April 2017 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] ot: TPM modules
by Malte Gell 26 Apr '17

26 Apr '17

Hi there, I have a only slightly off topic questions about TPMs. Is it possible to use e.g. a Gigabyte TPM module on a Asus maiboard and vice versa? Or does the vendor of module and board have to match? And, if a mainboard has no TPM socket, is there a kind of PCI card that features such a socket where you can put in a TPM module? Thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 2

[opensuse-security] Re: [security-announce] openSUSE-SU-2017:0969-1: important: Security update for apparmor
by Carlos E. R. 10 Apr '17

10 Apr '17

On 2017-04-10 15:08, opensuse-security(a)opensuse.org wrote: > openSUSE Security Update: Security update for apparmor > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2017:0969-1 > Rating: important > References: #1016259 #1017260 #1029696 > Cross-References: CVE-2017-6507 > Affected Products: > openSUSE Leap 42.2 > openSUSE Leap 42.1 > ______________________________________________________________________________ > > An update that solves one vulnerability and has two fixes > is now available. You forgot to mention that YaST requires a reboot after installing this patch. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

2 2

Re: [opensuse-security] signing custom kernel for secure boot
by Malte Gell 04 Apr '17

04 Apr '17

Am 30.03.2017 um 15:48 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 09:19:42PM +0200, Malte Gell wrote: >> And, do I understand correctly, MokManager.efi is signed with the >> Microsoft KEK and writes my user key into the UEFI db key store? Thus, >> MokManager.efi is a way to get user keys into UEFI db? > > yes, with MokManager you can enroll your own keys Oh, is MokManager able to enroll new PK and KEK keys? That would be awesome, some mainboards have no EFI GUI for doing that and my Asrock only has a broken test PK..... :-( thanks Malte -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] shim bootloader with only SUSE signature?
by Malte Gell 03 Apr '17

03 Apr '17

Morning! I may deal with a system that is not able to cope with a EFI program that carries 2 signatures, like shim. efi. Thus, is there a shim loader that only carries one signature, the signature from openSUSE? I thought, /usr/lib64/efi/fallback.efi was nothing else than shim with just the openSUSE signature, but this seems not to be the case? fallback.efi carries only the openSUSE signature, but it is shim with a different name? What I need is shim.efi just with one signature, from SUSE. thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 1