[SRU][N][RFC PATCH 0/1] UBUNTU: SAUCE: Restore MokListRT machine-keyring handling

[Dean Marx]

Hello,

This SAUCE patch addresses LP: #2131181, where a certificate imported with
mokutil and enrolled through MokManager is loaded into the .platform
keyring rather than the .machine keyring.

The regression appears to have been introduced by 0ba9d5044222 ("UBUNTU: 
SAUCE: integrity: Load mokx certs from the EFI MOK config table")

That patch refactored load_moklist_certs() to handle both MokListRT and
MokListXRT. Before the refactor, MokListRT was parsed with
get_handler_for_mok(). The refactored code instead defaults to
get_handler_for_db(), which routes MokListRT certificates to the
platform keyring.

This patch restores get_handler_for_mok() as the default handler. The
MokListXRT case still explicitly selects get_handler_for_dbx().

I considered reverting the SAUCE patch that introduced the bug,
but it adds MOKvar config-table support for MokListXRT. That support
is needed when a large MokListXRT is split into MokListXRT{1,2,3},
and the original patch states it was required to address CVE-2020-26541
with Ubuntu's shim 15.4-based implementation.

Is the targeted handler correction the preferred fix, or should
the SAUCE patch be reverted and its MokListXRT functionality reworked
separately? Any feedback would be greatly appreciated.

BugLink: https://bugs.launchpad.net/bugs/2131181

Dean Marx (1):
  UBUNTU: SAUCE: integrity: Load MokListRT certs into the machine
    keyring

 security/integrity/platform_certs/load_uefi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.53.0