Please disable unnecessary config options in the Ubuntu 17.04 kernel config

Bug #1667490 reported by bugproxy
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
High
Seth Forshee

Bug Description

---Problem Description---
Some krnel config options for IMA should not be enabled in the Ubuntu 17.04 kernel as they are at best experimental and at worst dangerous:

  CONFIG_IMA_APPRAISE_SIGNED_INIT
  CONFIG_IMA_BLACKLIST_KEYRING
  CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
  CONFIG_IIMA_READ_POLICY
  CONFIG_IIMA_WRITE_POLICY

Please disable these config options in the Ubuntu 17.04 kernel config.

---uname output---
Linux briggs-rtp-2 4.9.0-15-generic #16-Ubuntu SMP Fri Jan 20 15:28:49 UTC 2017 ppc64le ppc64le ppc64le GNU/Linux

Machine Type = S822LC 8001-22C

bugproxy (bugproxy)
tags: added: architecture-ppc64le bugnameltc-151978 severity-critical targetmilestone-inin1704
Changed in ubuntu:
assignee: nobody → Taco Screen team (taco-screen-team)
affects: ubuntu → linux (Ubuntu)
Revision history for this message
Michael Hohnbaum (hohnbaum) wrote : Re: [Bug 1667490] [NEW] Please disable unnecessary config options in the Ubuntu 17.04 kernel config

Request from IBM for the Kernel team to consider.

                Michael

On 02/23/2017 01:49 PM, Launchpad Bug Tracker wrote:
> bugproxy (bugproxy) has assigned this bug to you for Ubuntu:
>
> ---Problem Description---
> Some krnel config options for IMA should not be enabled in the Ubuntu 17.04 kernel as they are at best experimental and at worst dangerous:
>
> CONFIG_IMA_APPRAISE_SIGNED_INIT
> CONFIG_IMA_BLACKLIST_KEYRING
> CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
> CONFIG_IIMA_READ_POLICY
> CONFIG_IIMA_WRITE_POLICY
>
> Please disable these config options in the Ubuntu 17.04 kernel config.
>
> ---uname output---
> Linux briggs-rtp-2 4.9.0-15-generic #16-Ubuntu SMP Fri Jan 20 15:28:49 UTC 2017 ppc64le ppc64le ppc64le GNU/Linux
>
> Machine Type = S822LC 8001-22C
>
> ** Affects: ubuntu
> Importance: Undecided
> Assignee: Taco Screen team (taco-screen-team)
> Status: New
>
>
> ** Tags: architecture-ppc64le bugnameltc-151978 severity-critical targetmilestone-inin1704

--
Michael Hohnbaum
OIL Program Manager
Power (ppc64el) Development Project Manager
Canonical, Ltd.

Changed in linux (Ubuntu):
assignee: Taco Screen team (taco-screen-team) → Canonical Kernel Team (canonical-kernel-team)
importance: Undecided → High
status: New → Triaged
Seth Forshee (sforshee)
Changed in linux (Ubuntu):
assignee: Canonical Kernel Team (canonical-kernel-team) → Seth Forshee (sforshee)
status: Triaged → Fix Committed
Revision history for this message
bugproxy (bugproxy) wrote : Comment bridged from LTC Bugzilla

---Problem Description---
Some krnel config options for IMA should not be enabled in the Ubuntu 17.04 kernel as they are at best experimental and at worst dangerous:

CONFIG_IMA_APPRAISE_SIGNED_INIT
CONFIG_IMA_BLACKLIST_KEYRING
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
CONFIG_IIMA_READ_POLICY
CONFIG_IIMA_WRITE_POLICY

Please disable these config options in the Ubuntu 17.04 kernel config.

---uname output---
Linux briggs-rtp-2 4.9.0-15-generic #16-Ubuntu SMP Fri Jan 20 15:28:49 UTC 2017 ppc64le ppc64le ppc64le GNU/Linux

Machine Type = S822LC 8001-22C

Request from IBM for the Kernel team to consider.

Michael

On 02/23/2017 01:49 PM, Launchpad Bug Tracker wrote:
> bugproxy (bugproxy) has assigned this bug to you for Ubuntu:
>
> ---Problem Description---
> Some krnel config options for IMA should not be enabled in the Ubuntu 17.04 kernel as they are at best experimental and at worst dangerous:
>
> CONFIG_IMA_APPRAISE_SIGNED_INIT
> CONFIG_IMA_BLACKLIST_KEYRING
> CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
> CONFIG_IIMA_READ_POLICY
> CONFIG_IIMA_WRITE_POLICY
>
> Please disable these config options in the Ubuntu 17.04 kernel config.
>
> ---uname output---
> Linux briggs-rtp-2 4.9.0-15-generic #16-Ubuntu SMP Fri Jan 20 15:28:49 UTC 2017 ppc64le ppc64le ppc64le GNU/Linux
>
> Machine Type = S822LC 8001-22C
>
> ** Affects: ubuntu
> Importance: Undecided
> Assignee: Taco Screen team (taco-screen-team)
> Status: New
>
>
> ** Tags: architecture-ppc64le bugnameltc-151978 severity-critical targetmilestone-inin1704

--
Michael Hohnbaum
OIL Program Manager
Power (ppc64el) Development Project Manager
Canonical, Ltd.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (14.0 KiB)

This bug was fixed in the package linux - 4.10.0-11.13

---------------
linux (4.10.0-11.13) zesty; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
    - LP: #1669127

  * linux-tools-common should Depends: lsb-release (LP: #1667571)
    - [Config] linux-tools-common depends on lsb-release

  * Ubuntu (Zesty): When we miss LSI/INTx interrupts on slot, message is too
    imprecise (LP: #1668382)
    - of/irq: improve error report on irq discovery process failure

  * Zesty update to v4.10.1 stable release (LP: #1668993)
    - ptr_ring: fix race conditions when resizing
    - ip: fix IP_CHECKSUM handling
    - net: socket: fix recvmmsg not returning error from sock_error
    - tty: serial: msm: Fix module autoload
    - USB: serial: mos7840: fix another NULL-deref at open
    - USB: serial: cp210x: add new IDs for GE Bx50v3 boards
    - USB: serial: ftdi_sio: fix modem-status error handling
    - USB: serial: ftdi_sio: fix extreme low-latency setting
    - USB: serial: ftdi_sio: fix line-status over-reporting
    - USB: serial: spcp8x5: fix modem-status handling
    - USB: serial: opticon: fix CTS retrieval at open
    - USB: serial: ark3116: fix register-accessor error handling
    - USB: serial: console: fix uninitialised spinlock
    - x86/platform/goldfish: Prevent unconditional loading
    - goldfish: Sanitize the broken interrupt handler
    - netfilter: nf_ct_helper: warn when not applying default helper assignment
    - ACPICA: Linuxize: Restore and fix Intel compiler build
    - block: fix double-free in the failure path of cgwb_bdi_init()
    - rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
    - xfs: clear delalloc and cache on buffered write failure
    - Linux 4.10.1

  * [UBUNTU Zesty] mlx5 - Improve OVS offload driver (LP: #1668019)
    - net/sched: cls_flower: Disallow duplicate internal elements
    - net/sched: cls_flower: Properly handle classifier flags dumping
    - net/sched: cls_matchall: Dump the classifier flags
    - net/sched: Reflect HW offload status
    - net/sched: cls_flower: Reflect HW offload status
    - net/sched: cls_matchall: Reflect HW offloading status
    - net/sched: cls_u32: Reflect HW offload status
    - net/sched: cls_bpf: Reflect HW offload status
    - net/mlx5: Push min-inline mode resolution helper into the core
    - IB/mlx5: Enable Eth VFs to query their min-inline value for user-space
    - net/mlx5: Use exact encap header size for the FW input buffer
    - net/mlx5e: Add TC offloads matching on IPv6 encapsulation headers
    - net/mlx5e: TC ipv4 tunnel encap offload cosmetic changes
    - net/mlx5e: Use the full tunnel key info for encapsulation offload house- keeping
    - net/mlx5e: Maximize ip tunnel key usage on the TC offloading path
    - net/mlx5e: Support SRIOV TC encapsulation offloads for IPv6 tunnels
    - net/mlx5: E-Switch, Enlarge the FDB size for the switchdev mode
    - net/mlx5: Fix static checker warnings

  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
    (LP: #1470250)
    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails

  * Ubuntu17.04: Need more patches for aacraid to bring up Bost...

Changed in linux (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
bugproxy (bugproxy) wrote :

------- Comment From <email address hidden> 2019-01-14 12:51 EDT-------
This old feature request was verified but never updated and closed.

Revision history for this message
bugproxy (bugproxy) wrote :

------- Comment From <email address hidden> 2019-04-08 15:54 EDT-------
What is the next step?

Revision history for this message
bugproxy (bugproxy) wrote :

------- Comment From <email address hidden> 2019-04-11 17:25 EDT-------
Closing on our side as fixed.

Brad Figg (brad-figg)
tags: added: cscc
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.