[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Changed in: ubuntu-power-systems Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: Fix Released Status in linux package in Ubuntu: Fix Released Status in linux-signed package in Ubuntu: Fix Released Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
This bug was fixed in the package linux-signed - 4.15.0-19.20 --- linux-signed (4.15.0-19.20) bionic; urgency=medium * Master version: 4.15.0-19.20 linux-signed (4.15.0-18.19+signed2) bionic; urgency=medium * Fix dbgsym package handling to work for the case where we have a bumped linux-signed version number. linux-signed (4.15.0-18.19+signed1) bionic; urgency=medium * Fix the dbgsym packages to be correctly named as .ddeb instead of .deb so they are published to the right archive. linux-signed (4.15.0-18.19) bionic; urgency=medium * Master version: 4.15.0-18.19 * signing: only install a signed kernel (LP: #1764794) - switch to raw-signing tarball form - make control.stub master for packages built - [Config] tone down the output verbosity - switch to producing linux-image directly - propogate control information from -unsigned package - pull control files in from linux-unsigned - resync control files with master - introduce meta packages for the debug package - fix names of substvars files - propogate Recommends: and Provides: from unsigned package - fix Section: control records - do not produce lowlatency dbgsym package for ppc64el - move dbgsym packages to bottom of control file - ensure we apt-cache show against the exact version * [18.04 FEAT] Sign POWER host/NV kernels (LP: #1696154) - add Opal signing support and enable for ppc64el linux-signed (4.15.0-17.18) bionic; urgency=medium * Master version: 4.15.0-17.18 linux-signed (4.15.0-16.17) bionic; urgency=medium * Master version: 4.15.0-16.17 -- Seth Forshee Sat, 21 Apr 2018 17:32:56 -0500 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: Fix Committed Status in linux package in Ubuntu: Fix Released Status in linux-signed package in Ubuntu: Fix Released Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
This bug was fixed in the package linux - 4.15.0-19.20 --- linux (4.15.0-19.20) bionic; urgency=medium * linux: 4.15.0-19.20 -proposed tracker (LP: #1766021) * Kernel 4.15.0-15 breaks Dell PowerEdge 12th Gen servers (LP: #1765232) - Revert "blk-mq: simplify queue mapping & schedule with each possisble CPU" - Revert "genirq/affinity: assign vectors to all possible CPUs" linux (4.15.0-18.19) bionic; urgency=medium * linux: 4.15.0-18.19 -proposed tracker (LP: #1765490) * [regression] Ubuntu 18.04:[4.15.0-17-generic #18] KVM Guest Kernel: meltdown: rfi/fallback displacement flush not enabled bydefault (kvm) (LP: #1765429) - powerpc/pseries: Fix clearing of security feature flags * signing: only install a signed kernel (LP: #1764794) - [Packaging] update to Debian like control scripts - [Packaging] switch to triggers for postinst.d postrm.d handling - [Packaging] signing -- switch to raw-signing tarballs - [Packaging] signing -- switch to linux-image as signed when available - [Config] signing -- enable Opal signing for ppc64el - [Packaging] printenv -- add signing options * [18.04 FEAT] Sign POWER host/NV kernels (LP: #1696154) - [Packaging] signing -- add support for signing Opal kernel binaries * Please cherrypick s390 unwind fix (LP: #1765083) - s390/compat: fix setup_frame32 * Ubuntu 18.04 installer does not detect any IPR based HDD/RAID array [S822L] [ipr] (LP: #1751813) - d-i: move ipr to storage-core-modules on ppc64el * drivers/gpu/drm/bridge/adv7511/adv7511.ko missing (LP: #1764816) - SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm * Miscellaneous Ubuntu changes - [Packaging] Add linux-oem to rebuild test blacklist. linux (4.15.0-17.18) bionic; urgency=medium * linux: 4.15.0-17.18 -proposed tracker (LP: #1764498) * Eventual OOM with profile reloads (LP: #1750594) - SAUCE: apparmor: fix memory leak when duplicate profile load linux (4.15.0-16.17) bionic; urgency=medium * linux: 4.15.0-16.17 -proposed tracker (LP: #1763785) * [18.04] [bug] CFL-S(CNP)/CNL GPIO testing failed (LP: #1757346) - [Config]: Set CONFIG_PINCTRL_CANNONLAKE=y * [Ubuntu 18.04] USB Type-C test failed on GLK (LP: #1758797) - SAUCE: usb: typec: ucsi: Increase command completion timeout value * Fix trying to "push" an already active pool VP (LP: #1763386) - SAUCE: powerpc/xive: Fix trying to "push" an already active pool VP * hisi_sas: Revert and replace SAUCE patches w/ upstream (LP: #1762824) - Revert "UBUNTU: SAUCE: scsi: hisi_sas: export device table of v3 hw to userspace" - Revert "UBUNTU: SAUCE: scsi: hisi_sas: config for hip08 ES" - scsi: hisi_sas: modify some register config for hip08 - scsi: hisi_sas: add v3 hw MODULE_DEVICE_TABLE() * Realtek card reader - RTS5243 [VEN_10EC&DEV_5260] (LP: #1737673) - misc: rtsx: Move Realtek Card Reader Driver to misc - updateconfigs for Realtek Card Reader Driver - misc: rtsx: Add support for RTS5260 - misc: rtsx: Fix symbol clashes * Mellanox [mlx5] [bionic] UBSAN: Undefined behaviour in ./include/linux/net_dim.h (LP: #1763269) - net/mlx5e: Fix int overflow * apparmor bug fixes for bionic (LP: #1763427) - apparmor: fix logging of the existence test for signals - apparmor: make signal label match work when matching stacked labels - apparmor: audit unknown signal numbers - apparmor: fix memory leak on buffer on error exit path - apparmor: fix mediation of prlimit * dangling symlinks to loaded apparmor policy (LP: #1755563) // apparmor bug fixes for bionic (LP: #1763427) - apparmor: fix dangling symlinks to policy rawdata after replacement * [OPAL] Assert fail: core/mem_region.c:447:lock_held_by_me(®ion->free_list_lock) (LP: #1762913) - powerpc/watchdog: remove arch_trigger_cpumask_backtrace * [LTC Test] Ubuntu 18.04: tm_trap_test failed on P8 compat mode guest (LP: #1762928) - powerpc/tm: Fix endianness flip on trap * Add support for RT5660 codec based sound cards on Baytrail (LP: #1657674) - SAUCE: (no-up) ASoC: Intel: Support machine driver for RT5660 on Baytrail - SAUCE: (no-up) ASoC: rt5660: Add ACPI support - SAUCE: (no-up): ASoC: Intel: bytcr-rt5660: Add MCLK, quirks - [Config] CONFIG_SND_SOC_INTEL_BYTCR_RT5660_MACH=m, CONFIG_SND_SOC_RT5660=m * /dev/ipmi enumeration flaky on Cavium Sabre nodes (LP: #1762812) - i2c: xlp9xx: return ENXIO on slave address NACK - i2c: xlp9xx: Handle transactions with I2C_M_RECV_LEN properly - i2c: xlp9xx: Check for Bus state before every transfer - i2c: xlp9xx: Handle NACK on DATA properly * [18.04 FEAT] Add kvm_stat from kernel tree (LP: #1734130) - tools/kvm_stat: simplify the sortkey function - tools/kvm_stat: use a namedtuple for storing the values - tools/kvm_stat: use a more pythonic way to iterate over dictionaries - tools/kv
Re: [Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
Thanks For Catching/Noticing and making repairs an adjustments On Mon, Apr 23, 2018, 10:51 AM Launchpad Bug Tracker < 1696...@bugs.launchpad.net> wrote: > ** Branch linked: lp:~ubuntu-core-dev/debian-installer/ubuntu > > -- > You received this bug notification because you are subscribed to > Launchpad itself. > Matching subscriptions: Anthony > https://bugs.launchpad.net/bugs/1696154 > > Title: > [18.04 FEAT] Sign POWER host/NV kernels > > Status in Launchpad itself: > Fix Released > Status in The Ubuntu-power-systems project: > Fix Committed > Status in linux package in Ubuntu: > Fix Committed > Status in linux-signed package in Ubuntu: > Fix Committed > > Bug description: > Feature Description: > > Sign POWER host and NV kernels with sign-file in anticipation of POWER > secure boot. Provide the associated certificate. Ideally it would > be possible to reuse the UEFI shim private key and certificate used to > sign and verify x86_64 kernels. More details to follow. Guest > kernels will be addressed in a future separate feature request. > > > Business Case: > > As a system administrator I want to verify the integrity of my kernels > so that I can prevent malicious kernels from being executed. > > Use Case: > > Signed POWER kernels will be validated by OPAL as OpenPOWER systems > boot when keys are properly installed and the system is booted in > secure mode. > > > Test Case: > > Sign and install a POWER kernel on an OpenPOWER machine with a > firmware level that supports secure boot. Install a PK, distro KEK > certificat, and distro DB certificate. Boot the system and verify > that it will boot the kernel. Negative tests: Separately remove the > signature, install an usigned kernel, and modify the kernel image and > test that the kernel will not boot. > > To manage notifications about this bug go to: > https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions > -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: Fix Committed Status in linux package in Ubuntu: Fix Committed Status in linux-signed package in Ubuntu: Fix Committed Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Branch linked: lp:~ubuntu-core-dev/debian-installer/ubuntu -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: Fix Committed Status in linux package in Ubuntu: Fix Committed Status in linux-signed package in Ubuntu: Fix Committed Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Changed in: ubuntu-power-systems Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: Fix Committed Status in linux package in Ubuntu: Fix Committed Status in linux-signed package in Ubuntu: Fix Committed Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Changed in: linux-signed (Ubuntu) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: In Progress Status in linux package in Ubuntu: Fix Committed Status in linux-signed package in Ubuntu: Fix Committed Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Changed in: linux (Ubuntu) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: In Progress Status in linux package in Ubuntu: Fix Committed Status in linux-signed package in Ubuntu: In Progress Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
[Kernel-packages] [Bug 1696154] Re: [18.04 FEAT] Sign POWER host/NV kernels
** Summary changed: - [17.10 FEAT] Sign POWER host/NV kernels + [18.04 FEAT] Sign POWER host/NV kernels ** Changed in: linux (Ubuntu) Milestone: None => ubuntu-18.04 ** Changed in: linux-signed (Ubuntu) Milestone: None => ubuntu-18.04 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-signed in Ubuntu. https://bugs.launchpad.net/bugs/1696154 Title: [18.04 FEAT] Sign POWER host/NV kernels Status in Launchpad itself: Fix Released Status in The Ubuntu-power-systems project: In Progress Status in linux package in Ubuntu: In Progress Status in linux-signed package in Ubuntu: In Progress Bug description: Feature Description: Sign POWER host and NV kernels with sign-file in anticipation of POWER secure boot. Provide the associated certificate. Ideally it would be possible to reuse the UEFI shim private key and certificate used to sign and verify x86_64 kernels. More details to follow. Guest kernels will be addressed in a future separate feature request. Business Case: As a system administrator I want to verify the integrity of my kernels so that I can prevent malicious kernels from being executed. Use Case: Signed POWER kernels will be validated by OPAL as OpenPOWER systems boot when keys are properly installed and the system is booted in secure mode. Test Case: Sign and install a POWER kernel on an OpenPOWER machine with a firmware level that supports secure boot. Install a PK, distro KEK certificat, and distro DB certificate. Boot the system and verify that it will boot the kernel. Negative tests: Separately remove the signature, install an usigned kernel, and modify the kernel image and test that the kernel will not boot. To manage notifications about this bug go to: https://bugs.launchpad.net/launchpad/+bug/1696154/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
