Power guest secure boot with key management: kernel portion
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| The Ubuntu-power-systems project |
New
|
High
|
Ubuntu on IBM Power Systems Bug Triage | ||
| linux (Ubuntu) |
New
|
High
|
Ubuntu on IBM Power Systems Bug Triage | ||
Bug Description
Covering the kernel portion
Feature:
This feature comprises PowerVM LPAR guest OS kernel verification using static keys to extend the chain of trust from partition firmware to the OS kernel. GRUB and the host OS kernel are signed with 2 separate public key pairs. Partition firmware includes the the public verification key for GRUB in its build and uses it to verify GRUB. GRUB includes the public verification key for the OS kernel in its build and uses it to verify the OS kernel image
Test case:
If secure boot is switched off, any GRUB and kernel boots.
If secure boot is switched on:
- Properly signed GRUB boots.
- Improperly signed GRUB does not boot.
- Tampered signed GRUB does not boot.
- Properly signed kernels boot.
- Improperly signed kernels do not boot.
- Tampered signed kernels do not boot.
TPM PCRs are extended roughly following the TCG PC Client and UEFI specs as they apply to POWER.
| tags: | added: architecture-ppc64le bugnameltc-205842 severity-critical targetmilestone-inin2404 |
| Changed in ubuntu: | |
| assignee: | nobody → Ubuntu on IBM Power Systems Bug Triage (ubuntu-power-triage) |
| affects: | ubuntu → linux (Ubuntu) |
| tags: |
added: targetmilestone-inin2410 removed: targetmilestone-inin2404 |
| Frank Heimes (fheimes) wrote | #1 |
| Changed in ubuntu-power-systems: | |
| assignee: | nobody → Ubuntu on IBM Power Systems Bug Triage (ubuntu-power-triage) |
| importance: | Undecided → High |
| Changed in linux (Ubuntu): | |
| importance: | Undecided → High |
Hello, is there already a list of (kernel) commits that are required?
(So that we can check whether they are incl. in the Ubuntu kernel or not; and in case not do the submissions to the Ubuntu kernel team.)