[EOAN] UBUNTU: [Config] enable secureboot signing on s390x
diff mbox series

Message ID 20190716000203.15174-1-xnox@ubuntu.com
State New
Headers show
Series
  • [EOAN] UBUNTU: [Config] enable secureboot signing on s390x
Related show

Commit Message

Dimitri John Ledkov July 16, 2019, 12:02 a.m. UTC
Bug-Link: https://bugs.launchpad.net/bugs/1829749

Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
---
 debian.master/rules.d/s390x.mk  | 2 +-
 debian/rules                    | 2 +-
 debian/rules.d/1-maintainer.mk  | 1 +
 debian/rules.d/2-binary-arch.mk | 5 +++++
 4 files changed, 8 insertions(+), 2 deletions(-)

Comments

Seth Forshee July 17, 2019, 7:08 p.m. UTC | #1
On Tue, Jul 16, 2019 at 01:02:04AM +0100, Dimitri John Ledkov wrote:
> Bug-Link: https://bugs.launchpad.net/bugs/1829749
> 
> Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>

Looks good to me, would like to have Andy look this over too.

Is support for signing the .sipl files already in launchpad?

Thanks,
Seth
Dimitri John Ledkov July 17, 2019, 9:25 p.m. UTC | #2
On Wed, 17 Jul 2019 at 20:08, Seth Forshee <seth.forshee@canonical.com> wrote:
>
> On Tue, Jul 16, 2019 at 01:02:04AM +0100, Dimitri John Ledkov wrote:
> > Bug-Link: https://bugs.launchpad.net/bugs/1829749
> >
> > Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
>
> Looks good to me, would like to have Andy look this over too.
>
> Is support for signing the .sipl files already in launchpad?
>

It is, and the correct production signing key is in place on the
Ubuntu primary archive too.

See statuses on https://bugs.launchpad.net/launchpad/+bug/1829749 ie.
https://code.launchpad.net/~apw/launchpad/signing-sipl/+merge/368275
is merged and deployed.
Andy Whitcroft July 18, 2019, 2:32 p.m. UTC | #3
On Tue, Jul 16, 2019 at 01:02:04AM +0100, Dimitri John Ledkov wrote:
> Bug-Link: https://bugs.launchpad.net/bugs/1829749
> 
> Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
> ---
>  debian.master/rules.d/s390x.mk  | 2 +-
>  debian/rules                    | 2 +-
>  debian/rules.d/1-maintainer.mk  | 1 +
>  debian/rules.d/2-binary-arch.mk | 5 +++++
>  4 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/debian.master/rules.d/s390x.mk b/debian.master/rules.d/s390x.mk
> index dad66b1a674f..14e58db17d27 100644
> --- a/debian.master/rules.d/s390x.mk
> +++ b/debian.master/rules.d/s390x.mk
> @@ -11,7 +11,7 @@ vdso		= vdso_install
>  no_dumpfile	= true
>  
>  do_extras_package = true
> -
> +sipl_signed       = true
>  do_tools_usbip    = true
>  do_tools_cpupower = true
>  do_tools_perf     = true
> diff --git a/debian/rules b/debian/rules
> index 0953195f5ab1..80205f30b265 100755
> --- a/debian/rules
> +++ b/debian/rules
> @@ -49,7 +49,7 @@ ifneq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
>  endif
>  
>  # Are any of the kernel signing options enabled.
> -any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed)))
> +any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed) $(sipl_signed)))
>  ifeq ($(any_signed),true)
>  bin_pkg_name=$(bin_pkg_name_unsigned)
>  else
> diff --git a/debian/rules.d/1-maintainer.mk b/debian/rules.d/1-maintainer.mk
> index e71bf3c281ef..efc5e50841c9 100644
> --- a/debian/rules.d/1-maintainer.mk
> +++ b/debian/rules.d/1-maintainer.mk
> @@ -92,6 +92,7 @@ printenv:
>  	@echo "any_signed                = $(any_signed)"
>  	@echo " uefi_signed               = $(uefi_signed)"
>  	@echo " opal_signed               = $(opal_signed)"
> +	@echo " sipl_signed               = $(sipl_signed)"
>  	@echo "full_build                = $(full_build)"
>  	@echo "libc_dev_version          = $(libc_dev_version)"
>  	@echo "DEB_HOST_GNU_TYPE         = $(DEB_HOST_GNU_TYPE)"
> diff --git a/debian/rules.d/2-binary-arch.mk b/debian/rules.d/2-binary-arch.mk
> index f3ab06748cf6..083b64772439 100644
> --- a/debian/rules.d/2-binary-arch.mk
> +++ b/debian/rules.d/2-binary-arch.mk
> @@ -151,6 +151,11 @@ ifeq ($(opal_signed),true)
>  	cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
>  		$(signingv)/$(instfile)-$(abi_release)-$*.opal;
>  endif
> +ifeq ($(sipl_signed),true)
> +	install -d $(signingv)
> +	cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
> +		$(signingv)/$(instfile)-$(abi_release)-$*.sipl;
> +endif
>  
>  	install -d $(pkgdir)/boot
>  	install -m644 $(builddir)/build-$*/.config \
> -- 
> 2.20.1

Looks in the ball-park. 

Acked-by: Andy Whitcroft <apw@canonical.com>

Was there something we were waiting for before allowing the kernel to be
signed, making sure it was appropriately locked down as is done in x86 I
think.  Xnox has that landed?

-apw
Dimitri John Ledkov July 19, 2019, 2:03 a.m. UTC | #4
On Thu, 18 Jul 2019 at 15:32, Andy Whitcroft <apw@canonical.com> wrote:
>
> On Tue, Jul 16, 2019 at 01:02:04AM +0100, Dimitri John Ledkov wrote:
> > Bug-Link: https://bugs.launchpad.net/bugs/1829749
> >
> > Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
> > ---
> >  debian.master/rules.d/s390x.mk  | 2 +-
> >  debian/rules                    | 2 +-
> >  debian/rules.d/1-maintainer.mk  | 1 +
> >  debian/rules.d/2-binary-arch.mk | 5 +++++
> >  4 files changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/debian.master/rules.d/s390x.mk b/debian.master/rules.d/s390x.mk
> > index dad66b1a674f..14e58db17d27 100644
> > --- a/debian.master/rules.d/s390x.mk
> > +++ b/debian.master/rules.d/s390x.mk
> > @@ -11,7 +11,7 @@ vdso                = vdso_install
> >  no_dumpfile  = true
> >
> >  do_extras_package = true
> > -
> > +sipl_signed       = true
> >  do_tools_usbip    = true
> >  do_tools_cpupower = true
> >  do_tools_perf     = true
> > diff --git a/debian/rules b/debian/rules
> > index 0953195f5ab1..80205f30b265 100755
> > --- a/debian/rules
> > +++ b/debian/rules
> > @@ -49,7 +49,7 @@ ifneq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
> >  endif
> >
> >  # Are any of the kernel signing options enabled.
> > -any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed)))
> > +any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed) $(sipl_signed)))
> >  ifeq ($(any_signed),true)
> >  bin_pkg_name=$(bin_pkg_name_unsigned)
> >  else
> > diff --git a/debian/rules.d/1-maintainer.mk b/debian/rules.d/1-maintainer.mk
> > index e71bf3c281ef..efc5e50841c9 100644
> > --- a/debian/rules.d/1-maintainer.mk
> > +++ b/debian/rules.d/1-maintainer.mk
> > @@ -92,6 +92,7 @@ printenv:
> >       @echo "any_signed                = $(any_signed)"
> >       @echo " uefi_signed               = $(uefi_signed)"
> >       @echo " opal_signed               = $(opal_signed)"
> > +     @echo " sipl_signed               = $(sipl_signed)"
> >       @echo "full_build                = $(full_build)"
> >       @echo "libc_dev_version          = $(libc_dev_version)"
> >       @echo "DEB_HOST_GNU_TYPE         = $(DEB_HOST_GNU_TYPE)"
> > diff --git a/debian/rules.d/2-binary-arch.mk b/debian/rules.d/2-binary-arch.mk
> > index f3ab06748cf6..083b64772439 100644
> > --- a/debian/rules.d/2-binary-arch.mk
> > +++ b/debian/rules.d/2-binary-arch.mk
> > @@ -151,6 +151,11 @@ ifeq ($(opal_signed),true)
> >       cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
> >               $(signingv)/$(instfile)-$(abi_release)-$*.opal;
> >  endif
> > +ifeq ($(sipl_signed),true)
> > +     install -d $(signingv)
> > +     cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
> > +             $(signingv)/$(instfile)-$(abi_release)-$*.sipl;
> > +endif
> >
> >       install -d $(pkgdir)/boot
> >       install -m644 $(builddir)/build-$*/.config \
> > --
> > 2.20.1
>
> Looks in the ball-park.
>
> Acked-by: Andy Whitcroft <apw@canonical.com>
>
> Was there something we were waiting for before allowing the kernel to be
> signed, making sure it was appropriately locked down as is done in x86 I
> think.  Xnox has that landed?
>
> -apw

As discussed on irc, there are currently no appropriately locked down
as is done in x86. Opened case to confirm with IBM if further locking
down is to be expected or not.
Thus this is on hold, pending further information.
Seth Forshee Aug. 20, 2019, 9:10 p.m. UTC | #5
On Tue, Jul 16, 2019 at 01:02:04AM +0100, Dimitri John Ledkov wrote:
> Bug-Link: https://bugs.launchpad.net/bugs/1829749
> 
> Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>

Applied to eoan/master-next and unstable/master, thanks!

Patch
diff mbox series

diff --git a/debian.master/rules.d/s390x.mk b/debian.master/rules.d/s390x.mk
index dad66b1a674f..14e58db17d27 100644
--- a/debian.master/rules.d/s390x.mk
+++ b/debian.master/rules.d/s390x.mk
@@ -11,7 +11,7 @@  vdso		= vdso_install
 no_dumpfile	= true
 
 do_extras_package = true
-
+sipl_signed       = true
 do_tools_usbip    = true
 do_tools_cpupower = true
 do_tools_perf     = true
diff --git a/debian/rules b/debian/rules
index 0953195f5ab1..80205f30b265 100755
--- a/debian/rules
+++ b/debian/rules
@@ -49,7 +49,7 @@  ifneq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 endif
 
 # Are any of the kernel signing options enabled.
-any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed)))
+any_signed=$(sort $(filter-out false,$(uefi_signed) $(opal_signed) $(sipl_signed)))
 ifeq ($(any_signed),true)
 bin_pkg_name=$(bin_pkg_name_unsigned)
 else
diff --git a/debian/rules.d/1-maintainer.mk b/debian/rules.d/1-maintainer.mk
index e71bf3c281ef..efc5e50841c9 100644
--- a/debian/rules.d/1-maintainer.mk
+++ b/debian/rules.d/1-maintainer.mk
@@ -92,6 +92,7 @@  printenv:
 	@echo "any_signed                = $(any_signed)"
 	@echo " uefi_signed               = $(uefi_signed)"
 	@echo " opal_signed               = $(opal_signed)"
+	@echo " sipl_signed               = $(sipl_signed)"
 	@echo "full_build                = $(full_build)"
 	@echo "libc_dev_version          = $(libc_dev_version)"
 	@echo "DEB_HOST_GNU_TYPE         = $(DEB_HOST_GNU_TYPE)"
diff --git a/debian/rules.d/2-binary-arch.mk b/debian/rules.d/2-binary-arch.mk
index f3ab06748cf6..083b64772439 100644
--- a/debian/rules.d/2-binary-arch.mk
+++ b/debian/rules.d/2-binary-arch.mk
@@ -151,6 +151,11 @@  ifeq ($(opal_signed),true)
 	cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
 		$(signingv)/$(instfile)-$(abi_release)-$*.opal;
 endif
+ifeq ($(sipl_signed),true)
+	install -d $(signingv)
+	cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
+		$(signingv)/$(instfile)-$(abi_release)-$*.sipl;
+endif
 
 	install -d $(pkgdir)/boot
 	install -m644 $(builddir)/build-$*/.config \