rhboot / rhboot/shim

Does gnu-efi inside shim may cause incompatibility with gnu-efi used for compilation with grub when secure boot enabled?

Open
#704 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
1.1k
Forks
348
PR merge metrics
No merged PRs in 30d

Description

Hi all,
just like in the subject I have encountered strange behavior.

Namely I'm building my OS within yocto project scarthgap release with secure boot enabled. Now for that purpose I'm using meta-secure-core which has shim-15.8 and it contains gnu-efi-3.0.12 - which is really old - but in openembeded-core it is already 3.0.17.

Now, what I have encountered is this strange bug https://github.com/Wind-River/meta-secure-core/issues/79

TL:DR - grub hangs when disconnecting USB HID device e.g. keyboard (in my case the issue is more dramatic as we are using LTE modem connected with m.2 slot which is behaving like some kind of USB hub and it reconnects automatically and after couple of seconds the hang is occuring)

Now what I did to fix it was reverting back shim package to 15.2 which still supports external gnu-efi package and downgraded gnu-efi package to 3.0.14 which was used before in yocto kirkstone release and everything was working properly in it and it started to work again.

Now I know that you stopped to use external gnu-efi, but is it possible that maybe due to the difference in gnu-efi between shim and grub it may behave like that?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing shim 15.8's bundled gnu-efi 3.0.12 with the gnu-efi versions used by OpenEmbedded and the reported shim 15.2 setup. Reproduce the secure-boot GRUB hang when disconnecting and reconnecting a USB HID device, using the linked meta-secure-core issue as context. Done means determining whether the version difference causes the hang and documenting the evidence.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.