[Bug 1789918] Re: grub2 signed kernel enforcement doesn't check on upgrade that signatures are from trusted keys

[Steve Langasek]

Hello Brad, or anyone else affected,

Accepted grub2 into trusty-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-9ubuntu1.17 in a
few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-trusty to verification-done-trusty. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-trusty. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: grub2 (Ubuntu Trusty)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-trusty

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to mokutil in Ubuntu.
Matching subscriptions: mokutil-bugs
https://bugs.launchpad.net/bugs/1789918

Title:
  grub2 signed kernel enforcement doesn't check on upgrade that
  signatures are from trusted keys

Status in grub2 package in Ubuntu:
  Fix Released
Status in mokutil package in Ubuntu:
  Fix Released
Status in grub2 source package in Trusty:
  Fix Committed
Status in grub2 source package in Bionic:
  Fix Released
Status in grub2 source package in Cosmic:
  Fix Released

Bug description:
  [Impact]
  This affects UEFI users upgrading grub, especially when upgrading from an earlier release or when using custom kernels (signed by PPA keys, or unsigned).

  [Test case]
  1) Install a custom / PPA kernel, or copy an existing kernel into an unsigned version of it:

  sudo cp /boot/vmlinuz-4.11.0-11-generic
  /boot/vmlinuz-4.11.0-11-lp1789918

  2) Make sure the kernel is unsigned or signed with an unknown key (in
  this case, remove signature for convenience):

  sudo sbattach --remove /boot/vmlinuz-4.11.0-11-lp1789918

  3) Upgrade grub2.

  4) Validate that the upgrade fails, and complains about incorrectly
  signed kernels for the new "vmlinuz-4.11.0-11-lp1789918", or other
  incorrectly signed kernels present, newer than the currently running
  kernel.

  5) Run /usr/share/grub/grub-check-signatures. Validate the same error
  appears as through the upgrade process.

  
  [Regression potential]
  Relatively low risk of failure. This only affects the upgrade process maintainer scripts, which run an additional script to fail the upgrade if it is detected that a newer kernel than the one currently running would be invalid for Secure Boot. This already catches invalid signatures and unsigned kernels, and mitigates against broken firmwares by shipping the certificate for the most common kernel signatures (the Canonical cert). Upgrades should already have been migrating users to forcing the signed version of kernels to be installed when the official pacakges are being used.

  Watch for upgrade failures due to false positives (correcly signed
  kernels that are detected as signed by unknown keys) or other failure
  modes of the upgrade of the grub packages. Grub functionality at boot
  has been unchanged.

  
  [Background information]
  Secure Boot will soon enforce that kernels are properly signed to be able to boot them. Catch systems early where this upgrade would break boot for our users, to ensure they can correct the situation while the system is running.

  ---

  This is on a cosmic system. I wanted to test the 4.18 kernel in the kernel teams unstable ppa. I enabled that ppa, then ran "sudo apt-get update; sudo apt-get dist-upgrade" and then rebooted. Upon boot grub started reporting that none of the kernels I have installed have valid signatures. These were working just fine before this update. The only remedy was to disable secure boot in my bios.
  ---
  ProblemType: Bug
  ApportVersion: 2.20.10-0ubuntu9
  Architecture: amd64
  CurrentDesktop: ubuntu:GNOME
  DistroRelease: Ubuntu 18.10
  EcryptfsInUse: Yes
  InstallationDate: Installed on 2017-08-14 (380 days ago)
  InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170812)
  Package: grub2 (not installed)
  ProcEnviron:
   TERM=tmux-256color
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  ProcVersionSignature: Ubuntu 4.18.0-7.8-generic 4.18.5
  Tags:  wayland-session cosmic
  Uname: Linux 4.18.0-7-generic x86_64
  UpgradeStatus: No upgrade log present (probably fresh install)
  UserGroups: adm cdrom dip kvm libvirt lpadmin plugdev sambashare sudo
  _MarkForUpload: True

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1789918/+subscriptions