From 41884f4dfbbcdf5a5301a6c05511b5b1953c9d92 Mon Sep 17 00:00:00 2001 From: Jaroslav Klech Date: Sep 23 2019 10:33:05 +0000 Subject: [PATCH 1/4] Describes issue #352 --- diff --git a/modules/release-notes/pages/sysadmin/Distribution.adoc b/modules/release-notes/pages/sysadmin/Distribution.adoc index efbfd5d..9012958 100644 --- a/modules/release-notes/pages/sysadmin/Distribution.adoc +++ b/modules/release-notes/pages/sysadmin/Distribution.adoc @@ -3,3 +3,16 @@ include::{partialsdir}/entities.adoc[] [[select-distribution]] = Distribution-wide Changes + +[[grub-modules]] +== EFI build of GRUB2 now contains several security-oriented modules + +The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the `grub2-efi-x64` package to enhance users' trust in integrity of early-launch code. + +Users utilizing the secure boot functionality on the UEFI systems can insert and verify *GRUB* modules or employ nearly full disk encryption. + +[NOTE] +==== +The build process automatically includes the explicit dependencies `mpi`, `gcry_sha1`, `procfs`, `archelp`. However you need to include also the following implicit dependencies `gcry_sha256`, `gcry_rsa`, `gcry_rijndael`, `gcry_serpent`, `gcry_twofish`, `gcry_whirlpool`. +==== + diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index dcabdc5..ed1dac6 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -3,3 +3,8 @@ include::{partialsdir}/entities.adoc[] [[sect-security]] = Security + +== EFI build of GRUB2 now contains several security-oriented modules + +The `grub2-efi-x64` package in Fedora 31 contains the `cryptodisk`, `luks` and `verify` *GRUB* modules. For more details see the xref:sysadmin/Distribution.adoc#grub-modules[Distribution-wide changes] section. + From d54bfd360c129f42b09e5cca1f74601c5c46d3dc Mon Sep 17 00:00:00 2001 From: Jaroslav Klech Date: Sep 26 2019 09:56:57 +0000 Subject: [PATCH 2/4] Applies SME feedback --- diff --git a/modules/release-notes/pages/sysadmin/Distribution.adoc b/modules/release-notes/pages/sysadmin/Distribution.adoc index 9012958..ae1556a 100644 --- a/modules/release-notes/pages/sysadmin/Distribution.adoc +++ b/modules/release-notes/pages/sysadmin/Distribution.adoc @@ -7,9 +7,9 @@ include::{partialsdir}/entities.adoc[] [[grub-modules]] == EFI build of GRUB2 now contains several security-oriented modules -The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the `grub2-efi-x64` package to enhance users' trust in integrity of early-launch code. +The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the *GRUB EFI* builds to enhance users' trust in integrity of early-launch code. -Users utilizing the secure boot functionality on the UEFI systems can insert and verify *GRUB* modules or employ nearly full disk encryption. +This change enables users on their systems with disabled *Secure Boot* technology to verify signatures of *GRUB* modules or employ nearly full disk encryption. [NOTE] ==== From 3b28b8e1132ea59eabcba765157ef09e0ee726d1 Mon Sep 17 00:00:00 2001 From: Jaroslav Klech Date: Sep 26 2019 10:03:32 +0000 Subject: [PATCH 3/4] Applies additional SME feedback --- diff --git a/modules/release-notes/pages/sysadmin/Distribution.adoc b/modules/release-notes/pages/sysadmin/Distribution.adoc index ae1556a..95fd5ce 100644 --- a/modules/release-notes/pages/sysadmin/Distribution.adoc +++ b/modules/release-notes/pages/sysadmin/Distribution.adoc @@ -7,7 +7,7 @@ include::{partialsdir}/entities.adoc[] [[grub-modules]] == EFI build of GRUB2 now contains several security-oriented modules -The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the *GRUB EFI* builds to enhance users' trust in integrity of early-launch code. +The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the *GRUB EFI* build to enhance users' trust in integrity of early-launch code. This change enables users on their systems with disabled *Secure Boot* technology to verify signatures of *GRUB* modules or employ nearly full disk encryption. diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index ed1dac6..484eee3 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -6,5 +6,5 @@ include::{partialsdir}/entities.adoc[] == EFI build of GRUB2 now contains several security-oriented modules -The `grub2-efi-x64` package in Fedora 31 contains the `cryptodisk`, `luks` and `verify` *GRUB* modules. For more details see the xref:sysadmin/Distribution.adoc#grub-modules[Distribution-wide changes] section. +The *GRUB EFI* build in Fedora 31 contains the `cryptodisk`, `luks` and `verify` *GRUB* modules. For more details see the xref:sysadmin/Distribution.adoc#grub-modules[Distribution-wide changes] section. From 1de1f894bc788e8a35baabf6993435799da48c77 Mon Sep 17 00:00:00 2001 From: Jaroslav Klech Date: Sep 26 2019 16:46:04 +0000 Subject: [PATCH 4/4] fixup! Applies additional SME feedback --- diff --git a/modules/release-notes/pages/sysadmin/Distribution.adoc b/modules/release-notes/pages/sysadmin/Distribution.adoc index 95fd5ce..6908a46 100644 --- a/modules/release-notes/pages/sysadmin/Distribution.adoc +++ b/modules/release-notes/pages/sysadmin/Distribution.adoc @@ -9,7 +9,7 @@ include::{partialsdir}/entities.adoc[] The `cryptodisk`, `luks` and `verify` *GRUB* modules have been added to the *GRUB EFI* build to enhance users' trust in integrity of early-launch code. -This change enables users on their systems with disabled *Secure Boot* technology to verify signatures of *GRUB* modules or employ nearly full disk encryption. +This change enables users to verify that all files that are read from the disk are properly signed. The feature also allows to employ nearly full disk encryption. [NOTE] ====