Comments (5)
mokutil --import-hash kernel_hash
from shim.
@lcp Unfortunately, that requires the computer to be booted.
My situation: I'm trying to get a USB to boot on secure boot enabled devices with the Microsoft key. I have an encrypted boot partition, so MokManager won't be able to see it. My attempts at using keys and signatures result in the error "Bootloader has not verified loaded image. System is compromised." Both the bootloader (grub) and the Linux kernel are signed with the key enrolled. The bootloader always loads, but it appears that Linux doesn't. I verified that this is not the fault of encryption by testing it on a non encrypted system. I tried hashes, and they worked, but they require an updated version of the kernel in a place where MokManager can access it at all times (can't do this because it eliminates the purpose of an encrypted boot partition) because enrolled hashes or signatures don't transfer from computer to computer. So now, I have a hash in the EFI partition of the kernel, and I it would be great if I were able to use that or get keys to work.
Thank you, I know this is quite a specific situation.
from shim.
That sounds strange to me. For SUSE/openSUSE, we also put grub.efi in ESP and keep the kernel in the encrypted partition. Wonder why your signature couldn't be verified.
from shim.
@lcp Do you have any tips on how to solve this proiblem or a solution?
from shim.
Could you reproduce the issue with OVMF? It's easier to debug shim in a virtual machine. At least you can attach gdb to shim to get more information.
from shim.
Related Issues (20)
- Debugging shim in gdb gives 'Dwarf Error: DW_FORM_line_strp used without required section'
- "Press the Pause key now" message shown but could not pause
- Why kernel builds do not calculate CheckSum or should it be reset to zero? HOT 1
- Setting memory attributes in handle_image() does not comply with UEFI specification
- Is 15.8 being prepared? HOT 7
- Verification by vendor cert -- dead code? HOT 2
- Key was rejected by service 😭
- Shim always uses 512 byte block size to fetch grub EFI binary HOT 2
- Surface Book 2 hangs at vendor logo after firmware upgrade HOT 2
- add option to check if shim is in use - How to check if the system is using shim or not?
- Freshly compiled Shim-15.7 (x86_64) cannot load grubx64.efi HOT 11
- Third-party bootloader support HOT 1
- [Documentation] Usage examples + Screenshots? HOT 5
- 15.8 release tarball can not be verified HOT 7
- Cannot secure boot with new Certificate embedded, Verification failed (0x1A) Security Violation HOT 2
- What is the best way to test Shim with Vendor Certificate HOT 4
- SBAT.md recommends resetting vendor generation numbers after global generation number went up HOT 1
- A request for low-level developers HOT 2
- remove shim HTTP boot due to security issues HOT 10
- Testing shim-15.8, cannot start grub HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from shim.