diff mbox series

[IMPISH] UBUNTU: [Config] Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS

Message ID 20210824173759.64847-2-dimitri.ledkov@canonical.com
State New
Headers show
Series [UNSTABLE] UBUNTU: [Config] Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS | expand

Commit Message

Dimitri John Ledkov Aug. 24, 2021, 5:37 p.m. UTC 
BugLink: https://bugs.launchpad.net/bugs/1932029

Enforce SYSTEM_TRUSTED_KEYS and SYSTEM_REVOCATION_KEYS on all
architectures, including riscv64. Note that TRUSTED and REVOCATION
keys files are dynamically generated and individual kernels may
add/revoke certificates specific to them, as needed. But all kernels
must trust & revoke a base set of certificates.

Note some kernel flavours don't enherit, or don't enforce all
annotation keys by default, hence enforcement of these options is
required.

Fixes: 741f622c4d ("UBUNTU: [Config] Configure CONFIG_SYSTEM_REVOCATION_KEYS with revoked keys")
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
---
 debian.master/config/annotations | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Paolo Pisati Aug. 27, 2021, 10:18 a.m. UTC | #1 
On Tue, Aug 24, 2021 at 06:37:59PM +0100, Dimitri John Ledkov wrote:
> BugLink: https://bugs.launchpad.net/bugs/1932029
diff mbox series

Patch

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index c0b76a4636..600cf79097 100644
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -363,11 +363,14 @@  CONFIG_SYSTEM_BLACKLIST_KEYRING                 mark<ENFORCED>
 
 # Menu: Cryptographic API >> Certificates for signature checking >> Provide system-wide ring of trusted keys
 CONFIG_SYSTEM_TRUSTED_KEYRING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
-CONFIG_SYSTEM_TRUSTED_KEYS                      policy<{'amd64': '"debian/canonical-certs.pem"', 'arm64': '"debian/canonical-certs.pem"', 'armhf': '"debian/canonical-certs.pem"', 'ppc64el': '"debian/canonical-certs.pem"', 's390x': '"debian/canonical-certs.pem"'}>
+CONFIG_SYSTEM_TRUSTED_KEYS                      policy<{'amd64': '"debian/canonical-certs.pem"', 'arm64': '"debian/canonical-certs.pem"', 'armhf': '"debian/canonical-certs.pem"', 'ppc64el': '"debian/canonical-certs.pem"', 'riscv64': '"debian/canonical-certs.pem"', 's390x': '"debian/canonical-certs.pem"'}>
 CONFIG_SYSTEM_EXTRA_CERTIFICATE                 policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE            policy<{'amd64': '4096', 'arm64': '4096', 'armhf': '4096', 'ppc64el': '4096', 's390x': '4096'}>
-CONFIG_SYSTEM_REVOCATION_KEYS                   policy<{'amd64': '"debian/canonical-revoked-certs.pem"', 'arm64': '"debian/canonical-revoked-certs.pem"', 'armhf': '"debian/canonical-revoked-certs.pem"', 'ppc64el': '"debian/canonical-revoked-certs.pem"', 's390x': '"debian/canonical-revoked-certs.pem"'}>
+CONFIG_SYSTEM_REVOCATION_KEYS                   policy<{'amd64': '"debian/canonical-revoked-certs.pem"', 'arm64': '"debian/canonical-revoked-certs.pem"', 'armhf': '"debian/canonical-revoked-certs.pem"', 'ppc64el': '"debian/canonical-revoked-certs.pem"', 'riscv64': '"debian/canonical-revoked-certs.pem"', 's390x': '"debian/canonical-revoked-certs.pem"'}>
 CONFIG_SECONDARY_TRUSTED_KEYRING                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+#
+CONFIG_SYSTEM_TRUSTED_KEYS                      mark<ENFORCED>
+CONFIG_SYSTEM_REVOCATION_KEYS                   mark<ENFORCED>
 
 # Menu: Cryptographic API >> Hardware crypto devices
 CONFIG_CRYPTO_HW                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>