Added mokutil check to detect SecureBoot status before installing #5879
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zenmonkeykstop
requested review from
conorsch,
emkll and
kushaldas
as code owners
|
As I mentioned in yesterday's standup, I don't have access to the prod hardware right now, so I will not be able to review this PR. |
On Ubuntu Focal installed from ISO, the "mokutil" package wasn't installed by default. Let's add it early in the prepare-servers role, so we can use it to check for SecureBoot status before proceeding with installation.
conorsch
approved these changes
Mar 30, 2021
There was a problem hiding this comment.
I haven't tested on prod server hardware, but I did test on Focal Qubes HVMs. Added a commit to make sure that mokutil is present. As you say, the check passes when it's not (which is appropriate), but it seems reasonable to install the tool in order to verify the system state.
Inside Qubes HVMs, I see EFI variables are not supported on this system, which still passes the check.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review
Description of Changes
Fixes #5871.
Adds a raw command check in the
prepare_serversansible role, to see if SecureBoot is enabled. If it is, the install exits early with an informative error. The check runsmokutil --sb-state, and fails iff the output includesSecureBoot enabled:mokutilwill error out ifnoefiis set in kernel boot args (as it is for the current grsec kernel) - this is ignored and the check passesSecureBoot disabled, it obviously passes :)Testing
On prod hardware,
./securedrop-admin --force installentering the server password when promptedinstallcommandtailsconfig, runssh mon sudo apt remove mokutilto remove the utility from the mon server../securedrop-admin --force installagainEFI variables are not supportedmessagemokutil: not foundDeployment
Deployed when workstation is updated. No implications for older systems IMO
Checklist
If you made non-trivial code changes:
Choose one of the following: