shim-review-request.md

shim-review-request.md

(tl;dr same as #82 + an additional patch, and now built in Ubuntu 20.04 instead of 19.10)

Make sure you have provided the following information:

• link to your code branch cloned from rhboot/shim-review in the form user/repo@tag
• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate embedded in shim (the file passed to VENDOR_CERT_FILE)
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs

Our submission tree is at: https://github.com/CanonicalLtd/shim-review

What organization or people are asking to have this signed:

Canonical

What product or service is this for:

Ubuntu

What is the origin and full version number of your shim?

rhboot/shim@3beb971 + additional patches

What's the justification that this really does need to be signed for the whole world to be able to boot it:

Fixes a regression in loading fwupd compared to the one in #82

How do you manage and protect the keys used in your SHIM?

The key used in our shim is an offline CA key which is only used for signing operational keys. Certificate signing is always done from a machine booted from read-only media, not connected to the Internet. The private key information is distributed among designated trusted employees using a Galois field, which requires that multiple employees be present in order to reconstitute the private key for use and ensures that an attacker who managed to gain possession of anything less than the defined number of key shares would have zero information about the private key.

Do you use EV certificates as embedded certificates in the SHIM?

No

What is the origin and full version number of your bootloader (GRUB or other)?

GRUB 2.04-1ubuntu22, from https://git.launchpad.net/~ubuntu-core-dev/grub/+git/ubuntu/log/?h=ubuntu

If your SHIM launches any other components, please provide further details on what is launched

Does not load other components.

How do the launched components prevent execution of unauthenticated code?

GRUB enforces Secure Boot, using the accepted patches (see github.com/rhboot/grub2); fallback.efi and MokManager are shim components that enforce authenticated code already.

Does your SHIM load any loaders that support loading unsigned kernels (e.g. GRUB)?

GRUB bootloaders of previous supported releases of Ubuntu currently still support loading unsigned kernels, on 14.04 and 16.04. The process to remove those is still in progress.

What kernel are you using? Which patches does it includes to enforce Secure Boot?

Varying Linux kernel versions; see https://launchpad.net/ubuntu/+source/linux (series 5.4 on 20.04, 5.3 on 19.10, 5.0 on Ubuntu 19.04, 4.15 on 16.04, etc.) all with lockdown patches applied.

What changes were made since your SHIM was last signed?

Cherry-picked single commit rhboot/shim@1870bae796022f8bbf60465352eac329ff1d6ffd to fix loading of fwupd

What is the hash of your final SHIM binary?

$ sha256sum usr/lib/shim/*
29022ef11b5f08f669499fbf90665a9b70e5ffba90d74c9be43b00a060180d21  usr/lib/shim/BOOTAA64.CSV
6add06de471015ad4460964f30fb115e7fdc286da6a527d0643fc7815b728fbf  usr/lib/shim/BOOTX64.CSV
24bf8dd350f9f2215c80869a386ef2e038f0023741f499ee7b2b2dce2bacc6da  usr/lib/shim/fbaa64.efi
3a55f93fbc7eaa95f78ced07ef2a12e16925b31742af8339bdf6ab18010c79f1  usr/lib/shim/fbx64.efi
4ddc9f2f862bfd953d8366f54313dc3ed1d83d3735a53e2e78f0ce1765c3ed3f  usr/lib/shim/mmaa64.efi
452c80fca7863dcf37b5def86998a51681ee89487ae6832931b977bfcc7fe1bd  usr/lib/shim/mmx64.efi
3c6318dc79e5ce66f7dccc71df01c4e4acc53f14d978011a29033d59d43d9233  usr/lib/shim/shimaa64.efi
84e680f95cd31db85663a5482a68778dd236503d88e8a6d8e3c4a6c9ba201102  usr/lib/shim/shimx64.efi