search

lcp / mokutil

The utility to manipulate machine owner keys
GNU General Public License v3.0
70 stars 38 forks source link

MokManager never appears at boot on Azure with RHEL 8 #76

Open RFC1920 opened 12 months ago

RFC1920 commented 12 months ago

We are attempting to load 3rd party drivers with SecureBoot on a RHEL 8 VM on Azure. I know this is probably not a bug with mokutil, but mokmanager never appears at boot, and the new keys are cleared. This process works just fine for us on physical servers and VMWare. But, with Azure, the serial console appears to not engage until it is too late, or otherwise interrupt the shim boot.

I have confirmed via efibootvars that a shim boot is the default. RedHat sent me some commands to extend the timeout for the boot process, but this only caused a hang for about 2 minutes after the console shows "reboot: Restarting system."

echo -en "\xff\xff" > /tmp/2bytes efivar -f /tmp/2bytes -A 7 -w -n 605dab50-e046-4300-abb6-3dd810dd8b23-MokTimeout mokutil --import vendorcrt.der reboot

Just wondering if there are any possible workarounds for this issue. I am relatively certain it has to do with Azure's console.

gfl94 commented 10 months ago

similar case seeing from my side..

found a lot of reference:

https://github.com/lcp/mokutil/issues/11 https://www.reddit.com/r/linux4noobs/comments/ow771j/how_do_you_get_mokmanager_to_come_up_during_the/ https://www.reddit.com/r/AZURE/comments/undlna/mokmanager_and_serial_console/

confirmed my Azure VM has efibootmgr entry configured correctly, booting from shimx64.efi instead of grubx64.efi:

root@xxx:/boot/efi/EFI# efibootmgr -v
BootCurrent: 0001
Timeout: 0 seconds
BootOrder: 0002,0001
Boot0000* MsTemp        AcpiEx(VMBus,,)/VenHw(9b17e5a2-0891-42dd-b653-80b5c22809ba,d96361baa104294db60572e2ffb1dc7f1a78b3f8821e1848a1c363d806ec15bb)/SCSI(0,0)/HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)
Boot0001* ubuntu        HD(15,GPT,2627d760-797e-45fc-b3bc-965cb41cd122,0x2800,0x35000)/File(\EFI\ubuntu\shimx64.efi)
Boot0002* ubuntu_custom HD(1,GPT,e20b901a-844f-4e5f-84e1-12f887ba3071,0x37800,0x3bc8fdf)/File(\EFI\ubuntu\shimx64.efi)

it is still unable to work, not able to see any MokManager entry while rebooting in serial console.

Anyone gets any idea to resolve this?

Luiz-Monad commented 4 weeks ago

The only way I was able to solve this problem was by following this and burning my key on the firmware before even creating the VM, you have to detach the OSDISK and do that. https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi

This is also relevant https://sysguides.com/fedora-uefi-secure-boot-with-custom-keys#19-9-add-microsoft-keys-to-uefi-secure-boot