<div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 30 Nov 2021, 13:17 Tim Gardner, <<a href="mailto:tim.gardner@canonical.com" target="_blank" rel="noreferrer">tim.gardner@canonical.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Acked-by: Tim Gardner <<a href="mailto:tim.gardner@canonical.com" rel="noreferrer noreferrer" target="_blank">tim.gardner@canonical.com</a>><br>
<br>
What is the provenance of patches 5/6 ? They look like they came from a <br>
stable update in one of our repos. They are also missing your S-O-B.<br></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Yes, sorry about my missing S-O-B.</div><div dir="auto"><br></div><div dir="auto">The provenance of those patches is that without them kernel does not load asymmetric keys from dbx or moklistx. In 2019/2020 an attempt was made to revoke all grubs and kernels signed by the 2012 key by publishing said key in <a href="http://uefi.org">uefi.org</a> dbx and in Ubuntu shim. This preventing booting vulnerable grubs and kernels, but did not prevent kexec from fixed kernels to 2012 signed ones. In order for us to be able to revoke signing keys out of band in the future kernels must learn to load assymetric keys from dbx and moklistx into blacklist keyring. These patches are present in focal+ kernels.</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 11/30/21 4:04 AM, Dimitri John Ledkov wrote:<br>
> BugLink: <a href="https://bugs.launchpad.net/bugs/1928679" rel="noreferrer noreferrer noreferrer" target="_blank">https://bugs.launchpad.net/bugs/1928679</a><br>
> BugLink: <a href="https://bugs.launchpad.net/bugs/1932029" rel="noreferrer noreferrer noreferrer" target="_blank">https://bugs.launchpad.net/bugs/1932029</a><br>
> <br>
> Same story as before, backport support for builtin revoked<br>
> certificates, add support loading revoked certificates from<br>
> mokvar-table.<br>
> <br>
> Some of the patches had to be adjusted during backport. For example,<br>
> instead of patching security/integrity/platform_certs/load_uefi.c<br>
> which does not exist in v4.15 kernel certs/load_uefi.c is. Some error<br>
> handling is done differently as well. For example, EFI status not<br>
> found is not handled when loading keys from variables.<br>
> <br>
> This series doesn't have any reverts, as the lockdown patchset is<br>
> mostly older without any major reorgs that didn't make upstream. It is<br>
> slightly larger than focal's one as support for EFI_CERT_X509_GUID did<br>
> not land via linux-stable updates.<br>
> <br>
> After this patch is applied, the RT boot testing & kernel built-in<br>
> final check will catch any kernels that do not have<br>
> CONFIG_SYSTEM_REVOCATION_KEYS set. In bionic, this may trip up raspi2,<br>
> snapdgaron, kvm flavours as they in theory can support UEFI, but are<br>
> not signed and may not enable all the lockdown and keyring<br>
> features. These flavours may need reverting 70de61082d ("UBUNTU:<br>
> [Packaging] Add system trusted and revocation keys final check") as<br>
> was done in Focal. Or enable all the keyrings and builtin revocation<br>
> keys.<br>
> <br>
> Focal patches already reviewed and applied:<br>
> <br>
> <a href="https://lists.ubuntu.com/archives/kernel-team/2021-October/124497.html" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.ubuntu.com/archives/kernel-team/2021-October/124497.html</a><br>
> <br>
> The following changes since commit 8233475840ca94121170efeaa4f661c7029ac576:<br>
> <br>
> UBUNTU: Ubuntu-4.15.0-164.172 (2021-11-26 17:31:19 -0700)<br>
> <br>
> are available in the Git repository at:<br>
> <br>
> <a href="https://git.launchpad.net/~xnox/ubuntu/+source/linux/+git/bionic" rel="noreferrer noreferrer noreferrer" target="_blank">https://git.launchpad.net/~xnox/ubuntu/+source/linux/+git/bionic</a> revocation-keys<br>
> <br>
> for you to fetch changes up to 750558eb34dd84c912dbe004aca41987665535d5:<br>
> <br>
> UBUNTU: [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys (2021-11-30 10:44:16 +0000)<br>
> <br>
> This pull request can also be reviewed on launchpad at:<br>
> <br>
> <a href="https://code.launchpad.net/~xnox/ubuntu/+source/linux/+git/bionic/+merge/412577" rel="noreferrer noreferrer noreferrer" target="_blank">https://code.launchpad.net/~xnox/ubuntu/+source/linux/+git/bionic/+merge/412577</a><br>
> <br>
> Ard Biesheuvel (2):<br>
> efi: mokvar-table: fix some issues in new code<br>
> efi: mokvar: add missing include of asm/early_ioremap.h<br>
> <br>
> Borislav Petkov (1):<br>
> efi/mokvar: Reserve the table only if it is in boot services data<br>
> <br>
> Dimitri John Ledkov (5):<br>
> UBUNTU: SAUCE: integrity: Load mokx certs from the EFI MOK config<br>
> table<br>
> UBUNTU: SAUCE: integrity: add informational messages when revoking<br>
> certs<br>
> UBUNTU: [Packaging] build canonical-revoked-certs.pem from branch/arch<br>
> certs<br>
> UBUNTU: [Packaging] Revoke 2012 UEFI signing certificate as built-in<br>
> UBUNTU: [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked<br>
> keys<br>
> <br>
> Eric Snowberg (3):<br>
> certs: Add EFI_CERT_X509_GUID support for dbx entries<br>
> certs: Move load_system_certificate_list to a common function<br>
> certs: Add ability to preload revocation certs<br>
> <br>
> Lenny Szubowicz (3):<br>
> efi: Support for MOK variable config table<br>
> integrity: Move import of MokListRT certs to a separate routine<br>
> integrity: Load certs from the EFI MOK config table<br>
> <br>
> Linus Torvalds (1):<br>
> certs: add 'x509_revocation_list' to gitignore<br>
> <br>
> Tim Gardner (1):<br>
> UBUNTU: SAUCE: Dump stack when X.509 certificates cannot be loaded<br>
> <br>
> arch/x86/kernel/setup.c | 1 +<br>
> certs/.gitignore | 1 +<br>
> certs/Kconfig | 17 +<br>
> certs/Makefile | 21 +-<br>
> certs/blacklist.c | 67 ++++<br>
> certs/blacklist.h | 2 +<br>
> certs/common.c | 58 +++<br>
> certs/common.h | 9 +<br>
> certs/load_uefi.c | 109 +++++-<br>
> certs/revocation_certificates.S | 21 +<br>
> certs/system_keyring.c | 57 +--<br>
> debian.master/config/annotations | 1 +<br>
> debian.master/config/config.common.ubuntu | 2 +<br>
> .../revoked-certs/canonical-uefi-2012-all.pem | 86 +++++<br>
> debian/rules | 14 +-<br>
> drivers/firmware/efi/Makefile | 1 +<br>
> drivers/firmware/efi/arm-init.c | 1 +<br>
> drivers/firmware/efi/efi.c | 9 +<br>
> drivers/firmware/efi/mokvar-table.c | 362 ++++++++++++++++++<br>
> include/keys/system_keyring.h | 15 +<br>
> include/linux/efi.h | 34 ++<br>
> scripts/Makefile | 1 +<br>
> 22 files changed, 824 insertions(+), 65 deletions(-)<br>
> create mode 100644 certs/common.c<br>
> create mode 100644 certs/common.h<br>
> create mode 100644 certs/revocation_certificates.S<br>
> create mode 100644 debian/revoked-certs/canonical-uefi-2012-all.pem<br>
> create mode 100644 drivers/firmware/efi/mokvar-table.c<br>
> <br>
<br>
-- <br>
-----------<br>
Tim Gardner<br>
Canonical, Inc<br>
</blockquote></div></div></div>