APPLIED: [SRU][N][PATCH 0/1] UBUNTU: SAUCE: integrity: Load MokListRT certs into the machine keyring

[Mehmet Basaran]

Applied to noble:linux master-next branch. Thanks.

-------------- next part --------------
Dean Marx via kernel-team <kernel-team at lists.ubuntu.com> writes:

> BugLink: https://bugs.launchpad.net/bugs/2131181
>
> SRU Justification:
>
> [Impact]
>
> Certificates imported with mokutil and enrolled through MokManager are
> loaded into the .platform keyring instead of the .machine keyring. MOK
> certificates are therefore assigned to the platform keyring rather than
> the machine keyring intended for Machine Owner Keys.
>
> [Fix]
>
> Restore get_handler_for_mok() as the default signature-list handler for
> MokListRT. MokListXRT continues to use get_handler_for_dbx(), preserving
> the existing EFI MOKvar config-table support for large revocation lists.
>
> [Test Plan]
>
> On a Noble system, enroll a test certificate with mokutil and MokManager,
> then verify that it is loaded into the .machine keyring and not the
> .platform keyring. Confirm that MokListXRT continues to use its dbx
> handler, including the MOKvar config-table path for large lists.
>
> [Where problems could occur]
>
> The change affects which keyring receives certificates parsed from
> MokListRT. The risk is limited to that handler selection, MokListXRT
> continues to select its existing dbx handler. Systems relying on the
> previous placement of MokListRT certificates in the platform
> keyring could see a change in keyring contents.
>
> [Other Info]
>
> Reverting the earlier SAUCE change would also remove its MokListXRT
> MOKvar config table support. This targeted correction retains that
> support while restoring the MokListRT behavior expected for MOK
> certificates.
>
> Dean Marx (1):
>    UBUNTU: SAUCE: integrity: Load MokListRT certs into the machine keyring
>
>  security/integrity/platform_certs/load_uefi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> --
> 2.53.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20261009/64a09733/attachment.sig>