Re: Debian live boot corrupting secure boot

[Max Nikulin <manikulin@gmail.com>]

On 30/09/2023 20:53, Valerio Vanni wrote:
> Il 29/09/2023 05:39, Max Nikulin ha scritto:
>
> > That is why I am suggesting to check for discussions related to shim & 
> > grub and to ask people involved into their development.
>
> I'll try. I don't feel confortable at the idea that a live environment 
> could do such a change.

In general I agree with you, but some restrictions may exist.

> At least a warning "I'm going to blacklist something, do you want to 
> continue?".

It is just speculation. To show a warning you need to execute some code. 
However .efi file is considered unsafe due to unknown signature. I have 
no idea concerning origin of code that injects newer keys. It should be 
some special case for secure boot.

> > Yes, I do. My idea is to build custom image of old Clonezilla with EFI 
> > files signed by you own keys. The downside is that you need  to 
> > install your keys to every box where you are going to boot your images.
>
> Doesn't seem practical. I am the mantainer of that disk image: I keep it 
> updated, I keep it tested after updates and after modifications I get 
> from applications' mantainers.

You may ask Clonezilla developers to make an image with old version and 
new grub-signed and shim-signed. I think, you even could do it yourself. 
Take an old image, put EFI, grub directories and kernel files from a new 
image. Perhaps adjust some config files if they include Clonezilla 
version. This way allows to avoid dealing with custom secure boot keys.

> But neither Asus (bios from start of September) nor Microsoft (Windows 
> 11) do that blacklisting.

Do you mean Windows install on hard drive or Windows install image?

> > Notice, it is still just a hypothesis that your issues are caused by 
> > new keys and it has to be confirmed by comparison key lists before and 
> > after.
>
> I'll try with
> efibootmgr -v
> when I have here another machine

This particular command lists boot entries (location of .efi file to 
boot), not secure boot keys. I mentioned it because I had an issue 
namely with boot entries. In your case they may be unaffected.

If firmware has the "EFI shell" option then you may try "bcfg boot dump 
-v". Unsure if it is possible to redirect output to a file.

> I don't know if Clonezilla has this package installed,

Then you may try any other live image. Perhaps some of Debian live, 
grml, system rescue have necessary tools installed.

> Clonezilla come in many flavours, the main line is based on Debian 
> (stable - testing) and the alternate one is based on Ubuntu (alternate 
> stable - alternate testign).
>
> I'll try also with a non related distribution, as you suggest.

I mean an image from Fedora, not Clonezilla based on Fedora.