Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Valerio Vanni Newsgroups: linux.debian.user Subject: Re: Debian live boot corrupting secure boot Date: Tue, 03 Oct 2023 12:20:01 +0200 Message-ID: References: X-Original-To: debian-user@lists.debian.org X-Mailbox-Line: From debian-user-request@lists.debian.org Tue Oct 3 10:15:45 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-10.257 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, NICE_REPLY_A=-3.058, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 HELO_IP_IN_CL16_SUBNET=-0.41 (check from: .inwind. - helo: .libero. - helo-domain: .libero.) FROM/MX_MATCHES_NOT_UNVR_HELO(DOMAIN)_NOR_CL_NAME(DOMAIN)=1.6 RESOLVED_IP_IS_NOT_HELO=0.5; rate: 0.19 X-Libjamoibt: 1601 X-Cnfs-Analysis: v=2.4 cv=Q/EUoa6a c=1 sm=1 tr=0 ts=651be9bf cx=a_exe a=ISCxQgxFsz8cH4CM93yxxQ==:117 a=ISCxQgxFsz8cH4CM93yxxQ==:17 a=IkcTkHD0fZMA:10 a=yMhMjlubAAAA:8 a=o9FsnWtoKAUyibY50-sA:9 a=QEXdDO2ut3YA:10 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.13.1 Content-Language: it-IT Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: AVG (VPS 231003-0, 3/10/2023), Outbound message X-Antivirus-Status: Clean X-Cmae-Envelope: MS4xfPzV36q5Y+ec7un7Cjnd25WEo8U1Fr0Tea8U5rbJL0caedqGD6xfi/LwfMEz6D0DTCs8p7SrEq4iKPu44CjGkyBO5zulKwYILAypV9IVgXji5Hlxb/a0 uOUjLA4JYFUxfu431iOKVsv7IvkvtclMgsaXRPPiPcGFZhaf1NKm4KJnaZ0EzlEJYF9VCXQ6rnvQq/0TOAZSAzR46Z5tgE3C8ss= X-Mailing-List: archive/latest/803786 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/1c9a4456-aab2-9618-e812-cf295a3d51e2@inwind.it Approved: robomod@news.nic.it Lines: 29 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 3 Oct 2023 12:15:27 +0200 X-Original-Message-ID: <1c9a4456-aab2-9618-e812-cf295a3d51e2@inwind.it> X-Original-References: <7ae712ef-3dbe-77e1-59ca-4fdc3f9837ac@inwind.it> Xref: csiph.com linux.debian.user:262117 Il 03/10/2023 04:01, Jeffrey Walton ha scritto: >>> Does it mean that you can not boot your *old* Clonezilla live after booting a latest Clonezilla? If so, it is better to discuss the issue with shim or grub developers. >> >> Yes. If I load a Clonezilla live newer than 3.1.0-11, then I cannot boot >> anymore 2.8.1-12. > > I would probably bet if you booted to Windows, the OS would check the > Forbidden Signature/Secure Boot DBX and (re)apply KB5012170 [0] as > required. No, it hasn't happen. If you read entire discussion, it hasn't happen nieither with Windows 10 nor Windows 11. The only action that breaks secure boot of Clonezilla 2.8.1-12 is reaching the page of Grub entries in recent Clonezilla and Debian live. > So you are probably going to have to deal with this sooner rather than > later. Both OSes are going to try to update the database with > signatures of the bad grub programs. Or I would not bet against it. > > Jeff > > [0] https://support.microsoft.com/en-gb/topic/kb5012170-security-update-for-secure-boot-dbx-72ff5eed-25b4-47c7-be28-c42bd211bb15 Yes, no one can tell... but this update has more than six months. So far it seems that Linux has a larger revocation database. And, even if Windows would adobt this larger database, I keep on considering it bad in a live environment. Be it Live Windows or Live Linux.