Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #261958

Re: Debian live boot corrupting secure boot

Show all headers | View raw

On Wed, 27 Sep 2023 09:54:31 +0700 Max Nikulin <manikulin@gmail.com> wrote:
>     I found the issue on latest versions of Clonezilla, but then I tried 
> 
>                        ^^^^^^
> 
>     with plain Debian live and the behavior is the same.
> 
> 
> Does it mean that you can not boot your *old* Clonezilla live after booting a latest Clonezilla? If so, it is better to discuss the issue with shim or grub developers.

Yes. If I load a Clonezilla live newer than 3.1.0-11, then I cannot boot 
anymore 2.8.1-12.

> 
>     1) Machine brand new: secure boot is active, Windows 10 shows it active, I can boot an old Clonezilla live (2.8.1-12) as many times as I want. 
> 
> An old image may be signed by a key later added to certificate revocation lists. If so, secure boot just works as it is supposed to do.

I didn't consider that... But it makes sense.

>     2) I boot from USB drive Debian Live 12
>     https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/debian-live-12.1.0-amd64-kde.iso
> 
> 
> If it can be reproduced with a contemporary Clonezilla or e.g. a Fedora image then it is not a Debian issue. If it is specific to namely Debian (I am unsure concerning Ubuntu, Debian derivatives) then it is better to file a bug providing more details.

As I said, the image that is not loaded anymore is older Clonezilla.
The image that alters secure boot is newer Clonezilla, and then I found 
that newer Debian does the same.
I still haven't found an old version of Debian that cannot boot after 
newer one (but I only tried 10 live, so far).

>     4) I reflash BIOS, same version, and go to point 1.
> 
> 
> How old is your BIOS? Maybe you just restore obsolete list signing of keys.

Perhaps... I have no option during reflash.

BIOS has 9 month. One month ago a new version has been released: some 
day ago I installed it but it behaves just like the previous.

> I suggest to compare
> 
>     efibootmgr -v
> 
> output in the state when Clonezilla may be booted and when it fails. In addition public keys and certificate revocation list should be compared (unsure concerning commands).

I'll try as soon as I have another identical machine.

> My opinion is that just loading boot images without installing OS should not modify firmware state. In this sense it may be a bug.

Not only I didn't install any OS, I didn't boot any image. It's enough 
to reach first page (grub entries) and the damage is done.

> On the other hand, forgot old images if you have secure boot enabled.

Or forget the new ones ;-)

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: Debian live boot corrupting secure boot Valerio Vanni <valerio.vanni@inwind.it> - 2023-09-28 01:00 +0200
  Re: Debian live boot corrupting secure boot Max Nikulin <manikulin@gmail.com> - 2023-09-28 05:10 +0200
    Re: Debian live boot corrupting secure boot Stefan Monnier <monnier@iro.umontreal.ca> - 2023-09-28 16:20 +0200
      Re: Debian live boot corrupting secure boot Steve McIntyre <steve@einval.com> - 2023-09-29 12:00 +0200
        On the uses of secure boot [was: Debian live boot corrupting secure  boot] <tomas@tuxteam.de> - 2023-09-29 12:20 +0200
          Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] Max Nikulin <manikulin@gmail.com> - 2023-09-29 12:30 +0200
          Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] Curt <curty@free.fr> - 2023-09-29 18:50 +0200
            Re: On the uses of secure boot [was: Debian live boot corrupting  secure boot] <tomas@tuxteam.de> - 2023-09-30 09:30 +0200
  Re: Debian live boot corrupting secure boot Steve McIntyre <steve@einval.com> - 2023-09-29 13:00 +0200
  Re: Debian live boot corrupting secure boot Jeffrey Walton <noloader@gmail.com> - 2023-10-03 04:10 +0200
    Re: Debian live boot corrupting secure boot Valerio Vanni <valerio.vanni@inwind.it> - 2023-10-03 12:20 +0200
      Re: Debian live boot corrupting secure boot Jeffrey Walton <noloader@gmail.com> - 2023-10-04 19:20 +0200

csiph-web