Bug 2333706 - Kernel 6.12.6 kernel lockdown disabled
Summary: Kernel 6.12.6 kernel lockdown disabled
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 41
Hardware: x86_64
OS: Linux
high
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: CVE-2025-1272
TreeView+ depends on / blocked
 
Reported: 2024-12-21 22:59 UTC by grumpey0
Modified: 2025-02-22 11:01 UTC (History)
24 users (show)

Fixed In Version: kernel-6.12.15-100.fc40 kernel-6.12.15-200.fc41
Clone Of:
Environment:
Last Closed: 2025-02-20 02:27:04 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Journal of 6.12.6 booting with lsm.debug set on the kernel. (418.18 KB, text/plain)
2024-12-21 23:00 UTC, grumpey0
no flags Details

Description grumpey0 2024-12-21 22:59:11 UTC
1. Please describe the problem:
output of fwupdmgr security on 6.12.6

Runtime Suffix -!
✔ fwupd plug-ins:                Untainted
✔ CET OS Support:                Supported
✔ Linux swap:                    Encrypted
✔ Linux kernel:                  Untainted
✘ Linux kernel lockdown:         Disabled



2. What is the Version-Release number of the kernel:
6.12.6-200.fc41.x86_64

3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :
This appears to be working  with 6.11.4 kernel. 


4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:
Yes, boot with a 6.12.X kernel.

5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:


6. Are you running any modules that not shipped with directly Fedora's kernel?:
No 

7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.

Comment 1 grumpey0 2024-12-21 23:00:32 UTC
Created attachment 2063450 [details]
Journal of 6.12.6 booting with lsm.debug set on the kernel.

Comment 2 Andreas Schneider 2025-01-09 18:15:02 UTC
Linux Kernel 6.11.11-300.fc41.x86_64
cat /sys/kernel/security/lockdown
none [integrity] confidentiality


After `dnf upgrade --refresh` and which installs Linux Kernel 6.12.8-200.fc41.x86_64 as of today:
cat /sys/kernel/security/lockdown
[none] integrity confidentiality

Comment 3 Noam Raz 2025-01-26 18:33:28 UTC
Just noticed this on my machine as well with kernel 6.12.9-200.fc41.x86_64.

I've poked around a bit and am pretty sure the culprit is upstream commit
77b644c39d6a ("init/main.c: Initialize early LSMs after arch code, static
keys and calls."). That moved the call to early_security_init() to after
setup_arch(), but the downstream lockdown-on-secure-boot patch calls the
lockdown hook immediately after setting `EFI_SECURE_BOOT` there.

Basically, it looks like the lockdown hook is now invoked before lockdown has
even been registered.

Comment 4 Justin M. Forbes 2025-01-28 22:33:38 UTC
Right, this is being looked at, the timing was just not particularly good as everything was blowing up at once.  In the meantime, the kernel command line options and runtime enable should work (runtime disable still does not by design).

Comment 5 Dominik 'Rathann' Mierzejewski 2025-02-03 10:33:37 UTC
Thanks, Justin!

I can confirm that runtime enable works with at least 6.12.11:

# uname -r
6.12.11-200.fc41.x86_64
# cat /sys/kernel/security/lockdown
[none] integrity confidentiality
# echo integrity > /sys/kernel/security/lockdown
# cat /sys/kernel/security/lockdown
none [integrity] confidentiality
# dmesg |tail -n 1
[ 2227.603314] Kernel is locked down from securityfs; see man kernel_lockdown.7
# fwupdmgr security
...
Runtime Suffix -!
✔ fwupd plug-ins:                Untainted
✔ Linux kernel lockdown:         Enabled
✔ Linux swap:                    Encrypted
✔ Linux kernel:                  Untainted

Comment 6 Fedora Update System 2025-02-18 04:37:40 UTC
FEDORA-2025-1df4e96976 (kernel-6.12.14-100.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-1df4e96976

Comment 7 Fedora Update System 2025-02-19 02:12:23 UTC
FEDORA-2025-cca2fcc70c has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-cca2fcc70c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-cca2fcc70c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-02-19 02:24:18 UTC
FEDORA-2025-b268fceaec has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-b268fceaec`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-b268fceaec

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2025-02-20 02:27:04 UTC
FEDORA-2025-b268fceaec (kernel-6.12.15-100.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2025-02-20 02:27:44 UTC
FEDORA-2025-cca2fcc70c (kernel-6.12.15-200.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.