Device Security Report ====================== Report details Date generated: 2023-06-03 10:15:33 fwupd version: 1.8.12 System details Hardware model: LENOVO 81DE Processor: Intel(R) Core(TM) i3-7020U CPU @ 2.30GHz OS: Ubuntu 23.04 Security level: HSI:0! (v1.8.12) HSI-1 Tests Intel Management Engine Version: ! Fail (Not Valid) UEFI Platform Key: Pass (Valid) TPM v2.0: Pass (Found) Firmware BIOS Region: Pass (Locked) Firmware Write Protection Lock: Pass (Enabled) Platform Debugging: Pass (Not Enabled) Intel Management Engine Manufacturing Mode: Pass (Locked) UEFI Secure Boot: Pass (Enabled) Firmware Write Protection: Pass (Not Enabled) Intel Management Engine Override: Pass (Locked) TPM Platform Configuration: Pass (Valid) HSI-2 Tests Intel BootGuard Fuse: Pass (Valid) Intel BootGuard Verified Boot: ! Fail (Not Valid) Intel BootGuard ACM Protected: ! Fail (Not Valid) Intel BootGuard: Pass (Enabled) IOMMU Protection: ! Fail (Not Found) TPM Reconstruction: Pass (Valid) Platform Debugging: Pass (Locked) HSI-3 Tests Suspend To RAM: ! Fail (Enabled) Intel BootGuard Error Policy: ! Fail (Not Valid) Pre-boot DMA Protection: ! Fail (Not Enabled) Intel CET: ! Fail (Not Supported) Suspend To Idle: ! Fail (Not Enabled) HSI-4 Tests Encrypted RAM: ! Fail (Not Supported) Intel SMAP: Pass (Enabled) Runtime Tests Firmware Updater Verification: Pass (Not Tainted) Linux Swap: ! Fail (Not Encrypted) Linux Kernel Lockdown: Pass (Enabled) Linux Kernel Verification: Pass (Not Tainted) Host security events For information on the contents of this report, see https://fwupd.github.io/hsi.html
These are UEFI/BIOS reported configurations/settings that differ based on hardware support and not much can be done about them from within Ubuntu(apart from updating your UEFI/BIOS firmware) ... These also are the kind of information that would be listed in the extended product specifications of your machine ... Operating System type makes little to sometimes none effect on how those are reported by the UEFI/BIOS.
That report is a result of a security assessment by the
fwupdmgr security tool ... It classifies a machine(based on how UEFI/BIOS report it's hardware/firmware components) and as stated in Verifying Host Firmware Security:
To start out some core protections must be assigned a relative importance.
The above mentioned relativity can and does change from one version to the next and as a result security class might be upgraded or downgraded.
Then an evaluation must be done to determine how each vendor is conforming to the model.
The report you see is the result of the above two procedures.
And should be parsed/read in the stated context:
For instance, a user might say that for home use any hardware the bare minimum security level (
HSI:1) is good enough. For a work laptop the company IT department might restrict the choice of models to anything meeting the criteria of level
HSI:2or above. A journalist or a security researcher would only buy level
And, as a mostly none-technical side effect:
The reality is that
HSI:4is going to be more expensive than some unbranded hardware that is rated
even if that unbranded/unreported hardware is of high quality and may satisfy high security requirements.
However, there are conditions and limitations as also stated:
To be trusted, this rating information should be distributed in a centralized agnostic database such as the LVFS.
Not all vendors support LVFS(Linux Vendor Firmware Service) and not all those who support it do that for all their products and not all of the latter do that in a timely prompt manner.
In addition Runtime Behavior is also taken into consideration in that security assessment process.
That said, back to your question:
security check fails. Is this OK?
As far as Runtime Behavior goes, the only reported
Linux Swap: ! Fail (Not Encrypted)
Which in fact is based on that swap is unencrypted(which is the norm on the majority of Linux machines ... We only encrypt swap in possibly highly vulnerable environments e.g. multi-user machines that may swap sensitive data) ... So, decide for yourself if it's okay or encrypt your swap.
As far as security levels go, you need to first decide which security level you aim for and then read the report accordingly ... For example, if your aim is a security level of HSI:1 (Critical State) which is described as:
Basic protection but any failure would lead to a critical security impact.
This security level corresponds to the most basic of security protections considered essential by security professionals. Any failures at this level would have critical security impact and could likely be used to compromise the system firmware without physical access.
Then, looking at the relevant part(under
HSI-1 Tests) of your report, shows that the only reported
Fail entry is:
Intel Management Engine Version: ! Fail (Not Valid)
The reason appears to be either an unsupported motherboard/CPU main chip(Which is unlikely given your specifications) or an outdated version of Intel Management Engine that can mean a mismatch between the installed version and the one recently updated at LVFS which as described at Intel Management Engine (CSME) version is invalid can be a result of the cached LVFS data on your system that can be solved by forcefully refreshing your local copy with:
fwupdmgr refresh --force
and upgrading your firmware afterwards with:
Apart from that, any failure at higher security levels than your aim, should be irrelevant as far as security ranking goes.
Probably, worth noting as well that if you disable some UEFI/BIOS features like Secure Boot for instance and install some needed proprietary driver, both of these will be reported as a
Fail and will lower your machine’s security classification … So, even in that sense, I guess that sometimes "Success is not built on success. It’s built on failure."
However, these ratings are, certainly, not targeted to advanced users, but, as it seems, rather to the majority basic level users and even then some of us(@Austin Hemmelgarn and others myself included) might prefer to call it an informative security guideline rather than a strict ranking system … Useful nonetheless but one ought to keep in mind the basis for this security ranking system made clear by this statement from the official documentation which I had already quoted above and which reads:
... considered essential by security professionals.