/boot/EFI/memtest86/memtest.efi is not signed

Kreyren commented

2023-12-27 06:00:12 +00:00

(Migrated from github.com)

Is there a way to make it sign memtest set through boot.loader.systemd-boot.memtest86.enable ?

![image](https://github.com/nix-community/lanzaboote/assets/11302521/47aea3ed-4ac9-4cba-a040-9e507dabe8a9) Is there a way to make it sign memtest set through `boot.loader.systemd-boot.memtest86.enable` ?

👍 6

nikstur commented

2023-12-27 07:37:57 +00:00

(Migrated from github.com)

We would need to implement this in Lanzaboote. There currently is no out of the box way to do it.

Kreyren commented

2023-12-27 16:18:19 +00:00

(Migrated from github.com)

We would need to implement this in Lanzaboote. There currently is no out of the box way to do it. -- @nikstur (https://github.com/nix-community/lanzaboote/issues/273#issuecomment-1870033281)

f707a9be9f/rust/tool/systemd/src/install.rs (L377)

# Blind code, untested, meant to show the intention only
if let Some(specialisation_name) = &generation.specialisation_name {
    Ok(PathBuf::from(format!(
        "nixos-generation-{}-specialisation-{}-{}.efi",
        generation, specialisation_name, stub_input_hash
    )))
+ } else if let Some(specialisation_name) = "memtest.efi" {
+     Ok(PathBuf::from("memtest.efi"))
} else {
    Ok(PathBuf::from(format!(
        "nixos-generation-{}-{}.efi",
        generation, stub_input_hash
    )))
}

Is it this easy or does it need additional changes somewhere else? Would probably be better to add some kind of management in nix to make nixos configuration more manageable as not everyone might want to sign the memtest

> We would need to implement this in Lanzaboote. There currently is no out of the box way to do it. -- @nikstur (https://github.com/nix-community/lanzaboote/issues/273#issuecomment-1870033281) https://github.com/nix-community/lanzaboote/blob/f707a9be9f061c86a3e5cc163603dd59b5ee07aa/rust/tool/systemd/src/install.rs#L377 ```diff # Blind code, untested, meant to show the intention only if let Some(specialisation_name) = &generation.specialisation_name { Ok(PathBuf::from(format!( "nixos-generation-{}-specialisation-{}-{}.efi", generation, specialisation_name, stub_input_hash ))) + } else if let Some(specialisation_name) = "memtest.efi" { + Ok(PathBuf::from("memtest.efi")) } else { Ok(PathBuf::from(format!( "nixos-generation-{}-{}.efi", generation, stub_input_hash ))) } ``` Is it this easy or does it need additional changes somewhere else? Would probably be better to add some kind of management in nix to make nixos configuration more manageable as not everyone might want to sign the memtest

RaitoBezarius commented

2023-12-27 22:03:53 +00:00

(Migrated from github.com)

It would require more than that.

kuflierl commented

2024-07-31 13:58:00 +00:00

(Migrated from github.com)

@Kreyren wouldn't your change sign any binary names memtest.efi without checking its contents? Wouldn't that potentially also sign a malicious binary if it was replaced prior?

MithicSpirit commented

2024-07-31 15:15:39 +00:00

(Migrated from github.com)

Yeah, maybe it should compare the file's checksum with that from the nix store, or maybe even use a hardcoded checksum.

👍 1

Rows
Columns

/boot/EFI/memtest86/memtest.efi is not signed #273