Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #60772 > unrolled thread

Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"

Back to article view | Back to linux.debian.kernel

Contents

  Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem" Heinrich Schuchardt <xypron.glpk@gmx.de> - 2018-04-29 12:30 +0200
    Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem" Ben Hutchings <ben@decadent.org.uk> - 2018-04-29 18:00 +0200
    Processed: Re: Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem" "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-04-29 18:00 +0200

#60772 — Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"

Package: linux-image-amd64
Version: 4.15+91~bpo9+1
Severity: normal
Tags: security

The Debian kernels are currently built with
CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"
This was introduced with
https://alioth-lists-archive.debian.net/pipermail/kernel-svn-changes/2016-April/022904.html

We are now two years after Ben's contribution and we are still not using
kernel module signing (CONFIG_MODULE_SIG is not set in config).

As there is no need for the kernel trusting Ben's certificate, please,
remove the setting.

Best regards

Heinrich Schuchardt


-- System Information:
Debian Release: 9.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (100, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64, armhf, i386

Kernel: Linux 4.15.0-0.bpo.2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored:
LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
(ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-amd64 depends on:
ii  linux-image-4.15.0-0.bpo.2-amd64  4.15.11-1~bpo9+1

linux-image-amd64 recommends no packages.

linux-image-amd64 suggests no packages.

-- no debconf information

[toc] | [next] | [standalone]

#60774

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 - security
Control: reassign -1 src:linux 4.15.17-1

There was a Secure Boot sprint earlier this month, during which we
agreed how to do centralised code signing, and I reimplemented the
kernel side of this.

We'll remove this certificate when there's a production certificate to
replace it with, which should happen soon.

Ben.

-- 
Ben Hutchings
[W]e found...that it wasn't as easy to get programs right as we had
thought. I realized that a large part of my life from then on was going
to be spent in finding mistakes in my own programs.
                                                 - Maurice Wilkes, 1949

[toc] | [prev] | [next] | [standalone]

#60775 — Processed: Re: Bug#897163: Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"

Processing control commands:

> tag -1 - security
Bug #897163 [linux-image-amd64] Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"
Removed tag(s) security.
> reassign -1 src:linux 4.15.17-1
Bug #897163 [linux-image-amd64] Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"
Bug reassigned from package 'linux-image-amd64' to 'src:linux'.
No longer marked as found in versions linux-latest/91~bpo9+1.
Ignoring request to alter fixed versions of bug #897163 to the same values previously set
Bug #897163 [src:linux] Remove CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/benh@debian.org.cert.pem"
Marked as found in versions linux/4.15.17-1.

-- 
897163: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897163
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web