Comments (8)
Foxboron
commented on August 14, 2024
So what you are looking at is your OEM firmware vendor having the microsoft signing keys enrolled in KEK and db without the Platform Key. I believe this confuses sbkeysync and enrolling the PK manually with efi-updatevar should work. Are you sure you are unable to clear out all of them?
Frankly sbkeysync is poorly maintained and a lot of this is hopefully going away when I move sbctl to go-uefi. However it's hard to make this 100% fool-proof with the current available tooling.
from sbctl.
Foxboron
commented on August 14, 2024
Here is a checklist you should try:
- Clear all keys from the BIOS menu "Reset all keys" or something similiar
- Post output of
sudo sbkeysync --verbose --dry-run - Output of
sudo lsattr /sys/firmware/efi/efivars/{PK,KEK,db}* - Run
sudo chattr -i /sys/firmware/efi/efivars/{PK,KEK,db}* sudo sbkeysync --verbose --pk- If PK fails, install
efitools efi-updatevar -f /usr/share/secureboot/keys/PK/PK.auth PK- Post output of
sudo sbkeysync --verbose --dry-run
from sbctl.
WhyNotHugo
commented on August 14, 2024
My firmware has two settings, Reset all keys and Delete all keys.
I first ran Reset all keys:
# sbkeysync --verbose --dry-run
Filesystem keystore:
/usr/share/secureboot/keys/db/db.der [1276 bytes]
/usr/share/secureboot/keys/db/db.der.esl [1320 bytes]
/usr/share/secureboot/keys/db/db.pem [1785 bytes]
/usr/share/secureboot/keys/db/db.key [3272 bytes]
/usr/share/secureboot/keys/db/db.auth [3433 bytes]
/usr/share/secureboot/keys/KEK/KEK.auth [3425 bytes]
/usr/share/secureboot/keys/KEK/KEK.key [3272 bytes]
/usr/share/secureboot/keys/KEK/KEK.der [1292 bytes]
/usr/share/secureboot/keys/KEK/KEK.der.esl [1336 bytes]
/usr/share/secureboot/keys/KEK/KEK.pem [1805 bytes]
/usr/share/secureboot/keys/PK/PK.auth [3409 bytes]
/usr/share/secureboot/keys/PK/PK.pem [1785 bytes]
/usr/share/secureboot/keys/PK/PK.der [1276 bytes]
/usr/share/secureboot/keys/PK/PK.der.esl [1320 bytes]
/usr/share/secureboot/keys/PK/PK.key [3272 bytes]
Invalid key /usr/share/secureboot/keys/PK/PK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.key
- unknown cert type
firmware keys:
PK:
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. Platform Key
KEK:
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation KEK CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. Key Exchange Key
db:
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. UEFI DB
dbx:
45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e
64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745
939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049
3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9
c83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884
77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2f
55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5ba
ca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65b
fecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436
fe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01
fddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8
e92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fa
d8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fa
ce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540ce
cb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7
c90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8b
c617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967f
c409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fc
bc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7
b97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9
b8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736
b54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55
afe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3
aeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1
ad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720
a7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458d
a6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7
9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734
9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42
8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481c
8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521
8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9
895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163daf
82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67
81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4
7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5
72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8
726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1
71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375
6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785e
6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11
6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66
5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5c
518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135
47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adf
4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692
3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73
3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02
3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2
306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593
2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7d
2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17d
2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8
2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939
18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10f
174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920c
106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689c
0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfc
0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140f
0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898c
0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374
09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26
07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09e
075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238
90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44c
29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44
d063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56d
d626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1
5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992ea
58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771
c3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66
e6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5
1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06
363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76
c5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbd
f52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7a
80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows PCA 2010
filesystem keys:
PK:
/C=Platform Key/CN=Platform Key
from /usr/share/secureboot/keys/PK/PK.auth
KEK:
/C=Key Exchange Key/CN=Key Exchange Key
from /usr/share/secureboot/keys/KEK/KEK.auth
db:
/C=Database Key/CN=Database Key
from /usr/share/secureboot/keys/db/db.auth
dbx:
New keys in filesystem:
/usr/share/secureboot/keys/db/db.auth
/usr/share/secureboot/keys/KEK/KEK.auth
/usr/share/secureboot/keys/PK/PK.auth
# sbctl status
==> Setup Mode: Disabled
==> WARNING: Secure Boot: Disabled
# lsattr /sys/firmware/efi/efivars/{PK,KEK,db}*
----i----------------- /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c
----i----------------- /sys/firmware/efi/efivars/PKDefault-8be4df61-93ca-11d2-aa0d-00e098032b8c
----i----------------- /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c
----i----------------- /sys/firmware/efi/efivars/KEKDefault-8be4df61-93ca-11d2-aa0d-00e098032b8c
----i----------------- /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
----i----------------- /sys/firmware/efi/efivars/dbDefault-8be4df61-93ca-11d2-aa0d-00e098032b8c
----i----------------- /sys/firmware/efi/efivars/dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f
----i----------------- /sys/firmware/efi/efivars/dbxDefault-8be4df61-93ca-11d2-aa0d-00e098032b8cApparently, resetting all keys also disables setup mode (I think it's a bug,
since the UI still showed the right checkbox).
I rebooted and re-enabled setup mode. The output off sbkeysync and lsattr
remained the same. The status change is properly reflected:
# sbctl status
==> WARNING: Setup Mode: Enabled
==> WARNING: Secure Boot: Disabled# sbkeysync --verbose --pk
Filesystem keystore:
/usr/share/secureboot/keys/db/db.der [1276 bytes]
/usr/share/secureboot/keys/db/db.der.esl [1320 bytes]
/usr/share/secureboot/keys/db/db.pem [1785 bytes]
/usr/share/secureboot/keys/db/db.key [3272 bytes]
/usr/share/secureboot/keys/db/db.auth [3433 bytes]
/usr/share/secureboot/keys/KEK/KEK.auth [3425 bytes]
/usr/share/secureboot/keys/KEK/KEK.key [3272 bytes]
/usr/share/secureboot/keys/KEK/KEK.der [1292 bytes]
/usr/share/secureboot/keys/KEK/KEK.der.esl [1336 bytes]
/usr/share/secureboot/keys/KEK/KEK.pem [1805 bytes]
/usr/share/secureboot/keys/PK/PK.auth [3409 bytes]
/usr/share/secureboot/keys/PK/PK.pem [1785 bytes]
/usr/share/secureboot/keys/PK/PK.der [1276 bytes]
/usr/share/secureboot/keys/PK/PK.der.esl [1320 bytes]
/usr/share/secureboot/keys/PK/PK.key [3272 bytes]
Invalid key /usr/share/secureboot/keys/PK/PK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.key
- unknown cert type
firmware keys:
PK:
KEK:
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation KEK CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. Key Exchange Key
db:
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. UEFI DB
dbx:
45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e
64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745
939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049
3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9
c83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884
77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2f
55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5ba
ca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65b
fecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436
fe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01
fddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8
e92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fa
d8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fa
ce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540ce
cb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7
c90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8b
c617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967f
c409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fc
bc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7
b97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9
b8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736
b54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55
afe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3
aeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1
ad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720
a7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458d
a6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7
9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734
9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42
8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481c
8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521
8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9
895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163daf
82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67
81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4
7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5
72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8
726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1
71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375
6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785e
6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11
6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66
5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5c
518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135
47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adf
4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692
3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73
3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02
3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2
306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593
2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7d
2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17d
2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8
2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939
18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10f
174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920c
106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689c
0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfc
0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140f
0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898c
0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374
09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26
07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09e
075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238
90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44c
29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44
d063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56d
d626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1
5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992ea
58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771
c3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66
e6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5
1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06
363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76
c5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbd
f52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7a
80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows PCA 2010
filesystem keys:
PK:
/C=Platform Key/CN=Platform Key
from /usr/share/secureboot/keys/PK/PK.auth
KEK:
/C=Key Exchange Key/CN=Key Exchange Key
from /usr/share/secureboot/keys/KEK/KEK.auth
db:
/C=Database Key/CN=Database Key
from /usr/share/secureboot/keys/db/db.auth
dbx:
New keys in filesystem:
/usr/share/secureboot/keys/db/db.auth
/usr/share/secureboot/keys/KEK/KEK.auth
/usr/share/secureboot/keys/PK/PK.auth
Inserting key update /usr/share/secureboot/keys/db/db.auth into db
Inserting key update /usr/share/secureboot/keys/KEK/KEK.auth into KEK
Inserting key update /usr/share/secureboot/keys/PK/PK.auth into PK
Finally:
# sbkeysync --verbose
Filesystem keystore:
/usr/share/secureboot/keys/db/db.der [1276 bytes]
/usr/share/secureboot/keys/db/db.der.esl [1320 bytes]
/usr/share/secureboot/keys/db/db.pem [1785 bytes]
/usr/share/secureboot/keys/db/db.key [3272 bytes]
/usr/share/secureboot/keys/db/db.auth [3433 bytes]
/usr/share/secureboot/keys/KEK/KEK.auth [3425 bytes]
/usr/share/secureboot/keys/KEK/KEK.key [3272 bytes]
/usr/share/secureboot/keys/KEK/KEK.der [1292 bytes]
/usr/share/secureboot/keys/KEK/KEK.der.esl [1336 bytes]
/usr/share/secureboot/keys/KEK/KEK.pem [1805 bytes]
/usr/share/secureboot/keys/PK/PK.auth [3409 bytes]
/usr/share/secureboot/keys/PK/PK.pem [1785 bytes]
/usr/share/secureboot/keys/PK/PK.der [1276 bytes]
/usr/share/secureboot/keys/PK/PK.der.esl [1320 bytes]
/usr/share/secureboot/keys/PK/PK.key [3272 bytes]
Invalid key /usr/share/secureboot/keys/PK/PK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/PK/PK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.key
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/KEK/KEK.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.der.esl
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.pem
- unknown cert type
Invalid key /usr/share/secureboot/keys/db/db.key
- unknown cert type
firmware keys:
PK:
/C=Platform Key/CN=Platform Key
KEK:
/C=Key Exchange Key/CN=Key Exchange Key
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation KEK CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. Key Exchange Key
db:
/C=Database Key/CN=Database Key
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
/C=US/ST=Texas/L=Round Rock/O=Dell Inc./CN=Dell Inc. UEFI DB
dbx:
45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e
64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745
939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049
3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9
c83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884
77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2f
55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5ba
ca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65b
fecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436
fe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01
fddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8
e92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fa
d8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fa
ce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540ce
cb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7
c90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8b
c617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967f
c409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fc
bc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7
b97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9
b8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736
b54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55
afe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3
aeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1
ad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720
a7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458d
a6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7
9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734
9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42
8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481c
8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521
8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9
895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163daf
82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67
81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4
7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5
72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8
726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1
71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375
6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785e
6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11
6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66
5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5c
518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135
47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adf
4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692
3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73
3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02
3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2
306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593
2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7d
2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17d
2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8
2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939
18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10f
174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920c
106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689c
0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfc
0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140f
0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898c
0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374
09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26
07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09e
075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238
90fbe70e69d633408d3e170c6832dbb2d209e0272527dfb63d49d29572a6f44c
29c6eb52b43c3aa18b2cd8ed6ea8607cef3cfae1bafe1165755cf2e614844a44
d063ec28f67eba53f1642dbf7dff33c6a32add869f6013fe162e2c32f1cbe56d
d626157e1d6a718bc124ab8da27cbb65072ca03a7b6b257dbdcbbd60f65ef3d1
5391c3a2fb112102a6aa1edc25ae77e19f5d6f09cd09eeb2509922bfcd5992ea
58fb941aef95a25943b3fb5f2510a0df3fe44c58c95e0ab80487297568ab9771
c3a99a460da464a057c3586d83cef5f4ae08b7103979ed8932742df0ed530c66
e6ca68e94146629af03f69c2f86e6bef62f930b37c6fbcc878b78df98c0334e5
1aec84b84b6c65a51220a9be7181965230210d62d6d33c48999c6b295a2b0a06
363384d14d1f2e0b7815626484c459ad57a318ef4396266048d058c5a19bbf76
c5d9d8a186e2c82d09afaa2a6f7f2e73870d3e64f72c4e08ef67796a840f0fbd
f52f83a3fa9cfbd6920f722824dbe4034534d25b8507246b3b957dac6e1bce7a
80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a
/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows PCA 2010
filesystem keys:
PK:
/C=Platform Key/CN=Platform Key
from /usr/share/secureboot/keys/PK/PK.auth
KEK:
/C=Key Exchange Key/CN=Key Exchange Key
from /usr/share/secureboot/keys/KEK/KEK.auth
db:
/C=Database Key/CN=Database Key
from /usr/share/secureboot/keys/db/db.auth
dbx:
New keys in filesystem:
Shall I try the delete all keys option too?
from sbctl.
WhyNotHugo
commented on August 14, 2024
I found a checkbox that says "custom mode" in the UEFI, and the manual seems to indicate that this is required to enroll new keys. Oddly though, when I toggle it, the "save" button is disabled (no matter what I set it to). It does seem to save immediately (unlike all the other settings in the UEFI/BIOS).
However, there's also a setting to enable / disable "Setup Mode(andsbctl status` reflects on this correctly).
Am I mixing up two different things here?
from sbctl.
WhyNotHugo
commented on August 14, 2024
Frankly sbkeysync is poorly maintained and a lot of this is hopefully going away when I move sbctl to go-uefi. However it's hard to make this 100% fool-proof with the current available tooling.
Thanks! I appreciate the ongoing effort in maintaining this tools to make this whole process simpler :)
from sbctl.
Foxboron
commented on August 14, 2024
The second run of sbkeysync actually enrolls PK and everything should be working. I assume the confusion of the immutable flag in efivarfs is part of the cause here.
"Custom Mode" set to "User Mode" should be the proper thing, and "Delete all keys" is the proper action, while "Reset" would enroll the OEM keys. All of this is confusing so don't worry if it's not super clear the first time around :)
I should get my shit together and improve the documentation on https://secureboot.dev properly :)
from sbctl.
WhyNotHugo
commented on August 14, 2024
I blame Dell here for making this so non-obvious.
There's a "Secure Boot" screen which has two options:
- Deployed mode: basically
Setup Mode: Disabled. - Audit mode: basically:
Setup Mode: Enabled.
There's another, separate screen with a Custom Mode. On all other screens, when I change any value the Apply (save) button gets enabled. For this one it doesn't, but it seems the value is saved right away (without any indication). I initially though there was simply no way to change it, so kind of ignored the whole thing. 😅
If Custom Mode is off, then I get the initial behaviour of Operation not permitted, and it it's on, then it seems enrolling the keys work, so it seem to do what you indicated.
It also seems that enabling Custom Mode disabled Setup Mode, but does not update the checkbox on the UI until after rebooting (so one would think it's still on). Figured that out via sbctl status and a few reboots.
Thanks for you patience here, enrolling has worked. Hopefully these details might help someone else in future.
from sbctl.
Foxboron
commented on August 14, 2024
No problem. thanks for the write up :) Enjoy sbctl!
from sbctl.
Related Issues (20)
- Enabling Secure Boot with enroll-keys HOT 3
- Automatic signing mkinitcpio post hook not working in latest archlinux package HOT 1
- Mkinitcpio post hook error HOT 4
- In the README the Ubuntu package link is not available, it takes the reader to the OpenSUSE package HOT 3
- Implement sbctl debug HOT 1
- Multiple displays and resolution doesn't work HOT 9
- Cannot re-enroll keys after upgrading system HOT 4
- Kernel removal fails if image file is already removed, resulting in multiple installed kernels on fedora HOT 2
- Unable to make secure boot to work on Surface Go 1st Gen and Arch Linux
- sbctl sign-all does not sign all efi binaries HOT 8
- `sbctl reset` when in setup mode results in PC hang
- Suggestion: Only sign generated file in initcpio hook, use sign-all in a separate pacman hook HOT 4
- sbctl won't work on Fujtsu Lifebook A574/M, BIOS would just reset ANY USER intervention of the secure boot changes HOT 6
- [archlinux] failed signing ***: *** does not exist HOT 3
- my Bios gone black HOT 4
- pacstrap fails due to mkinitcpio post hook HOT 2
- initcpio hook adds temporary files to list HOT 1
- kernel-install plugin fails with uki layout when removing HOT 1
- [Good News] Lenovo Thinkpad Yoga L13 AMD Gen 2 does not brick when removing vendor+ms keys. HOT 6
- sbctl sign failing with "binary has no valid signatures" HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sbctl.