Easier way of unrolling keys
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Description
After a bootloader certificate is enrolled into shim, it always proceeds to load the chained bootloader, and the user has no opportunity to remove the enrolled key using shim menu. Exiting the bootloader exits directly to UEFI, not shim. Authenticated variables used by MokManager seem to persist through disabling / re-enabling Secure Boot on real hardware.
It would be great if the user had an opportunity to reach shim menu unconditionally. E.g., if the chained bootloader would return to shim (no idea if that's possible with UEFI API), or if shim waited a couple of seconds before loading the chained image, with the user having an opportunity to intervene.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review shim's chained-bootloader flow, shim menu, MokManager, and authenticated variables under Secure Boot. Investigate whether the UEFI API can return from the chained image to shim or support an intervention delay. Done means giving users an unconditional opportunity to reach shim menu and remove an enrolled key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100