Visitar URL original
No standard efivars by alfrix · Pull Request #518 · Foxboron/sbctl · GitHub
Skip to content

No standard efivars - #518

Closed
alfrix wants to merge 2 commits into
Foxboron:masterfrom
alfrix:no-standard-efivars
Closed

No standard efivars#518
alfrix wants to merge 2 commits into
Foxboron:masterfrom
alfrix:no-standard-efivars

Conversation

@alfrix

@alfrix alfrix commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Hi, on my Lenovo LOQ 15IRX10 R3CN44WW,
I had to modify sbctl to make enroll-keys work correctly with the latest firmware.

main sbctl will just say "system is not booted with UEFI"

with this patch:

Kernel says it's enabled

$ journalctl -b | grep Secure
nov 09 19:04:15 cachyos kernel: Secure boot enabled

The standard variables are missing.
the firmware exposes a SecureBootData variable:

$ efivar -l
8be4df61-93ca-11d2-aa0d-00e098032b8c-dbxDefault
8be4df61-93ca-11d2-aa0d-00e098032b8c-dbDefault
8be4df61-93ca-11d2-aa0d-00e098032b8c-KEKDefault
8be4df61-93ca-11d2-aa0d-00e098032b8c-PKDefault
3441803e-5a88-4941-82f0-858a1085276c-WIFI_MANAGER_IFR_NVDATA
07a66697-d400-4903-b3da-67a61d2b7058-Tcg2ConfigInfo
aa1305b9-01f3-4afb-920e-c9b979a852fd-SecureBootData
02eea107-98db-400e-9830-460a1542d799-IP6_CONFIG_IFR_NVDATA
4d20583a-7765-4e7a-8a67-dcde74ee3ec5-HTTP_BOOT_CONFIG_IFR_NVDATA
98ae8272-ce5a-46be-9f5d-d9f9cbbb99f2-H2OFormDialogConfig
1f2d63e1-febd-4dc7-9cc5-ba2b1cef9c5b-FeData
a1d89a3a-4a90-429d-4365-1f64c3a29614-NhltEndpointsTableConfigurationVariable
ec87d643-eba4-4bb5-a1e5-3f3e36b20da9-PciBusSetup

this causes a lot of tools to miss-report the status:

$ sudo bootctl status
System:
      Firmware: n/a (n/a)
 Firmware Arch: x64
   Secure Boot: disabled (unsupported)
  TPM2 Support: yes
  Measured UKI: no
   Measured OS: no
  Boot into FW: not supported
 Platform Lang: n/a

$ sudo mokutil --sb-state
This system doesn't support Secure Boot

but:

$ sudo tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements |     grep -i -A1 SecureBoot
    UnicodeName: SecureBoot
    VariableData: "01

after the patch sbctl:

$ sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     b459c68d-b748-4d4b-adad-46dda4534056
Setup Mode:     ⁇ Unknown
Secure Boot:    ⁇ Unknown
                (Secure Boot state cannot be determined from the available EFI variables)
Vendor Keys:    none

alfrix added 2 commits November 9, 2026 17:28
@alfrix
status: report Secure Boot state via three-state enum and detect Secu…
839bf78 
…reBootData firmware

Some UEFI firmwares expose the vendor-specific SecureBootData variable and no
standalone SetupMode/SecureBoot variable, so status reported "not booted with
UEFI" on those systems.

- Add secureBootConfigPresent: a presence-probe for SecureBootData via the
  filesystem. It is attribute-agnostic and never parses the undocumented payload
  (it does not encode the on/off state), so presence still counts even when the
  variable is unreadable.
- Accept SecureBootData presence as proof of UEFI boot so status no longer
  rejects these systems.
- Replace the bool SetupMode/SecureBoot fields with an unknown/disabled/enabled
  enum (mirroring the kernel's efi_secureboot_mode). Firmware that reports Secure
  Boot through SecureBootData exposes no readable variable, so its state is
  reported as "unknown" rather than "disabled".
- Document the new string fields for --json output.
- Add regression tests for the status path.
@alfrix
enroll-keys: handle an absent SetupMode without guessing enrollment
2a544bf 
Enrollment with an unreadable SetupMode was rejected outright, but some firmware
accepts key enrollment without a standalone SetupMode variable. Keep the gate
conservative rather than guessing:

- Exporting keys never needs Setup Mode, so still allow that through.
- An absent SetupMode is undeterminable, not disabled. Partial enrollments stay
  refused, but a full enrollment may proceed when --force is passed or the user
  confirms an interactive prompt; otherwise it is reported as ErrSetupModeMissing
  rather than ErrSetupModeDisabled.
- A genuine read error (present-but-unreadable SetupMode) still returns an error.
- Add a promptYesNo helper that stays non-blocking when stdin is not a terminal.
- Add the setup-mode-missing error message and regression tests.
@alfrix

alfrix commented Nov 9, 2026

Copy link
Copy Markdown
Author

Windows 11 confirms it too

Get-SecureBootUEFI -Name SecureBoot

Name       Bytes Attributes
----       ----- ----------
SecureBoot {1}   BOOTSERVICE ACCESS...

Get-SecureBootUEFI -Name SetupMode

Name      Bytes Attributes
----      ----- ----------
SetupMode {0}   BOOTSERVICE ACCESS...

@alfrix

alfrix commented Nov 9, 2026

Copy link
Copy Markdown
Author

For Testers, the workflow seems to be straightforward with the patch:
Enter UEFI and reset to Setup-mode
boot linux
use sbctl normally to create, enroll, sign.
reboot to UEFI and enable SecureBoot
verify via jornalctl which seems the only reliable source, or windows...

@Foxboron

Foxboron commented Nov 9, 2026

Copy link
Copy Markdown
Owner

This is just a bunch of LLM generated code. I'm not interested in this.

@Foxboron Foxboron closed this Nov 9, 2026
@alfrix

alfrix commented Nov 9, 2026

Copy link
Copy Markdown
Author

So even though i've spent hours diagnosing the issue, confirming its cause, and verifying that this works,.

The fact that I used an LLM to help me contribute to a Go project without having to learn Go first is apparently enough for you to dismiss all that work.

I still reviewed, read, cleaned up and understood the code, i verified its functionality on actual hardware., using an LLM doesn't invalidate the investigation, the testing, or the result.

dismissing the entire contribution solely because an LLM helped write some of the code is disappointing.

@alfrix alfrix mentioned this pull request Nov 10, 2026
Open
@Foxboron

Foxboron commented Nov 10, 2026

Copy link
Copy Markdown
Owner

The fact that I used an LLM to help me contribute to a Go project without having to learn Go first is apparently enough for you to dismiss all that work.

Yes. You are asking me to maintain a bunch of code and then leave LLM slop comments like "An absent SetupMode is undeterminable, not disabled".

@alfrix

alfrix commented Nov 10, 2026

Copy link
Copy Markdown
Author

Yes. You are asking me to maintain a bunch of code and then leave LLM slop comments like "An absent SetupMode is undeterminable, not disabled".

it's just missing a word:
"An absent SetupMode VARIABLE is undeterminable, not disabled"

what i think it happened here, it's that it's probably too much at once and it overwhelmed you, i get it, and i'm sorry, being in security will make anyone stressed.

what i can do, is split the work into smaller concerns if you are willing to workaround this stupid firmware that vendors are pushing on us.

@Foxboron

Foxboron commented Nov 10, 2026

Copy link
Copy Markdown
Owner

it's just missing a word:

You are missing the point. It's not a missing word, it's the LLM slop structure that does not contribute anything to the change, and you are comfortable keeping it here.

what i think it happened here, it's that it's probably too much at once and it overwhelmed you, i get it, and i'm sorry, being in security will make anyone stressed.

No, the issue here is that you are chugging a bunch of code over without making an issue and discussing a change, also without mentioning any LLM usage because you do not deem it important.

You have stated you do not know Go, which leave me with having to dicern this generated code to figure out if you are solving the correct problem (does this belong in sbctl or go-uefi?), or if you are solving it the correct way. This is with no information about the choices you have made, with bad commit messages and barely any thought going into this pull-request.

You are also introducing a breaking change without any discussion.

This tells me I'm not going to spend more time on this change and it's simple not worth my time.

@alfrix

alfrix commented Nov 10, 2026

Copy link
Copy Markdown
Author

Some fair criticism there, i apologize, i still think i have some worthwhile fixes, let this be an archive and i'll make incremental changes that you can challenge and we can discuss

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alfrix @Foxboron