action #109611
closed
[sle][security][sle15sp4] Verify that if we are "secure booted" that kernel lockdown is enabled
Added by msmeissn about 2 years ago.
Updated about 2 years ago.
Description
We have identified cases where we booted in "secure boot" mode, but the kernel was not locked down.
This affected SLES and openSUSE Tumbleweed.
see https://bugzilla.suse.com/show_bug.cgi?id=1198101
$ cat /sys/kernel/security/lockdown
[none] integrity confidentiality
should NOT show [none] here.
- Subject changed from Verify that if we are "secure booted" that kernel lockdown is enabled to [security] Verify that if we are "secure booted" that kernel lockdown is enabled
- Subject changed from [security] Verify that if we are "secure booted" that kernel lockdown is enabled to [sle][security][sle15sp4] Verify that if we are "secure booted" that kernel lockdown is enabled
- Category set to New test
- Assignee set to rfan1
- Estimated time set to 16.00 h
Thanks I will try to add this tests to both SLE/TW [x86_64 and arm]
- Status changed from New to In Progress
- % Done changed from 0 to 30
- % Done changed from 30 to 50
i opened the bug to be suse employee only (from secinternal only)
- Status changed from In Progress to Feedback
- % Done changed from 50 to 90
- Status changed from Feedback to Resolved
- % Done changed from 90 to 100
This is an autogenerated message for openQA integration by the openqa_review script:
This bug is still referenced in a failing openQA test: secureboot_kernel_lockdown@uefi
https://openqa.opensuse.org/tests/2331170#step/kernel_lockdown/1
To prevent further reminder comments one of the following options should be followed:
- The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
- The openQA job group is moved to "Released" or "EOL" (End-of-Life)
- The bugref in the openQA scenario is removed or replaced, e.g.
label:wontfix:boo1234
Expect the next reminder at the earliest in 32 days if nothing changes in this ticket.
Also available in: Atom
PDF