** Description changed:

  [ Impact ]
  
  UEFI GRUB2 in Oracular Oriole enforces NX_COMPAT even when used with a
  non-NX shim.
  
  Kernels in Oracular Oriole support NX_COMPAT.
  
  The impact is limited to failing to chainload other non-NX compatible
  operating systems from GRUB2.
  
  The most common such operating system is Windows 10, most installations
  of which do not have a NX compatible bootloader according to Microsoft.
  
  [ Test Plan ]
  
  1. Set up (or take an existing) machine with Ubuntu Oracular Oriole and
  Windows 10 in a dual boot configuration.
  
  2. Verify that `objdump -x /boot/efi/efi/microsoft/boot/bootmgfw.efi`
  does not show NX_COMPAT under DllCharacteristics.
  
  3. Verify that Windows 10 fails to boot via the os-prober created GRUB
  menu entry.
  
  4. Update grub-efi-amd64-signed to the version from oracular-proposed.
  
  5. Verify that Windows 10 successfully boots via the os-prober created
  GRUB menu entry.
  
  6. Switch to the NX shim using `update-alternatives --set
  shimx64.efi.signed /usr/lib/shim/shimx64.nx.efi.signed.latest && dpkg-
  reconfigure shim-signed`
  
  7. Verify that Windows 10 fails to boot via the os-prober created GRUB
  menu entry again.
  
  (8. If intending to use this machine, switch back to the non-NX shim
  using: update-alternatives --auto shimx64.efi.signed && dpkg-reconfigure
  shim-signed)
  
  [ Where problems could occur ]
  
  The patch for this only removes checks, deferring to policy enforced by
  shim protocol verification that is already in place, thus it should only
  make more things bootable not less.
  
  When used without shim, existing and this new GRUB2 will only function
  with Secure Boot disabled, thus no new security problems can arise.
  
  When used with the non-NX shim, the policy will let both non-NX and NX
  executables through as expected.
  
  When used with the NX shim, the policy will only let NX executables
- through as expected. Only possible problem here is that if we've have
- ever signed a pre-LF2 kernel with NX_COMPAT set in DllCharacteristics,
- such kernel would be let through, then use the non-NX compatible legacy
+ through as expected. Only possible problem here is that if we have ever
+ signed a pre-LF2 kernel with NX_COMPAT set in DllCharacteristics, such
+ kernel would be let through, then use the non-NX compatible legacy
  loader, which will lead to an inevitable page fault.
  
  The existence of such a kernel is exceedingly unlikely due to the
  upstream timeline of LF2 and NX supports, but it is a theoretical
  possibility and hence worth mentioning.
  
  [ Other Info ]
  
  n/a

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2084104

Title:
  UEFI GRUB2 enforces NX even with a non-NX shim

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/2084104/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to