search

lcp / mokutil

The utility to manipulate machine owner keys
GNU General Public License v3.0
60 stars 37 forks source link

8bac3f53 mokutil: check the kernel trusted keyring by default #50

Open hramrach opened 2 years ago

hramrach commented 2 years ago

Why is this?

The key is enrolled with shim, not kernel.

The key built into kernel has nothing to do with keys recognized by shim.

Not enrolling the kernel key makes kernel unbootable for typical distribution kernels that are signed with a key that's also built into the kernel.

hramrach commented 2 years ago

@joeyli

lnussel commented 1 year ago

This is related to https://bugzilla.suse.com/show_bug.cgi?id=1173115