[SRU][I/kvm][PATCH 1/1] UBUNTU: [Config] Enable Trusted, Platform, Secondary Keyrings
Dimitri John Ledkov
dimitri.ledkov at canonical.com
Tue Oct 5 11:14:02 UTC 2021
BugLink: https://bugs.launchpad.net/bugs/1942319
Enable keyrings required to support Platform, Built-in Trusted,
Secondary, Revoked keys and hashes.
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov at canonical.com>
---
debian.kvm/config/annotations | 5 +++++
debian.kvm/config/config.common.ubuntu | 18 ++++++++++++++----
2 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/debian.kvm/config/annotations b/debian.kvm/config/annotations
index a0de0feb0e..10c963254d 100644
--- a/debian.kvm/config/annotations
+++ b/debian.kvm/config/annotations
@@ -8,6 +8,11 @@ CONFIG_MODVERSIONS mark<ENFORCED> note<LP: #1898716>
CONFIG_SYSTEM_TRUSTED_KEYS policy<{'amd64': '"debian/canonical-certs.pem"'}>
CONFIG_SYSTEM_TRUSTED_KEYS mark<ENFORCED> note<LP: #1898716>
+CONFIG_LOAD_UEFI_KEYS policy<{'amd64': 'y'}>
+CONFIG_SYSTEM_REVOCATION_KEYS policy<{'amd64': '"debian/canonical-revoked-certs.pem"'}>
+CONFIG_LOAD_UEFI_KEYS mark<ENFORCED> note<LP: #1942319>
+CONFIG_SYSTEM_REVOCATION_KEYS mark<ENFORCED> note<LP: #1942319>
+
CONFIG_BLK_DEV_RAM policy<{'amd64': 'm'}>
CONFIG_BLK_DEV_RAM mark<ENFORCED> note<LP: #1873809>
diff --git a/debian.kvm/config/config.common.ubuntu b/debian.kvm/config/config.common.ubuntu
index d7f55812d6..a06bc85299 100644
--- a/debian.kvm/config/config.common.ubuntu
+++ b/debian.kvm/config/config.common.ubuntu
@@ -1230,6 +1230,7 @@ CONFIG_IA32_FEAT_CTL=y
CONFIG_IKHEADERS=m
CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
# CONFIG_IMA is not set
+# CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY is not set
# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
CONFIG_INET=y
CONFIG_INET6_AH=m
@@ -1282,8 +1283,11 @@ CONFIG_INPUT_EVDEV=y
CONFIG_INSTRUCTION_DECODER=y
# CONFIG_INT340X_THERMAL is not set
CONFIG_INTEGRITY=y
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_AUDIT=y
-# CONFIG_INTEGRITY_SIGNATURE is not set
+CONFIG_INTEGRITY_PLATFORM_KEYRING=y
+CONFIG_INTEGRITY_SIGNATURE=y
+CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEL_IDLE=y
# CONFIG_INTEL_ISH_HID is not set
# CONFIG_INTEL_MEI is not set
@@ -1454,6 +1458,7 @@ CONFIG_KERNEL_LZ4=y
# CONFIG_KERNEL_ZSTD is not set
CONFIG_KERNFS=y
CONFIG_KEXEC=y
+# CONFIG_KEXEC_BZIMAGE_VERIFY_SIG is not set
CONFIG_KEXEC_CORE=y
CONFIG_KEXEC_FILE=y
CONFIG_KEXEC_SIG=y
@@ -1498,6 +1503,7 @@ CONFIG_LIBNVDIMM=y
CONFIG_LLC=y
# CONFIG_LLC2 is not set
CONFIG_LLD_VERSION=0
+CONFIG_LOAD_UEFI_KEYS=y
CONFIG_LOCALVERSION=""
# CONFIG_LOCALVERSION_AUTO is not set
CONFIG_LOCKD=m
@@ -2431,7 +2437,7 @@ CONFIG_SCSI_VIRTIO=y
CONFIG_SECCOMP=y
# CONFIG_SECCOMP_CACHE_DEBUG is not set
CONFIG_SECCOMP_FILTER=y
-# CONFIG_SECONDARY_TRUSTED_KEYRING is not set
+CONFIG_SECONDARY_TRUSTED_KEYRING=y
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
CONFIG_SECURITY=y
CONFIG_SECURITYFS=y
@@ -2510,7 +2516,8 @@ CONFIG_SHIFT_FS_POSIX_ACL=y
CONFIG_SHMEM=y
CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
CONFIG_SIGNALFD=y
-# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set
+CONFIG_SIGNATURE=y
+CONFIG_SIGNED_PE_FILE_VERIFICATION=y
# CONFIG_SIOX is not set
CONFIG_SKB_EXTENSIONS=y
# CONFIG_SLAB is not set
@@ -2599,10 +2606,13 @@ CONFIG_SYSCTL_EXCEPTION_TRACE=y
CONFIG_SYSFS=y
# CONFIG_SYSFS_DEPRECATED is not set
# CONFIG_SYSFS_SYSCALL is not set
-# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
+CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
+CONFIG_SYSTEM_BLACKLIST_KEYRING=y
CONFIG_SYSTEM_DATA_VERIFICATION=y
CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
+CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"
+CONFIG_SYSTEM_REVOCATION_LIST=y
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"
CONFIG_SYSVIPC=y
--
2.30.2
More information about the kernel-team
mailing list