https://bugzilla.suse.com/show_bug.cgi?id=1191480 Yan Huang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fkrueger@mailbox.org, | |yan.huang@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 Takashi Iwai changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jslaby@suse.com, | |msuchanek@suse.com, | |tiwai@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c2 --- Comment #2 from Michal Suchanek --- The kernel is signed but pesign signatures are apprently write-only there is no tool to tell you with which key specifically. sbverify --list kernel-default-5.14.10-2.1.g2878fd1.x86_64/usr/lib/modules/5.14.10-2.g2878fd1-default/vmlinuz signature 1 image signature issuers: - /CN=Kernel OBS Project/emailAddress=Kernel@build.opensuse.org image signature certificates: - subject: /CN=Kernel OBS Project/emailAddress=Kernel@build.opensuse.org issuer: /CN=Kernel OBS Project/emailAddress=Kernel@build.opensuse.org It verifies with the project certificate here: https://build.opensuse.org/projects/Kernel:stable/ssl_certificate sbverify --cert ~/Downloads/ssl_certificate.txt ~/Downloads/kernel-default-5.14.10-2.1.g2878fd1.x86_64/usr/lib/modules/5.14.10-2.g2878fd1-default/vmlinuz Signature verification OK The kernel package contains etc/uefi/certs/6A4E915C.crt so you can check that mokutil --list contains a certificate with hash starting with 6A4E915C and enroll it if not. Verifies with this certificate as well: openssl x509 --inform DER --outform PEM --in ~/Downloads/kernel-default-5.14.10-2.1.g2878fd1.x86_64/etc/uefi/certs/6A4E915C.crt

/tmp/cert sbverify --cert /tmp/cert ~/Downloads/kernel-default-5.14.10-2.1.g2878fd1.x86_64/usr/lib/modules/5.14.10-2.g2878fd1-default/vmlinuz Signature verification OK

-- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 Yan Huang changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium CC| |anogueiras@yahoo.es, | |glin@suse.com, | |lnussel@suse.com, | |mchang@suse.com Found By|--- |Field Engineer -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c4 --- Comment #4 from Michal Suchanek --- Please verify output of 'mokutil --list' contains a certificate with fingerprint starting with 6A4E915C and enroll it if not. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c5 --- Comment #5 from Jiri Slaby --- Works for me: # mokutil --sb-state SecureBoot enabled # uname -r 5.14.11-20.g834dddd-default # dmesg|grep -i Secure Secure boot enabled integrity: Loaded X.509 cert 'openSUSE Secure Boot CA: 6842600de22c4c477e95be23dfea9513e5971762' integrity: Loaded X.509 cert 'openSUSE Secure Boot CA: 6842600de22c4c477e95be23dfea9513e5971762' integrity: Loaded X.509 cert 'openSUSE Secure Boot Signkey: c8bdc7ac1a1d85966217fd93ebfc14f4a200b814' -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c7 Michal Suchanek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Depends on| |1189841 --- Comment #7 from Michal Suchanek --- It will be enrolled only after reboot. Thanks for verification. There is a problem with enrolling certificates ATM which should be resolved in some weeks. The released tumbleweed kernels should not be affected but the situation is different for the development snapshots. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c9 --- Comment #9 from Yan Huang --- Created attachment 853091 --> https://bugzilla.suse.com/attachment.cgi?id=853091&action=edit mokutil --list-enrolled (In reply to Michal Suchanek from comment #8)

Also you might need --ignore-keyring option

Thanks a lot, Michal. The "--ignore-keyring" option worked:

# mokutil --import /etc/uefi/certs/6A4E915C.crt --ignore-keyring input password: input password again:

After reboot, the new certificate 6A4E915C.crt is enrolled (also seen in the attached "mokutil --list-enrolled" output) and the newest Kernel:stable kernel 5.14.11-1.1.g834dddd successfully booted with Secure Boot enabled. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c11 Stephan Hemeier changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Sauerlandlinux@gmx.de --- Comment #11 from Stephan Hemeier --- Same here, with --ignore-keyring I got my key to mok. Before it was always: # mokutil --import /etc/uefi/certs/F2B7BCC9.crt

Already in kernel trusted keyring. Skip /etc/uefi/certs/F2B7BCC9.crt

And not shown in mokutil...... Now after restart, I could enroll the key and all is working. PS: I branch the kernel:stable:backport in my Repo so I have another key. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c13 Joey Lee changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jlee@suse.com) | --- Comment #13 from Joey Lee --- (In reply to Michal Suchanek from comment #12)

The key should be enrolled automagically but the --ignore-keyring option is not used.

If it's now needed to successfully enroll the key it needs to be adde in the scripts.

I prefer to keep the logic for checking keyring (--ignore-keyring option can disable it) but not add it to scripts. This mokutil function be added to prevent that the nvram space be wasted. When a shim and kernel be produced by the same project. The shim should be embedded a openSUSE CA that it can verify the kernel that be signed by openSUSE signkey. And, the kernel is emabedded a openSUSE signkey. So we don't need enroll openSUSE signkey to MOK. It can save limited nvraom space of firmware. About this issue, user installed a kernel be signed by another project (Kernel OBS Project/emailAddress=Kernel@build.opensuse.org, in this case). So shim's embedded CA can not verify the non-openSUSE signed kernel. And, mokutil checks the signkey is in kernel keyring because it be embedded by kernel. So the key can not be auto-enrolled. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c25 --- Comment #25 from Swamp Workflow Management --- openSUSE-RU-2021:3509-1: An update that has 5 recommended fixes can now be installed. Category: recommended (important) Bug References: 1191200,1191260,1191480,1191804,1191922 CVE References: JIRA References: Sources used: openSUSE Leap 15.3 (src): suse-module-tools-15.3.13-3.11.1 -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c27 --- Comment #27 from Swamp Workflow Management --- SUSE-RU-2021:3515-1: An update that has 5 recommended fixes can now be installed. Category: recommended (important) Bug References: 1191200,1191260,1191480,1191804,1191922 CVE References: JIRA References: Sources used: SUSE MicroOS 5.0 (src): suse-module-tools-15.2.15-4.9.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): suse-module-tools-15.2.15-4.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c32 Michal Suchanek changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Blocks| |1189841 Depends on|1189841 | Resolution|--- |FIXED --- Comment #32 from Michal Suchanek --- Update released. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c36 --- Comment #36 from Swamp Workflow Management --- SUSE-RU-2021:3869-1: An update that has 8 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1189841,1189879,1190598,1191200,1191260,1191480,1191804,1191922 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): suse-module-tools-15.1.23-3.19.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): suse-module-tools-15.1.23-3.19.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): suse-module-tools-15.1.23-3.19.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): suse-module-tools-15.1.23-3.19.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): suse-module-tools-15.1.23-3.19.1 SUSE Enterprise Storage 6 (src): suse-module-tools-15.1.23-3.19.1 SUSE CaaS Platform 4.0 (src): suse-module-tools-15.1.23-3.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1191480 https://bugzilla.suse.com/show_bug.cgi?id=1191480#c38 --- Comment #38 from Swamp Workflow Management --- SUSE-RU-2021:3970-1: An update that has 8 recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1189841,1189879,1190598,1191200,1191260,1191480,1191804,1191922 CVE References: JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): suse-module-tools-12.6.1-27.6.1 SUSE OpenStack Cloud Crowbar 8 (src): suse-module-tools-12.6.1-27.6.1 SUSE OpenStack Cloud 9 (src): suse-module-tools-12.6.1-27.6.1 SUSE OpenStack Cloud 8 (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): suse-module-tools-12.6.1-27.6.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): suse-module-tools-12.6.1-27.6.1 HPE Helion Openstack 8 (src): suse-module-tools-12.6.1-27.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.