[Bug 1807686] Re: efi-lockdown patch causes -EPERM for some debugfs files even though CONFIG_LOCK_DOWN_KERNEL is not set

** Package changed: kernel-package (Ubuntu) => linux (Ubuntu)

** Also affects: ubuntu-z-systems
Importance: Undecided
Status: New

** Changed in: ubuntu-z-systems
Status: New => Triaged

** Changed in: ubuntu-z-systems
Importance: Undecided => High

** Changed in: ubuntu-z-systems
Assignee: (unassigned) => Canonical Kernel Team (canonical-kernel-team)

--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/1807686

Title:
efi-lockdown patch causes -EPERM for some debugfs files even though
CONFIG_LOCK_DOWN_KERNEL is not set

Status in Ubuntu on IBM z Systems:
Triaged
Status in linux package in Ubuntu:
New

Bug description:
== Comment: #0 - Dominik Klein <dominik.klein@de.ibm.com> - 2018-12-10 03:58:10 ==
There seems to be a bug in the efi-lockdown patch as applied on top of vanilla for Cosmic kernels:
http://kernel.ubuntu.com/git/ubuntu/ubuntu-cosmic.git/commit/fs/debugfs/file.c?id=a1ba65da9ceae481c154bfd1a2c1550e4566d986

Also seems to be present for Disco as of today:
http://kernel.ubuntu.com/git/ubuntu/ubuntu-disco.git/commit/fs/debugfs/file.c?id=a1ba65da9ceae481c154bfd1a2c1550e4566d986

The problem is that part of the patch modifies kernel behavior
independently of CONFIG_LOCK_DOWN_KERNEL being set or not causing
issues on two debugfs files on s390x.

Vasily Gorbik has already analyzed the problem and has posted a proposed fix here:
https://lkml.org/lkml/2018/11/21/634
https://lkml.org/lkml/2018/11/21/635

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1807686/+subscriptions