** Description changed:
[Impact]
Compressed kernels as we have on arm64 cause grub to fail in two ways:
1. In all versions, grub-check-signatures will fail to verify the
binaries using sbverify, complain about that in debconf, and then abort
the installation/upgrade of grub-efi-arm64-signed
2. In 2.06, the verifiers framework runs before any decompression,
causing the kernels to fail verification, as it tries to verify the
compressed data. In grub 2.04, we manually verified the file after we
had opened it (hence after all filters).
+ The rest of the SRU template only refers to point 1, as point 2 only
+ applies to the development series jammy.
+
[Attack plan]
+
1. Modify grub-check-signatures to optionally decompress kernels before
passing them to sbverify
2. Modify grub to either
- a) verify after decompress
- b) disable shim_lock verifier on arm64, and only use the rhboot
+ a) verify after decompress
+ b) disable shim_lock verifier on arm64, and only use the rhboot
We do not know if this is a long-term solution, we really should migrate
back to kernels that are proper EFI executables themselves such that we
can use standard EFI functions to run them as well.
[Test plan]
- TBD
+
+ On a secure boot ARM64 VM:
+
+ 1) Run grub-check-signatures to ensure it verifies the kernels
+ successfully
[Where problems could occur]
- TBD
+ We only modify the grub-check-signatures script in the SRU to add
decompression. This could change the behavior of the script, and introduce new
bugs that cause false positives or false negatives.
** Changed in: grub2-unsigned (Ubuntu Jammy)
Status: New => Fix Committed
** Package changed: grub2-unsigned (Ubuntu Focal) => grub2 (Ubuntu
Focal)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1954683
Title:
grub is missing secure boot support for compressed kernels (our arm64
kernels)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1954683/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
