These are UEFI/BIOS reported configurations/settings that differ based on hardware support and not much can be done about them from within Ubuntu(apart from updating your UEFI/BIOS firmware) ... These also are the kind of information that would be listed in the extended product specifications of your machine ... Operating System type makes little to sometimes none effect on how those are reported by the UEFI/BIOS.
That report is a result of a security assessment by the fwupdmgr security tool ... It classifies a machine(based on how UEFI/BIOS report it's hardware/firmware components) and as stated in Verifying Host Firmware Security:
To start out some core protections must be assigned a relative
importance.
The above mentioned relativity can and does change from one version to the next and as a result security class might be upgraded or downgraded.
Then an evaluation must be done to determine how each vendor is
conforming to the model.
The report you see is the result of the above two procedures.
And should be parsed/read in the stated context:
For instance, a user might say that for home use any hardware the bare
minimum security level (HSI:1) is good enough. For a work laptop the
company IT department might restrict the choice of models to anything
meeting the criteria of level HSI:2 or above. A journalist or a
security researcher would only buy level HSI:3 and above.
And, as a mostly none-technical side effect:
The reality is that HSI:4 is going to be more expensive than some
unbranded hardware that is rated HSI:0.
even if that unbranded/unreported hardware is of high quality and may satisfy high security requirements.
However, there are conditions and limitations as also stated:
To be trusted, this rating information should be distributed in a
centralized agnostic database such as the LVFS.
Not all vendors support LVFS(Linux Vendor Firmware Service) and not all those who support it do that for all their products and not all of the latter do that in a timely prompt manner.
In addition Runtime Behavior is also taken into consideration in that security assessment process.
That said, back to your question:
security check fails. Is this OK?
As far as Runtime Behavior goes, the only reported Fail is:
Linux Swap: ! Fail (Not Encrypted)
Which in fact is based on that swap is unencrypted(which is the norm on the majority of Linux machines ... We only encrypt swap in possibly highly vulnerable environments e.g. multi-user machines that may swap sensitive data) ... So, decide for yourself if it's okay or encrypt your swap.
As far as security levels go, you need to first decide which security level you aim for and then read the report accordingly ... For example, if your aim is a security level of HSI:1 (Critical State) which is described as:
Basic protection but any failure would lead to a critical security
impact.
This security level corresponds to the most basic of security
protections considered essential by security professionals. Any
failures at this level would have critical security impact and could
likely be used to compromise the system firmware without physical
access.
Then, looking at the relevant part(under HSI-1 Tests) of your report, shows that the only reported Fail entry is:
Intel Management Engine Version: ! Fail (Not Valid)
The reason appears to be either an unsupported motherboard/CPU main chip(Which is unlikely given your specifications) or an outdated version of Intel Management Engine that can mean a mismatch between the installed version and the one recently updated at LVFS which as described at Intel Management Engine (CSME) version is invalid can be a result of the cached LVFS data on your system that can be solved by forcefully refreshing your local copy with:
fwupdmgr refresh --force
and upgrading your firmware afterwards with:
fwupdmgr update
Apart from that, any failure at higher security levels than your aim, should be irrelevant as far as security ranking goes.
Probably, worth noting as well that if you disable some UEFI/BIOS features like Secure Boot for instance and install some needed proprietary driver, both of these will be reported as a Fail and will lower your machine’s security classification … So, even in that sense, I guess that sometimes "Success is not built on success. It’s built on failure."
However, these ratings are, certainly, not targeted to advanced users, but, as it seems, rather to the majority basic level users and even then some of us(@Austin Hemmelgarn and others myself included) might prefer to call it an informative security guideline rather than a strict ranking system … Useful nonetheless but one ought to keep in mind the basis for this security ranking system made clear by this statement from the official documentation which I had already quoted above and which reads:
... considered essential by security professionals.
