How actually should developer set sbat policy on RHEL8?
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
I've been looking through secure boot process on el8 and found out that the current shim version shipped with el8 (15.6) is using SBAT_PREVIOUS policy by default. Thus, SbatLevel variable is not updated and system still stays vulnerable.
- As I see, at other distros. like SUSE, there is an ability to update sbat policy using mokutil, but on el8 mokutil is too old and doesn't support sbat variable update. How should I change sbat policy then?
- Why is sbat policy set to SBAT_PREVIOUS by default? It doesn't make much sense to me. I though that SBAT_PREVIOUS should exist as a backup option in case there is some issues with latest one, but instead it appears to be the main one.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the RHEL8-shipped shim 15.6 behavior and mokutil's handling of the SbatLevel variable, with particular attention to the SBAT_PREVIOUS default. Done would mean establishing whether the behavior is incorrect and documenting or implementing a clear RHEL8-compatible policy update path, along with the reason for the default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100