Recent searches
Search options
In the adventures of Bob's "Perfect" #Slackware install, I've been struggling to get Secure Boot working on my #Thinkpad x280.
Something seems to be preventing me from loading a custom Platform Key, while none appears loaded, and everything seems 'right' -- #SecureBoot is in Custom / Setup mode.
The unfortunate thing is ... using Secure Boot and signing kernel images and efi executables is not a common practice, and the documentation seems lacking explanations for people with my particular issue; method 1 of using `efi-updatevar` returns an error "Cannot write to PK, wrong filesystem permissions", method 2 -- updating from the #UEFI 'bios' -- is not an option on an x280, and method 3, using KeyTool.efi returns the error "Failed to update variable: (26) Security Violation".
I am wondering if there are some further setup settings that need to be adjusted to allow this operation, if perhaps my pk.auth file is incorrect in some way, if my machine was, from the factory, unable to allow custom Platform Keys, or if someone has modified it since then.
Rabbit holes are a pain in the dick, and now I'm in a position where I'm kinda 'forced' to learn a bit more about the mechanics of Secure Boot, under the hood.
Anyone got some good tips for where to start solving this puzzle?
I have been referencing:
- https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot_under_OpenRC
- https://wiki.linuxquestions.org/wiki/How_to_use_Secure_Boot_with_your_own_keys
@bobdobberson perhaps you'll find some inspiration from a #liveslak article:
https://alien.slackbook.org/blog/liveslak-1-8-2-re-adds-secure-boot-support/
- and the corresponding commits:
https://git.liveslak.org/liveslak/commit/?id=82d7bc751900909bcf1ea6d71ae3737454fef9d2
https://git.liveslak.org/liveslak/commit/?id=f5a3e197512428a14925376345215fcc79f73c8b
You may be missing a step on your #Slackware computer.
@alien from the first article, I think one of the tricks for grub 2.12 might be adding a custom line to the grub.cfg that disables the checking of the kernel with GPG -- in my setup, the only thing that is unencrypted at rest is the grubx64.efi binary, that I plan to sign for SB, and not require any particular signing for a kernel.
This is going to drive me nuts, as I came across that grub config option in one of the random sources I've been looking at; since I hadn't made it that far yet, I didn't think to add a note yet, and it might be that that is only required for 2.12, and I'm still using 2.06.
Let me know if the grub.cfg edit is news to you, and I'll dig it up.
@alien lol, nevermind, the first commit is the thing I was referencing.