Merge ~sdeziel/ubuntu/+source/secureboot-db:not-in-containers into ubuntu/+source/secureboot-db:ubuntu/devel

[Simon Déziel]

[Bryce Harrington (bryce)]

Hi Simon,

There seems not to be a changelog entry for this MP?
You might also consider Seth's suggestion in comment #2 on the bug.

6c2dc3f... by Simon Déziel on 2023-11-21

d/changelog: closes LP: #1840845

Signed-off-by: Simon Deziel <email address hidden>

[Simon Déziel (sdeziel)]

@bryce, thanks for the nudge. Please take another look now that I've rebased the changes and included the detection of the live cd env.

[Dimitri John Ledkov (xnox)]

I have commented on the bug report.
I am happy with the proposed condition virtualization.
I am concerned that live session condition will regress security of our installations.

review: Needs Information

[Simon Déziel (sdeziel)]

@xnox, thanks. I dropped the livecd env detection/condition.

Unmerged commits

6c2dc3f... by Simon Déziel on 2023-11-21

d/changelog: closes LP: #1840845

Signed-off-by: Simon Deziel <email address hidden>

5baab0f... by Simon Déziel on 2023-10-27

d/secureboot-db.service: do not run inside containers

Fixes LP: #1840845

Signed-off-by: Simon Deziel <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index fe81af4..54d704e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+secureboot-db (1.10) noble; urgency=medium
+
+  * d/secureboot-db.service: do not run inside containers (LP: #1840845)
+
+ -- Simon Deziel <[e-mail]>  Tue, 21 Nov 2023 15:26:41 -0500
+
 secureboot-db (1.9) noble; urgency=medium
 
   * Update packaging to debhelper 13
diff --git a/debian/secureboot-db.service b/debian/secureboot-db.service
index 7748e4a..3d34731 100644
--- a/debian/secureboot-db.service
+++ b/debian/secureboot-db.service
@@ -1,6 +1,7 @@
 [Unit]
 Description=Secure Boot updates for DB and DBX
 ConditionPathExists=/sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
+ConditionVirtualization=!container
 
 [Service]
 Type=oneshot