** Description changed: [ Impact ] UEFI GRUB2 in Oracular Oriole enforces NX_COMPAT even when used with a non-NX shim. Kernels in Oracular Oriole support NX_COMPAT. The impact is limited to failing to chainload other non-NX compatible operating systems from GRUB2. The most common such operating system is Windows 10, most installations of which do not have a NX compatible bootloader according to Microsoft. [ Test Plan ] 1. Set up (or take an existing) machine with Ubuntu Oracular Oriole and Windows 10 in a dual boot configuration. 2. Verify that `objdump -x /boot/efi/efi/microsoft/boot/bootmgfw.efi` does not show NX_COMPAT under DllCharacteristics. 3. Verify that Windows 10 fails to boot via the os-prober created GRUB menu entry. 4. Update grub-efi-amd64-signed to the version from oracular-proposed. 5. Verify that Windows 10 successfully boots via the os-prober created GRUB menu entry. 6. Switch to the NX shim using `update-alternatives --set shimx64.efi.signed /usr/lib/shim/shimx64.nx.efi.signed.latest && dpkg- reconfigure shim-signed` 7. Verify that Windows 10 fails to boot via the os-prober created GRUB menu entry again. (8. If intending to use this machine, switch back to the non-NX shim using: update-alternatives --auto shimx64.efi.signed && dpkg-reconfigure shim-signed) [ Where problems could occur ] The patch for this only removes checks, deferring to policy enforced by shim protocol verification that is already in place, thus it should only make more things bootable not less. When used without shim, existing and this new GRUB2 will only function with Secure Boot disabled, thus no new security problems can arise. When used with the non-NX shim, the policy will let both non-NX and NX executables through as expected. When used with the NX shim, the policy will only let NX executables - through as expected. Only possible problem here is that if we've have - ever signed a pre-LF2 kernel with NX_COMPAT set in DllCharacteristics, - such kernel would be let through, then use the non-NX compatible legacy + through as expected. Only possible problem here is that if we have ever + signed a pre-LF2 kernel with NX_COMPAT set in DllCharacteristics, such + kernel would be let through, then use the non-NX compatible legacy loader, which will lead to an inevitable page fault. The existence of such a kernel is exceedingly unlikely due to the upstream timeline of LF2 and NX supports, but it is a theoretical possibility and hence worth mentioning. [ Other Info ] n/a
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2084104 Title: UEFI GRUB2 enforces NX even with a non-NX shim To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/2084104/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
