All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
Cc: stable@vger.kernel.org, regressions@lists.linux.dev,
	Nathan Chancellor <nathan@kernel.org>,
	masahiroy@kernel.org
Subject: Re: [REGRESSION] Secureboot violation for linux enrolled by-hash into db v6.17.4 and v6.18-rc1
Date: Tue, 21 Oct 2025 18:07:33 +0200	[thread overview]
Message-ID: <2025102104-battery-battering-038e@gregkh> (raw)
In-Reply-To: <CANBHLUjPbXYghPx5zDwLDcGKXb7v7+1u-bpZ=L9r=qW7vDZ=cg@mail.gmail.com>

On Tue, Oct 21, 2025 at 03:00:56PM +0100, Dimitri John Ledkov wrote:
> If one enrolls linux kernel by-hash into db (for example using
> virt-fw-vars), the secureboot fails with security violation as EDK2
> computation of authenticode for the linux binary doesn't match the
> enrolled hash.
> 
> This is reproducible in AWS VMs, as well as locally with EDK2 builds
> with secureboot.
> 
> Not affected v6.17
> Not affected v6.17.3
> Affected v6.17.4
> Affected v6.18-rc1
> Affected v6.18-rc2

great, we are bug compatible :)

Once this is fixed in Linus's tree, we will be glad to take the fix into
the stable branch.

thanks,

greg k-h

  reply	other threads:[~2025-10-21 16:07 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-10-21 14:00 [REGRESSION] Secureboot violation for linux enrolled by-hash into db v6.17.4 and v6.18-rc1 Dimitri John Ledkov
2025-10-21 16:07 ` Greg KH [this message]
2025-10-21 23:02 ` Nathan Chancellor

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2025102104-battery-battering-038e@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=dimitri.ledkov@surgut.co.uk \
    --cc=masahiroy@kernel.org \
    --cc=nathan@kernel.org \
    --cc=regressions@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.