openSUSE Security April 2017

security@lists.opensuse.org

5 participants
4 discussions

by Malte Gell

Hi there, I have a only slightly off topic questions about TPMs. Is it possible to use e.g. a Gigabyte TPM module on a Asus maiboard and vice versa? Or does the vendor of module and board have to match? And, if a mainboard has no TPM socket, is there a kind of PCI card that features such a socket where you can put in a TPM module? Thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

5 years, 2 months

[opensuse-security] Re: [security-announce] openSUSE-SU-2017:0969-1: important: Security update for apparmor

by Carlos E. R.

On 2017-04-10 15:08, opensuse-security(a)opensuse.org wrote: > openSUSE Security Update: Security update for apparmor > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2017:0969-1 > Rating: important > References: #1016259 #1017260 #1029696 > Cross-References: CVE-2017-6507 > Affected Products: > openSUSE Leap 42.2 > openSUSE Leap 42.1 > ______________________________________________________________________________ > > An update that solves one vulnerability and has two fixes > is now available. You forgot to mention that YaST requires a reboot after installing this patch. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

5 years, 2 months

Re: [opensuse-security] signing custom kernel for secure boot

by Malte Gell

Am 30.03.2017 um 15:48 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 09:19:42PM +0200, Malte Gell wrote: >> And, do I understand correctly, MokManager.efi is signed with the >> Microsoft KEK and writes my user key into the UEFI db key store? Thus, >> MokManager.efi is a way to get user keys into UEFI db? > > yes, with MokManager you can enroll your own keys Oh, is MokManager able to enroll new PK and KEK keys? That would be awesome, some mainboards have no EFI GUI for doing that and my Asrock only has a broken test PK..... :-( thanks Malte -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

5 years, 3 months

[opensuse-security] shim bootloader with only SUSE signature?

by Malte Gell

Morning! I may deal with a system that is not able to cope with a EFI program that carries 2 signatures, like shim. efi. Thus, is there a shim loader that only carries one signature, the signature from openSUSE? I thought, /usr/lib64/efi/fallback.efi was nothing else than shim with just the openSUSE signature, but this seems not to be the case? fallback.efi carries only the openSUSE signature, but it is shim with a different name? What I need is shim.efi just with one signature, from SUSE. thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

5 years, 3 months

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

openSUSE Security April 2017