[Bug 1810842] Re: Allows booting unsigned kernel when not using shim

[dann frazier]

** Description changed:

- A Secure Boot system that has Canonical's key in the db can boot can
- boot our signed GRUB directly (i.e., w/o chaining through shim). In this
- configuration, GRUB will permit booting unsigned kernels. Reported by
- Ard Biesheuvel of Linaro.
+ Our current SB policy is to allow fallback to unsigned kernels, but we
+ are in the process of changing this policy to require valid signatures.
+ GRUB in disco should already be enforcing this new policy, but Ard
+ Biesheuvel of Linaro discovered a corner case.
+ 
+ A system that has Canonical's key in the db can boot our signed GRUB
+ directly (i.e., w/o chaining through shim). In this configuration, GRUB
+ fails to detect that it is unable to validate signatures, and will
+ permit booting unsigned kernels.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1810842

Title:
  Allows booting unsigned kernel when not using shim

Status in grub2-signed package in Ubuntu:
  New

Bug description:
  Our current SB policy is to allow fallback to unsigned kernels, but we
  are in the process of changing this policy to require valid
  signatures. GRUB in disco should already be enforcing this new policy,
  but Ard Biesheuvel of Linaro discovered a corner case.

  A system that has Canonical's key in the db can boot our signed GRUB
  directly (i.e., w/o chaining through shim). In this configuration,
  GRUB fails to detect that it is unable to validate signatures, and
  will permit booting unsigned kernels.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2-signed/+bug/1810842/+subscriptions