[Bug 1595611] Re: Improve prompting for Secure Boot password

[Brian Murray]

Hello Mathieu, or anyone else affected,

Accepted shim-signed into xenial-proposed. The package will build now
and be available at https://launchpad.net/ubuntu/+source/shim-
signed/1.19~16.04.1 in a few hours, and then in the -proposed
repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
enable and use -proposed.  Your feedback will aid us getting this update
out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, and change the tag
from verification-needed to verification-done. If it does not fix the
bug for you, please add a comment stating that, and change the tag to
verification-failed.  In either case, details of your testing will help
us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: shim-signed (Ubuntu Xenial)
       Status: In Progress => Fix Committed

** Tags added: verification-needed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1595611

Title:
  Improve prompting for Secure Boot password

Status in shim-signed package in Ubuntu:
  Fix Released
Status in shim-signed source package in Precise:
  In Progress
Status in shim-signed source package in Trusty:
  In Progress
Status in shim-signed source package in Xenial:
  Fix Committed

Bug description:
  [Impact]
  On install and upgrade, shim-signed prompts users for disabling Secure Boot if DKMS packages are installed. The prompting was confusing, hard to see, and defaulted to not disabling Secure Boot.

  [Test case]
  (re-enable Secure Boot if necessary: 'sudo mokutil --enable-validation' and reboot)
  1) Update shim-signed on a system with dkms packages installed, where Secure Boot is enabled.
  Verify that as a first step you see an explanation of why you see the prompt (Secure Boot is enabled and you have third-party drivers).

  Also:
  Test upgrade from other release with DKMS packages installed, where Secure Boot is enabled; verify that you are prompted to disable Secure Boot, that the Disable Secure Boot checkbox is checked by default, and that you see an explanation text as a first step.

  [Regression Potential]
  This changes the default selection for disabling Secure Boot (picked by default), so quickly hitting "Next" will now move to prompting for the Secure Boot password to disable validation in shim; this breaks any users relying on blindly ignoring the prompts. Disabling Secure Boot will reduce the security of the system since it is no longer verified by UEFI signatures past loading the shim bootloader. In a true regression potential; should there be an issue with the prompting workflow in debconf, the usage of the debconf frontend may be impacted (for example, some particular frontend of debconf may fail (readline?))

  ---

  Current strings in debconf templates for asking for a Secure Boot
  password are suboptimal:

  Template: shim/secureboot_key
  Type: password
  _Description: Password:
   Please enter a password for disabling Secure Boot. It will be asked again
   after a reboot.

  Template: shim/secureboot_key_again
  Type: password
  _Description: Re-enter password to verify:
   Please enter the same password again to verify you have typed it correctly.

  This would show only the short description in the debconf GNOME
  frontend; which may not be passing sufficient information for users to
  understand what is expected of them, and that they really need to
  remember that password since it will be asked after a reboot.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1595611/+subscriptions