similar, but different.


** Attachment added: debugging-oops.txt
   
https://bugs.launchpad.net/apparmor/+bug/1448912/+attachment/4430738/+files/debugging-oops.txt

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS Trusty Tahr - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-07-15 Thread Kees Cook
Three more crashes today, one after the other (the trigger must be some
kind of Apache access pattern, still trying to figure that out.)


** Attachment added: one.txt
   
https://bugs.launchpad.net/apparmor/+bug/1448912/+attachment/4429577/+files/one.txt

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS Trusty Tahr - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-07-15 Thread Kees Cook
** Attachment added: two.txt
   
https://bugs.launchpad.net/apparmor/+bug/1448912/+attachment/4429578/+files/two.txt

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS Trusty Tahr - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-07-15 Thread Kees Cook
** Attachment added: three.txt
   
https://bugs.launchpad.net/apparmor/+bug/1448912/+attachment/4429579/+files/three.txt

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor:
  Confirmed
Status in linux package in Ubuntu:
  Confirmed

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.
  --- 
  AlsaDevices:
   total 0
   crw-rw 1 root audio 116,  1 May 15 14:13 seq
   crw-rw 1 root audio 116, 33 May 15 14:13 timer
  AplayDevices: Error: [Errno 2] No such file or directory
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  ArecordDevices: Error: [Errno 2] No such file or directory
  AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', 
'/dev/snd/timer'] failed with exit code 1:
  CRDA: Error: [Errno 2] No such file or directory
  DistroRelease: Ubuntu 14.04
  HibernationDevice: RESUME=UUID=69e1aff7-c3d1-4bf4-8685-bd3fc2942f60
  InstallationDate: Installed on 2015-03-25 (61 days ago)
  InstallationMedia: Ubuntu-Server 14.04.2 LTS Trusty Tahr - Release amd64 
(20150218.1)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  Lsusb:
   Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd 
   Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
  MachineType: QEMU Standard PC (i440FX + PIIX, 1996)
  Package: linux (not installed)
  PciMultimedia:
   
  ProcEnviron:
   LANGUAGE=en_US:en
   TERM=xterm
   PATH=(custom, no user)
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 cirrusdrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.16.0-37-generic 
root=UUID=fea3075f-a9a3-414b-992a-b812d86cd04e ro
  ProcVersionSignature: Ubuntu 3.16.0-37.51~14.04.1-generic 3.16.7-ckt9
  RelatedPackageVersions:
   linux-restricted-modules-3.16.0-37-generic N/A
   linux-backports-modules-3.16.0-37-generic  N/A
   linux-firmware 1.127.11
  RfKill: Error: [Errno 2] No such file or directory
  Tags:  trusty
  Uname: Linux 3.16.0-37-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups:
   
  WifiSyslog:
   
  _MarkForUpload: True
  dmi.bios.date: 04/01/2014
  dmi.bios.vendor: SeaBIOS
  dmi.bios.version: 
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
  dmi.chassis.type: 1
  dmi.chassis.vendor: QEMU
  dmi.chassis.version: pc-i440fx-2.2
  dmi.modalias: 
dmi:bvnSeaBIOS:bvrrel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org:bd04/01/2014:svnQEMU:pnStandardPC(i440FX+PIIX,1996):pvrpc-i440fx-2.2:cvnQEMU:ct1:cvrpc-i440fx-2.2:
  dmi.product.name: Standard PC (i440FX + PIIX, 1996)
  dmi.product.version: pc-i440fx-2.2
  dmi.sys.vendor: QEMU

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1436940] Re: Atheros 168c:0041 (Lenovo G50-80) is not supported

2015-07-12 Thread Kees Cook
** Summary changed:

- Wireless device not listed in driver's PCI IDs
+ Atheros 168c:0041 (Lenovo G50-80) is not supported

** Summary changed:

- Atheros 168c:0041 (Lenovo G50-80) is not supported
+ Atheros wifi 168c:0041 (Lenovo G50-80) is not supported

** Also affects: linux (Ubuntu Vivid)
   Importance: Undecided
   Status: New

** Also affects: linux (Ubuntu Wily)
   Importance: Medium
   Status: Confirmed

** Changed in: linux (Ubuntu Vivid)
   Status: New = Confirmed

** Changed in: linux (Ubuntu Vivid)
   Importance: Undecided = Medium

** Summary changed:

- Atheros wifi 168c:0041 (Lenovo G50-80) is not supported
+ Atheros wifi 168c:0041 is not supported

** Description changed:

- The atheros wireless device (168c:0041) in this Lenovo G50-80 isn't
- supported by the ath10k_pci kernel driver.
+ The atheros wireless device (168c:0041) isn't supported by the
+ ath10k_pci kernel driver.
+ 
+ Found in several laptop models:
+ 
+ Lenovo G50-80
+ Lenovo Edge 15
+ Lenovo Z70
+ Lenovo G50-45
+ 
  
  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 Utopic Unicorn - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.
  
   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  MachineType: LENOVO 80E5
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-9-generic 
root=UUID=e52867c5-0b50-42fb-8288-f30765f926c5 ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.19.0-9-generic N/A
   linux-backports-modules-3.19.0-9-generic  N/A
   linux-firmware1.143SourcePackage: linux
  UpgradeStatus: Upgraded to vivid on 2015-03-26 (0 days ago)
  dmi.bios.date: 06/20/2014
  dmi.bios.vendor: LENOVO
  dmi.bios.version: B0CN69WW
  dmi.board.asset.tag: NO Asset Tag
  dmi.board.name: Lenovo G50-80
  dmi.board.vendor: LENOVO
  dmi.board.version: 31900058 WIN
  dmi.chassis.asset.tag: NO Asset Tag
  dmi.chassis.type: 10
  dmi.chassis.vendor: LENOVO
  dmi.chassis.version: Lenovo G50-80
  dmi.modalias: 
dmi:bvnLENOVO:bvrB0CN69WW:bd06/20/2014:svnLENOVO:pn80E5:pvrLenovoG50-80:rvnLENOVO:rnLenovoG50-80:rvr31900058WIN:cvnLENOVO:ct10:cvrLenovoG50-80:
  dmi.product.name: 80E5
  dmi.product.version: Lenovo G50-80
  dmi.sys.vendor: LENOVO

** Summary changed:

- Atheros wifi 168c:0041 is not supported
+ Atheros wifi 168c:0041(QCA6164) is not supported

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1436940

Title:
  Atheros wifi 168c:0041(QCA6164) is not supported

Status in linux package in Ubuntu:
  Confirmed
Status in linux source package in Vivid:
  Confirmed
Status in linux source package in Wily:
  Confirmed

Bug description:
  The atheros wireless device (168c:0041) isn't supported by the
  ath10k_pci kernel driver.

  Found in several laptop models:

  Lenovo G50-80
  Lenovo Edge 15
  Lenovo Z70
  Lenovo G50-45

  
  ProblemType: BugDistroRelease: Ubuntu 15.04
  Package: linux-image-3.19.0-9-generic 3.19.0-9.9
  ProcVersionSignature: Ubuntu 3.19.0-9.9-generic 3.19.1
  Uname: Linux 3.19.0-9-generic x86_64
  ApportVersion: 2.16.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC0:  nicholas   1695 F pulseaudio
   /dev/snd/controlC1:  nicholas   1695 F pulseaudio
  CurrentDesktop: Unity
  Date: Thu Mar 26 09:47:16 2015
  HibernationDevice: RESUME=UUID=5b068cd8-e60a-49b9-a88e-1581bb6b3dc1
  InstallationDate: Installed on 2015-03-25 (1 days ago)
  InstallationMedia: Ubuntu 14.10 Utopic Unicorn - Release amd64 (20141022.1)
  IwConfig:
   eth0  no wireless extensions.

   lono wireless extensions.
  Lsusb:
   Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
   Bus 001 Device 004: ID 0cf3:e300 Atheros Communications, Inc.
   Bus 001 Device 003: ID 5986:0652 Acer, Inc
   Bus 001 Device 002: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card 
Reader Controller
   Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
  

[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

2015-05-22 Thread Kees Cook
** Summary changed:

- BUG: unable to handle kernel NULL pointer dereference
+ BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor Linux application security framework:
  Confirmed
Status in linux package in Ubuntu:
  New

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1448912] Re: BUG: unable to handle kernel NULL pointer dereference

2015-05-22 Thread Kees Cook
I saw the same thing this morning.

Ubuntu 14.04.2 LTS
Kernel linux-image-3.16.0-30-generic
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1
apache2-mpm-prefork 2.4.7-1ubuntu4.4

Attached is first the warning (like in bug 1447530), and then the Oops,
9 seconds later.


** Attachment added: warn and oops
   
https://bugs.launchpad.net/apparmor/+bug/1448912/+attachment/4402483/+files/both.txt

** Also affects: linux (Ubuntu)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1448912

Title:
  BUG: unable to handle kernel NULL pointer dereference (aa_label_merge)

Status in AppArmor Linux application security framework:
  Confirmed
Status in linux package in Ubuntu:
  New

Bug description:
  I had a kernel problem with one of my high availability VMs. This was not the 
first occurence of the problem, it seems to appear every now and then.
  The VM froze because of the Kernel bug appended as a text file. I had to hard 
reset it.
  I am running Ubuntu 14.04.2 Kernel 3.16.0-34-generic with 
libapache2-mod-apparmor 2.8.95~2430-0ubuntu5.1 and apache 2.4.7-1ubuntu4.4 
(mpm_prefork).
  Unfortunately I am unable to reproduce the bug at will. This is a serious 
problem for high availability VMs.
  Looking at the trace, I assume this is a bug in AppArmor.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1448912/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 812360] Re: linux: 2.6.24-29.92 -proposed tracker

2015-02-11 Thread Kees Cook
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-4249

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/812360

Title:
  linux: 2.6.24-29.92 -proposed tracker

Status in Kernel SRU Workflow:
  Fix Released
Status in Kernel SRU Workflow certification-testing series:
  Invalid
Status in Kernel SRU Workflow prepare-package series:
  Fix Released
Status in Kernel SRU Workflow promote-to-proposed series:
  Fix Released
Status in Kernel SRU Workflow promote-to-security series:
  Fix Released
Status in Kernel SRU Workflow promote-to-updates series:
  Fix Released
Status in Kernel SRU Workflow regression-testing series:
  Fix Released
Status in Kernel SRU Workflow security-signoff series:
  Fix Released
Status in Kernel SRU Workflow verification-testing series:
  Fix Released
Status in linux package in Ubuntu:
  Fix Released

Bug description:
  This bug is for tracking the 2.6.24-29.92 upload package. This bug
  will contain status and testing results releated to that upload.

  For an explanation of the tasks and the associated workflow see:
  https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

  kernel-stable-Prepare-package-start:Tuesday, 18. July 2011 15:31 UTC
  kernel-stable-Promote-to-updates-end:Tuesday, 08. August 2011 21:40 UTC

To manage notifications about this bug go to:
https://bugs.launchpad.net/kernel-sru-workflow/+bug/812360/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] Re: lacks seccomp-tsync support

2014-11-10 Thread Kees Cook
Thanks! Tested Ubuntu 3.13.0-40.68-generic 3.13.11.10 with upstream
regression suite, all tests pass.

** Tags removed: verification-needed-trusty
** Tags added: verification-done-trusty

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux” source package in Trusty:
  Fix Committed
Status in “linux” source package in Utopic:
  Fix Released

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1300914] Re: External screen undetected after first plug

2014-10-16 Thread Kees Cook
What does the output of xrandr show when VGA is working, and when it
is not?

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1300914

Title:
  External screen undetected after first plug

Status in “linux” package in Ubuntu:
  Confirmed

Bug description:
  On Ubuntu 14.04, the external screen plugged on VGA is detected and get 
activated correctly.
  However, if I unplug it and then replug it later, it is not detected anymore 
and the screen receives no signal.

  A way to get it back to work is to reboot or simply suspend the
  computer.

  Sorry but I have no idea of what package is handling that.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1300914/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] Re: lacks seccomp-tsync support

2014-10-09 Thread Kees Cook
Thanks for the backport to Utopic!

Pull request for Trusty is here: https://lists.ubuntu.com/archives
/kernel-team/2014-October/049110.html

Logs for test runs of https://github.com/redpig/seccomp.git
tests/seccomp_bpf_tests all pass now.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  Fix Committed
Status in “linux” source package in Trusty:
  Triaged
Status in “linux” source package in Utopic:
  Fix Committed

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] Re: lacks seccomp-tsync support

2014-10-09 Thread Kees Cook
** Attachment added: before.log
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+attachment/4229705/+files/before.log

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  Fix Committed
Status in “linux” source package in Trusty:
  Triaged
Status in “linux” source package in Utopic:
  Fix Committed

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] Re: lacks seccomp-tsync support

2014-10-09 Thread Kees Cook
** Attachment added: after.log
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+attachment/4229706/+files/after.log

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  Fix Committed
Status in “linux” source package in Trusty:
  Triaged
Status in “linux” source package in Utopic:
  Fix Committed

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] [NEW] lacks seccomp-tsync support

2014-10-08 Thread Kees Cook
Public bug reported:

For Chrome (and other seccomp users like LXC), the thread-sync features
for seccomp would provide better process isolation. The feature landed
in kernel 3.17, and is relatively easy to back-port. The upstream
seccomp regression tests can be used to verify both the new features and
the old API, to prove there were no regressions.

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: New

** Affects: linux (Ubuntu Trusty)
 Importance: Undecided
 Status: New

** Also affects: linux (Ubuntu Trusty)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  New
Status in “linux” source package in Trusty:
  New

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1379020] Re: lacks seccomp-tsync support

2014-10-08 Thread Kees Cook
2014-08-11  seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock
2014-07-18  seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
2014-07-18  seccomp: allow mode setting across threads
2014-07-18  seccomp: introduce writer locking
2014-07-18  seccomp: split filter prep from check and apply
2014-07-18  sched: move no_new_privs into new atomic flags
2014-07-18  MIPS: add seccomp syscall
2014-07-18  ARM: add seccomp syscall
2014-07-18  seccomp: add seccomp syscall
2014-07-18  seccomp: split mode setting routines
2014-07-18  seccomp: extract check/assign mode helpers
2014-07-18  seccomp: create internal mode-setting function

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1379020

Title:
  lacks seccomp-tsync support

Status in “linux” package in Ubuntu:
  Incomplete
Status in “linux” source package in Trusty:
  Incomplete

Bug description:
  For Chrome (and other seccomp users like LXC), the thread-sync
  features for seccomp would provide better process isolation. The
  feature landed in kernel 3.17, and is relatively easy to back-port.
  The upstream seccomp regression tests can be used to verify both the
  new features and the old API, to prove there were no regressions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1379020/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1338883] Re: Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

2014-08-24 Thread Kees Cook
Works for me, thanks!

** Tags removed: verification-needed-precise
** Tags added: verified-precise

** Tags removed: verified-precise
** Tags added: verification-done-precise

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1338883

Title:
  Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux” source package in Precise:
  New

Bug description:
  This is an old bug that looks like the fix missed Precise since Yama
  was backported there. Yama was introduced in 3.4, but Precise is 3.2
  with Yama backported. The upstream fix for this bug is missing, which
  can cause problems when a Yama-aware program is running in 32-bit
  userspace (e.g. chroot) on a 64-bit kernel.

  Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

  SRU Justification:
  - impact: Yama programs running in 32-bit chroots will fail to work correctly
  - test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
  - regression potential: nearly zero. this restores a missing function, and 
the patch is trivial and upstream for years.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1338883/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1347088] Re: Trusty update to 3.13.11.5 stable release

2014-08-14 Thread Kees Cook
Reopened; it looks like this never landed and the auditsc fix in
3.13.0-33.58 typoed which bug it should close?


** Changed in: linux (Ubuntu Trusty)
   Status: Fix Released = Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1347088

Title:
  Trusty update to 3.13.11.5 stable release

Status in “linux” package in Ubuntu:
  Confirmed
Status in “linux” source package in Trusty:
  Confirmed

Bug description:
  SRU Justification

  Impact:
     The upstream process for stable tree updates is quite similar
     in scope to the Ubuntu SRU process, e.g., each patch has to
     demonstrably fix a bug, and each patch is vetted by upstream
     by originating either directly from Linus' tree or in a minimally
     backported form of that patch. The 3.13.11.5 upstream stable
     patch set is now available. It should be included in the Ubuntu
     kernel as well.

     git://git.kernel.org/

  TEST CASE: TBD

     The following patches are in the 3.13.11.5 stable release:
  Linux 3.13.11.5
  iscsi-target: fix iscsit_del_np deadlock on unload
  iscsi-target: Avoid rejecting incorrect ITT for Data-Out
  lz4: fix another possible overrun
  efi-pstore: Fix an overflow on 32-bit builds
  iscsi-target: Explicily clear login response PDU in exception 
path
  target: Fix left-over se_lun-lun_sep pointer OOPs
  ALSA: hda - restore BCLK M/N values when resuming HSW/BDW 
display controller
  MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd 
region
  recordmcount/MIPS: Fix possible incorrect mcount_loc table 
entries in modules
  ALSA: usb-audio: Fix races at disconnection and PCM closing
  net: allwinner: emac: Add missing free_irq
  powerpc: Don't skip ePAPR spin-table CPUs
  nfs: Fix cache_validity check in nfs_write_pageuptodate()
  aio: fix kernel memory disclosure in io_getevents() 
introduced in v3.10
  aio: fix aio request leak when events are reaped by userspace
  [CIFS] fix mount failure with broken pathnames when smb3 
mount with mapchars option
  drm/i915: Hold the table lock whilst walking the file's idr 
and counting the objects in debugfs
  mm: fix crashes from mbind() merging vmas
  DMA, CMA: fix possible memory leak
  mm, pcp: allow restoring percpu_pagelist_fraction default
  kernel/watchdog.c: remove preemption restrictions when 
restarting lockup detector
  hugetlb: fix copy_hugetlb_page_range() to handle 
migration/hwpoisoned entry
  x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
  lz4: ensure length does not wrap
  lzo: properly check for overruns
  ALSA: hda - hdmi: call overridden init on resume
  rbd: handle parent_overlap on writes correctly
  blkcg: fix use-after-free in __blkg_release_rcu() by making 
blkcg_gq refcnt an atomic_t
  rt2x00: fix rfkill regression on rt2500pci
  b43: fix frequency reported on G-PHY with /new/ firmware
  rt2x00: disable TKIP on USB
  Bluetooth: Allow change security level on ATT_CID in slave 
role
  Bluetooth: Fix locking of hdev when calling into SMP code
  Bluetooth: Fix indicating discovery state when canceling 
inquiry
  Bluetooth: Fix setting correct authentication information for 
SMP STK
  Bluetooth: Fix SSP acceptor just-works confirmation without 
MITM
  ALSA: control: Make sure that id-index does not overflow
  ALSA: control: Handle numid overflow
  ALSA: control: Don't access controls outside of protected 
regions
  ALSA: control: Fix replacing user controls
  ALSA: control: Protect user controls against concurrent access
  arm64/dma: Removing ARCH_HAS_DMA_GET_REQUIRED_MASK macro
  arm64: ptrace: fix empty registers set in prstatus of aarch32 
process core
  arm64: uid16: fix __kernel_old_{gid,uid}_t definitions
  arm64: ptrace: change fs when passing kernel pointer to 
regset code
  arm64: Bug fix in stack alignment exception
  USB: EHCI: avoid BIOS handover on the HASEE E200
  ARM: mvebu: DT: fix OpenBlocks AX3-4 RAM size
  drm/nouveau/kms: reference vblank for crtc during pageflip.
  epoll: fix use-after-free in eventpoll_release_file
  ACPI / ia64 / 

[Kernel-packages] [Bug 1338883] [NEW] Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

2014-07-07 Thread Kees Cook
Public bug reported:

This is an old bug that looks like the fix missed Precise since Yama was
backported there. Yama was introduced in 3.4, but Precise is 3.2 with
Yama backported. The upstream fix for this bug is missing, which can
cause problems when a Yama-aware program is running in 32-bit userspace
(e.g. chroot) on a 64-bit kernel.

Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

SRU Justification:
- impact: Yama programs running in 32-bit chroots will fail to work correctly
- test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
- regression potential: nearly zero. this restores a missing function, and the 
patch is trivial and upstream for years.

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: Fix Released

** Affects: linux (Ubuntu Precise)
 Importance: Undecided
 Status: New

** Also affects: linux (Ubuntu Precise)
   Importance: Undecided
   Status: New

** Changed in: linux (Ubuntu)
   Status: New = Fix Released

** Description changed:

  This is an old bug that looks like the fix missed Precise since Yama was
  backported there. Yama was introduced in 3.4, but Precise is 3.2 with
  Yama backported. The upstream fix for this bug is missing, which can
  cause problems when a Yama-aware program is running in 32-bit userspace
  (e.g. chroot) on a 64-bit kernel.
  
  Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8
+ 
+ SRU Justification:
+ - impact: Yama programs running in 32-bit chroots will fail to work correctly
+ - test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
+ - regression potential: nearly zero. this restores a missing function, and 
the patch is trivial and upstream for years.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1338883

Title:
  Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux” source package in Precise:
  New

Bug description:
  This is an old bug that looks like the fix missed Precise since Yama
  was backported there. Yama was introduced in 3.4, but Precise is 3.2
  with Yama backported. The upstream fix for this bug is missing, which
  can cause problems when a Yama-aware program is running in 32-bit
  userspace (e.g. chroot) on a 64-bit kernel.

  Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

  SRU Justification:
  - impact: Yama programs running in 32-bit chroots will fail to work correctly
  - test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
  - regression potential: nearly zero. this restores a missing function, and 
the patch is trivial and upstream for years.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1338883/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1338883] Re: Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

2014-07-07 Thread Kees Cook
Test-case:

sudo apt-get install gcc-multilib
gcc -Wall yama-test.c -m32 -o yama-test
./yama-test

This should return 0 and report ok, but on precise, it fails.

** Attachment added: yama-test.c
   
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1338883/+attachment/4147811/+files/yama-test.c

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1338883

Title:
  Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux” source package in Precise:
  New

Bug description:
  This is an old bug that looks like the fix missed Precise since Yama
  was backported there. Yama was introduced in 3.4, but Precise is 3.2
  with Yama backported. The upstream fix for this bug is missing, which
  can cause problems when a Yama-aware program is running in 32-bit
  userspace (e.g. chroot) on a 64-bit kernel.

  Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

  SRU Justification:
  - impact: Yama programs running in 32-bit chroots will fail to work correctly
  - test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
  - regression potential: nearly zero. this restores a missing function, and 
the patch is trivial and upstream for years.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1338883/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1338883] Re: Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

2014-07-07 Thread Kees Cook
Patch sent to kernel-team list:
https://lists.ubuntu.com/archives/kernel-team/2014-July/045729.html

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1338883

Title:
  Yama PR_SET_PTRACER_ANY fails on 32-bit user with 64-bit kernel

Status in “linux” package in Ubuntu:
  Fix Released
Status in “linux” source package in Precise:
  New

Bug description:
  This is an old bug that looks like the fix missed Precise since Yama
  was backported there. Yama was introduced in 3.4, but Precise is 3.2
  with Yama backported. The upstream fix for this bug is missing, which
  can cause problems when a Yama-aware program is running in 32-bit
  userspace (e.g. chroot) on a 64-bit kernel.

  Fixed upstream by 2e4930eb7c8fb20a39dfb5f8a8f80402710dcea8

  SRU Justification:
  - impact: Yama programs running in 32-bit chroots will fail to work correctly
  - test case: prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, ...) shouldn't return 
EINVAL on 32-bit userspace
  - regression potential: nearly zero. this restores a missing function, and 
the patch is trivial and upstream for years.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1338883/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1329177] Re: CONFIG_RANDOMIZE_BASE is not enabled in utopic kernel

2014-06-28 Thread Kees Cook
Will Utopic be 3.16 based? If so, once
24f2e0273f80ec262a772059e140a0adef35296d is in the Ubuntu kernel, it
will be possible to enable CONFIG_RANDOMIZE_BASE along with
CONFIG_HIBERNATE on i386 and amd64.

Otherwise, please backport a6e15a39048ec3229b9a53425f4384f55f6cc1b3 and
24f2e0273f80ec262a772059e140a0adef35296d from Linus's tree. They should
apply easily to 3.15.


** Changed in: linux (Ubuntu)
   Status: Invalid = Confirmed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1329177

Title:
  CONFIG_RANDOMIZE_BASE is not enabled in utopic kernel

Status in “linux” package in Ubuntu:
  Confirmed

Bug description:
  CONFIG_RANDOMIZE_BASE is not enabled in the utopic kernel; apparently
  it does not play nicely with CONFIG_HIBERNATE.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1329177/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1329177] Re: CONFIG_RANDOMIZE_BASE is not enabled in utopic kernel

2014-06-12 Thread Kees Cook
Notes from IRC:

You can either turn off CONFIG_HIBERNATE to gain it, or write patches to
make those work together in some way. :) one idea I had that I haven't
had time to see if it could work is to make kaslr disabled by default if
CONFIG_HIBERNATE is enabled, and then if boot with kaslr on the kernel
cmdline, hibernation would get disabled. (i.e. system owner could pick
which of the two they wanted, and pre-kaslr behavior would remain distro
default).

if someone could write that, i would be very happy! :)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1329177

Title:
  CONFIG_RANDOMIZE_BASE is not enabled in utopic kernel

Status in “linux” package in Ubuntu:
  Incomplete

Bug description:
  CONFIG_RANDOMIZE_BASE is not enabled in the utopic kernel; apparently
  it does not play nicely with CONFIG_HIBERNATE.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1329177/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1326905] Re: precise has wrong PTRACE_EVENT_SECCOMP value

2014-06-12 Thread Kees Cook
I've confirmed this is fixed. Thanks!

$ cat /proc/version_signature 
Ubuntu 3.2.0-65.98-generic 3.2.60
$ ./seccomp_bpf_tests
...
[ RUN  ] TRACE.read_has_side_effects
[   OK ] TRACE.read_has_side_effects
[ RUN  ] TRACE.getpid_runs_normally
[   OK ] TRACE.getpid_runs_normally
...


** Tags removed: verification-needed-precise
** Tags added: verification-done-precise

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1326905

Title:
  precise has wrong PTRACE_EVENT_SECCOMP value

Status in “linux” package in Ubuntu:
  Triaged
Status in “linux” source package in Precise:
  Triaged

Bug description:
  In v3.2, there was confusion over the new PTRACE_EVENT_EXIT value.
  Ultimately, upstream fixed it, but in the precise backporting of
  seccomp, the wrong value was used:
  5cdf389aee90109e2e3d88085dea4dd5508a3be7

  As a result, seccomp filteres expecting ptrace managers don't work
  correctly on precise.

  The attached patch backports the upstream PTRACE_EVENT_EXIT value and
  restores the correct PTRACE_EVENT_SECCOMP value.

  SRU Justification:
  Impact: seccomp filters using ptrace managers don't work on precise
  Fix: fix ptrace flag numbering to match all other released kernel versions
  Testcase: https://github.com/kees/seccomp/tree/ptrace

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1326905/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1326905] [NEW] precise has wrong PTRACE_EVENT_SECCOMP value

2014-06-05 Thread Kees Cook
Public bug reported:

In v3.2, there was confusion over the new PTRACE_EVENT_EXIT value.
Ultimately, upstream fixed it, but in the precise backporting of
seccomp, the wrong value was used:
5cdf389aee90109e2e3d88085dea4dd5508a3be7

As a result, seccomp filteres expecting ptrace managers don't work
correctly on precise.

The attached patch backports the upstream PTRACE_EVENT_EXIT value and
restores the correct PTRACE_EVENT_SECCOMP value.

** Affects: linux (Ubuntu)
 Importance: Undecided
 Status: Incomplete

** Affects: linux (Ubuntu Precise)
 Importance: Undecided
 Status: Incomplete


** Tags: precise

** Also affects: linux (Ubuntu Precise)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1326905

Title:
  precise has wrong PTRACE_EVENT_SECCOMP value

Status in “linux” package in Ubuntu:
  Incomplete
Status in “linux” source package in Precise:
  Incomplete

Bug description:
  In v3.2, there was confusion over the new PTRACE_EVENT_EXIT value.
  Ultimately, upstream fixed it, but in the precise backporting of
  seccomp, the wrong value was used:
  5cdf389aee90109e2e3d88085dea4dd5508a3be7

  As a result, seccomp filteres expecting ptrace managers don't work
  correctly on precise.

  The attached patch backports the upstream PTRACE_EVENT_EXIT value and
  restores the correct PTRACE_EVENT_SECCOMP value.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1326905/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1326905] Re: precise has wrong PTRACE_EVENT_SECCOMP value

2014-06-05 Thread Kees Cook
** Description changed:

  In v3.2, there was confusion over the new PTRACE_EVENT_EXIT value.
  Ultimately, upstream fixed it, but in the precise backporting of
  seccomp, the wrong value was used:
  5cdf389aee90109e2e3d88085dea4dd5508a3be7
  
  As a result, seccomp filteres expecting ptrace managers don't work
  correctly on precise.
  
  The attached patch backports the upstream PTRACE_EVENT_EXIT value and
  restores the correct PTRACE_EVENT_SECCOMP value.
+ 
+ SRU Justification:
+ Impact: seccomp filters using ptrace managers don't work on precise
+ Fix: fix ptrace flag numbering to match all other released kernel versions
+ Testcase: https://github.com/kees/seccomp/tree/ptrace

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1326905

Title:
  precise has wrong PTRACE_EVENT_SECCOMP value

Status in “linux” package in Ubuntu:
  Triaged
Status in “linux” source package in Precise:
  Triaged

Bug description:
  In v3.2, there was confusion over the new PTRACE_EVENT_EXIT value.
  Ultimately, upstream fixed it, but in the precise backporting of
  seccomp, the wrong value was used:
  5cdf389aee90109e2e3d88085dea4dd5508a3be7

  As a result, seccomp filteres expecting ptrace managers don't work
  correctly on precise.

  The attached patch backports the upstream PTRACE_EVENT_EXIT value and
  restores the correct PTRACE_EVENT_SECCOMP value.

  SRU Justification:
  Impact: seccomp filters using ptrace managers don't work on precise
  Fix: fix ptrace flag numbering to match all other released kernel versions
  Testcase: https://github.com/kees/seccomp/tree/ptrace

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1326905/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1244627] Re: Please enable CONFIG_IMA in the ubuntu kernel

2014-01-03 Thread Kees Cook
For making sure IMA isn't enabled at boot by default, here's some
details From http://sourceforge.net/p/linux-ima/wiki/Home/

Enabling IMA
IMA was first included in the 2.6.30 kernel. For distros that enable IMA by 
default in their kernels, collecting IMA measurements simply requires rebooting 
the kernel with the boot command line parameter 'ima_tcb'. (Fedora/RHEL may 
also require the boot command line parameter 'ima=on'.)

To determine if your distro enables IMA by default, mount securityfs
(mount -t securityfs security /sys/kernel/security), if it isn't already
mounted, and then check if '/integrity/ima' exists. If it exists, IMA is
indeed enabled. On systems without IMA enabled, recompile the kernel
with the config option 'CONFIG_IMA' enabled.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1244627

Title:
  Please enable CONFIG_IMA in the ubuntu kernel

Status in “linux” package in Ubuntu:
  Fix Committed
Status in “linux” source package in Trusty:
  Fix Committed

Bug description:
  I would be doubly happy if this also went into the raring backport
  kernel.

  I chatted with apw and kees on #ubuntu-kernel earlier in the week.
  From a security engineer on our team:

  so I was mistaken. if CONFIG_IMA=y, the default policy is NULL unless
  you boot with ima_tcb=on. without ima_tcb=y, nothing is measured,
  nothing is audited, no performance/memory hit is incurred.

  Same is true for CONFIG_IMA_APPRAISE, except with the
  ima_appraise_tcb=on commandline parameter. ima appraise gives us the
  ability to sign binaries at installation time and check the signature
  at runtime.

  So we are asking that you enable CONFIG_IMA, but to not enable it via
  the kernel command line options. IMA would boot with an empty policy
  and should incur no overhead. Enterprising folks who want to run IMA
  can enable it in grub at their option.

  CONFIG_IMA=y

  and possibly:

  CONFIG_IMA_MEASURE_PCR_IDX=10
  CONFIG_IMA_AUDIT=y
  CONFIG_IMA_LSM_RULES=y

  -A

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1244627/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1244627] Re: Please enable CONFIG_IMA in the ubuntu kernel

2013-12-17 Thread Kees Cook
Moving to main linux package. Waiting for memory benchmark comparison of:
- without CONFIG_IMA
- with CONFIG_IMA
- with CONFIG_IMG + policy


** Package changed: linux-meta-lts-saucy (Ubuntu) = linux (Ubuntu)

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1244627

Title:
  Please enable CONFIG_IMA in the ubuntu kernel

Status in “linux” package in Ubuntu:
  Triaged

Bug description:
  I would be doubly happy if this also went into the raring backport
  kernel.

  I chatted with apw and kees on #ubuntu-kernel earlier in the week.
  From a security engineer on our team:

  so I was mistaken. if CONFIG_IMA=y, the default policy is NULL unless
  you boot with ima_tcb=on. without ima_tcb=y, nothing is measured,
  nothing is audited, no performance/memory hit is incurred.

  Same is true for CONFIG_IMA_APPRAISE, except with the
  ima_appraise_tcb=on commandline parameter. ima appraise gives us the
  ability to sign binaries at installation time and check the signature
  at runtime.

  So we are asking that you enable CONFIG_IMA, but to not enable it via
  the kernel command line options. IMA would boot with an empty policy
  and should incur no overhead. Enterprising folks who want to run IMA
  can enable it in grub at their option.

  CONFIG_IMA=y

  and possibly:

  CONFIG_IMA_MEASURE_PCR_IDX=10
  CONFIG_IMA_AUDIT=y
  CONFIG_IMA_LSM_RULES=y

  -A

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1244627/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1196155] Re: mei_me resets spamming dmesg

2013-12-15 Thread Kees Cook
sudo rmmod mei_me mei should stop the messages. Usually means AMT has
been disabled in the BIOS.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1196155

Title:
  mei_me resets spamming dmesg

Status in “linux” package in Ubuntu:
  Fix Released

Bug description:
  As you can see from the dmesg attached I'm getting the following every 5-10 
seconds:
  [11332.456035] mei_me :00:03.0: reset: connect/disconnect timeout.
  [11332.456044] mei_me :00:03.0: unexpected reset: dev_state = RESETTING

  This was happening with raring but I blacklisted the mei module. With
  saucy it seems mei is included directly and is no longer loaded as a
  module.

  ProblemType: Bug
  DistroRelease: Ubuntu 13.10
  Package: linux-image-3.10.0-1-generic 3.10.0-1.8
  ProcVersionSignature: Ubuntu 3.10.0-1.8-generic 3.10.0-rc7
  Uname: Linux 3.10.0-1-generic x86_64
  ApportVersion: 2.10.2-0ubuntu3
  Architecture: amd64
  AudioDevicesInUse:
   USERPID ACCESS COMMAND
   /dev/snd/controlC1:  herb   2330 F pulseaudio
   /dev/snd/controlC0:  herb   2330 F pulseaudio
  CRDA: Error: command ['iw', 'reg', 'get'] failed with exit code 1: nl80211 
not found.
  Date: Sat Jun 29 18:57:30 2013
  EcryptfsInUse: Yes
  HibernationDevice: RESUME=UUID=878dad1b-8d2b-4879-8dea-862befaf67b9
  InstallationDate: Installed on 2013-01-23 (157 days ago)
  InstallationMedia: Ubuntu 12.04 LTS Precise Pangolin - Release amd64 
(20120425)
  IwConfig:
   eth0  no wireless extensions.
   
   lono wireless extensions.
  MachineType: Hewlett-Packard HP Compaq dc7700p Convertible Minitower
  MarkForUpload: True
  ProcEnviron:
   TERM=xterm-256color
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=set
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcFB: 0 inteldrmfb
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.10.0-1-generic 
root=UUID=bcaf6352-17f6-4fa2-af31-127c04f60e6e ro quiet splash vt.handoff=7
  RelatedPackageVersions:
   linux-restricted-modules-3.10.0-1-generic N/A
   linux-backports-modules-3.10.0-1-generic  N/A
   linux-firmware1.110
  RfKill:
   
  SourcePackage: linux
  UpgradeStatus: Upgraded to saucy on 2013-06-29 (0 days ago)
  dmi.bios.date: 08/14/2007
  dmi.bios.vendor: Hewlett-Packard
  dmi.bios.version: 786E1 v03.03
  dmi.board.name: 0A58h
  dmi.board.vendor: Hewlett-Packard
  dmi.chassis.asset.tag: 2UA741121G
  dmi.chassis.type: 6
  dmi.chassis.vendor: Hewlett-Packard
  dmi.modalias: 
dmi:bvnHewlett-Packard:bvr786E1v03.03:bd08/14/2007:svnHewlett-Packard:pnHPCompaqdc7700pConvertibleMinitower:pvr:rvnHewlett-Packard:rn0A58h:rvr:cvnHewlett-Packard:ct6:cvr:
  dmi.product.name: HP Compaq dc7700p Convertible Minitower
  dmi.sys.vendor: Hewlett-Packard

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1196155/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1183616] Re: seccomp-bpf missing on ARM in precise

2013-11-25 Thread Kees Cook
My testing was with a Debian userspace. I don't have a functional Ubuntu
ARM environment. I can boot rebuilt kernels in KVM.

Can you just adjust the header file to get it compiled? I have no idea
why __NR_time is stripped out like that. It's a valid syscall.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1183616

Title:
  seccomp-bpf missing on ARM in precise

Status in “linux” package in Ubuntu:
  Triaged
Status in “linux” source package in Precise:
  Triaged

Bug description:
  While seccomp-bpf was backported into precise, it was only for x86.
  Now that the ARM support is upstream too, it would be great to have
  the same level of support on ARM in the LTS kernel.

  I'll prepare patches.

  [Impact]
  ARM devices lack seccomp-bpf protections when running seccomp-aware 
applications (e.g. Chrome)

  [Test Case]
  git clone https://github.com/redpig/seccomp.git
  cd seccomp/tests
  make
  ./seccomp_bpf_tests
  All tests should pass

  [Regression Potential]
  Low: ARM currently has no seccomp-bpf support, so this is very unlikely to 
cause regressions. The changes that are common between x86 and ARM bring 
Precise closer to upstream seccomp-bpf, so this is similarly unlike to cause 
regressions (as this code is more correct than what is currently in Precise). 
Changes have been minimized, and tested.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1183616/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp


[Kernel-packages] [Bug 1183616] Re: seccomp-bpf missing on ARM in precise

2013-11-06 Thread Kees Cook
** Description changed:

  While seccomp-bpf was backported into precise, it was only for x86. Now
  that the ARM support is upstream too, it would be great to have the same
  level of support on ARM in the LTS kernel.
  
  I'll prepare patches.
+ 
+ [Impact]
+ ARM devices lack seccomp-bpf protections when running seccomp-aware 
applications (e.g. Chrome)
+ 
+ [Test Case]
+ git clone https://github.com/redpig/seccomp.git
+ cd seccomp/tests
+ make
+ ./seccomp_bpf_tests
+ All tests should pass
+ 
+ [Regression Potential]
+ Low: ARM currently has no seccomp-bpf support, so this is very unlikely to 
cause regressions. The changes that are common between x86 and ARM bring 
Precise closer to upstream seccomp-bpf, so this is similarly unlike to cause 
regressions (as this code is more correct than what is currently in Precise). 
Changes have been minimized, and tested.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1183616

Title:
  seccomp-bpf missing on ARM in precise

Status in “linux” package in Ubuntu:
  Triaged
Status in “linux” source package in Precise:
  Triaged

Bug description:
  While seccomp-bpf was backported into precise, it was only for x86.
  Now that the ARM support is upstream too, it would be great to have
  the same level of support on ARM in the LTS kernel.

  I'll prepare patches.

  [Impact]
  ARM devices lack seccomp-bpf protections when running seccomp-aware 
applications (e.g. Chrome)

  [Test Case]
  git clone https://github.com/redpig/seccomp.git
  cd seccomp/tests
  make
  ./seccomp_bpf_tests
  All tests should pass

  [Regression Potential]
  Low: ARM currently has no seccomp-bpf support, so this is very unlikely to 
cause regressions. The changes that are common between x86 and ARM bring 
Precise closer to upstream seccomp-bpf, so this is similarly unlike to cause 
regressions (as this code is more correct than what is currently in Precise). 
Changes have been minimized, and tested.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1183616/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp