Re: Debian live boot corrupting secure boot

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Valerio Vanni <valerio.vanni@inwind.it>
Newsgroups	linux.debian.user
Subject	Re: Debian live boot corrupting secure boot
Date	Tue, 03 Oct 2023 12:20:01 +0200
Message-ID	<HkKFr-devd-1@gated-at.bofh.it> (permalink)
References	<HiLFE-c08q-9@gated-at.bofh.it> <HkD1f-d9Qz-3@gated-at.bofh.it>
X-Original-To	debian-user@lists.debian.org
X-Mailbox-Line	From debian-user-request@lists.debian.org Tue Oct 3 10:15:45 2023
Old-Return-Path	<valerio.vanni@inwind.it>
X-Amavis-Spam-Status	No, score=-10.257 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, NICE_REPLY_A=-3.058, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
X-Policyd-Weight	NOT_IN_SBL_XBL_SPAMHAUS=-1.5 HELO_IP_IN_CL16_SUBNET=-0.41 (check from: .inwind. - helo: .libero. - helo-domain: .libero.) FROM/MX_MATCHES_NOT_UNVR_HELO(DOMAIN)_NOR_CL_NAME(DOMAIN)=1.6 RESOLVED_IP_IS_NOT_HELO=0.5; rate: 0.19
X-Libjamoibt	1601
X-Cnfs-Analysis	v=2.4 cv=Q/EUoa6a c=1 sm=1 tr=0 ts=651be9bf cx=a_exe a=ISCxQgxFsz8cH4CM93yxxQ==:117 a=ISCxQgxFsz8cH4CM93yxxQ==:17 a=IkcTkHD0fZMA:10 a=yMhMjlubAAAA:8 a=o9FsnWtoKAUyibY50-sA:9 a=QEXdDO2ut3YA:10
MIME-Version	1.0
User-Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.13.1
Content-Language	it-IT
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	7bit
X-Antivirus	AVG (VPS 231003-0, 3/10/2023), Outbound message
X-Antivirus-Status	Clean
X-Cmae-Envelope	MS4xfPzV36q5Y+ec7un7Cjnd25WEo8U1Fr0Tea8U5rbJL0caedqGD6xfi/LwfMEz6D0DTCs8p7SrEq4iKPu44CjGkyBO5zulKwYILAypV9IVgXji5Hlxb/a0 uOUjLA4JYFUxfu431iOKVsv7IvkvtclMgsaXRPPiPcGFZhaf1NKm4KJnaZ0EzlEJYF9VCXQ6rnvQq/0TOAZSAzR46Z5tgE3C8ss=
X-Mailing-List	<debian-user@lists.debian.org> archive/latest/803786
List-ID	<debian-user.lists.debian.org>
List-URL	<https://lists.debian.org/debian-user/>
List-Archive	https://lists.debian.org/msgid-search/1c9a4456-aab2-9618-e812-cf295a3d51e2@inwind.it
Approved	robomod@news.nic.it
Lines	29
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Tue, 3 Oct 2023 12:15:27 +0200
X-Original-Message-ID	<1c9a4456-aab2-9618-e812-cf295a3d51e2@inwind.it>
X-Original-References	<7ae712ef-3dbe-77e1-59ca-4fdc3f9837ac@inwind.it> <CAH8yC8k_Vv1kukRmm35pRytNag89-xoRrag6XN92F1oTUJsvOQ@mail.gmail.com>
Xref	csiph.com linux.debian.user:262117

Show key headers only | View raw

Il 03/10/2023 04:01, Jeffrey Walton ha scritto:

>>> Does it mean that you can not boot your *old* Clonezilla live after booting a latest Clonezilla? If so, it is better to discuss the issue with shim or grub developers.
>>
>> Yes. If I load a Clonezilla live newer than 3.1.0-11, then I cannot boot
>> anymore 2.8.1-12.
> 
> I would probably bet if you booted to Windows, the OS would check the
> Forbidden Signature/Secure Boot DBX and (re)apply KB5012170 [0] as
> required.

No, it hasn't happen. If you read entire discussion, it hasn't happen 
nieither with Windows 10 nor Windows 11.
The only action that breaks secure boot of Clonezilla 2.8.1-12 is 
reaching the page of Grub entries in recent Clonezilla and Debian live.

> So you are probably going to have to deal with this sooner rather than
> later. Both OSes are going to try to update the database with
> signatures of the bad grub programs. Or I would not bet against it.
> 
> Jeff
> 
> [0] https://support.microsoft.com/en-gb/topic/kb5012170-security-update-for-secure-boot-dbx-72ff5eed-25b4-47c7-be28-c42bd211bb15

Yes, no one can tell... but this update has more than six months.
So far it seems that Linux has a larger revocation database.

And, even if Windows would adobt this larger database, I keep on 
considering it bad in a live environment. Be it Live Windows or Live Linux.

Thread

Re: Debian live boot corrupting secure boot Valerio Vanni <valerio.vanni@inwind.it> - 2023-09-28 01:00 +0200
  Re: Debian live boot corrupting secure boot Max Nikulin <manikulin@gmail.com> - 2023-09-28 05:10 +0200
    Re: Debian live boot corrupting secure boot Stefan Monnier <monnier@iro.umontreal.ca> - 2023-09-28 16:20 +0200
      Re: Debian live boot corrupting secure boot Steve McIntyre <steve@einval.com> - 2023-09-29 12:00 +0200
        On the uses of secure boot [was: Debian live boot corrupting secure  boot] <tomas@tuxteam.de> - 2023-09-29 12:20 +0200
          Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] Max Nikulin <manikulin@gmail.com> - 2023-09-29 12:30 +0200
          Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] Curt <curty@free.fr> - 2023-09-29 18:50 +0200
            Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] <tomas@tuxteam.de> - 2023-09-30 09:30 +0200
  Re: Debian live boot corrupting secure boot Steve McIntyre <steve@einval.com> - 2023-09-29 13:00 +0200
  Re: Debian live boot corrupting secure boot Jeffrey Walton <noloader@gmail.com> - 2023-10-03 04:10 +0200
    Re: Debian live boot corrupting secure boot Valerio Vanni <valerio.vanni@inwind.it> - 2023-10-03 12:20 +0200
      Re: Debian live boot corrupting secure boot Jeffrey Walton <noloader@gmail.com> - 2023-10-04 19:20 +0200

csiph-web