canonical / canonical/secboot

efi/preinstall, efi: ensure WithBootManagerCodeProfile handles the installer being launched from the firmware settings UI

Open
#342 1 comment 0 reactions 0 assignees View on GitHub
preinstall-checks
Dominant language
Go
Stars
23
Forks
29
Avg merge
2d 8h
Merged PRs (30d)
2

Description

If the installer is launched from the firmware settings UI, PCR4 contains the corresponding load events in the pre-OS environment. Because we just assume that these are system preparation applications, they get copied to the initial profile during install. This causes the subsequent post-install boot to fail to unlock because the firmware settings UI isn't loaded and its events are thus not measured.

We should exclude pre-OS load events that don't match to a corresponding `SysPrepXXXX` variable, and which aren't related to Absolute, as some devices correctly load and measure Absolute as part of the pre-OS environment - Dell devices get this wrong by loading and measuring it as part of the OS-present environment, for which we already have a workaround.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.