1:10 p.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
Bug ID: 1322076
Summary: uefi secure boot, update examples that are fedora
specific
Product: Fedora Documentation
Version: devel
Component: system-administrator's-guide
Severity: low
Assignee: swadeley(a)redhat.com
Reporter: bugzilla(a)colorremedies.com
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: swadeley(a)redhat.com
Super low priority. The existing examples aren't Fedora specific and are more
verbose than on a Fedora system.
https://docs.fedoraproject.org/en-US/Fedora/23/html/System_Administrators...
Fedora 23, system without secure boot:
# keyctl list %:.system_keyring
1 key in keyring:
436069891: ---lswrv 0 0 asymmetric: Fedora kernel signing key:
123842f3d8cc3f140fa50a22fc9bc014cefcf2bf
Fedora 23, system with secure boot enabled:
# keyctl list %:.system_keyring
4 keys in keyring:
57620495: ---lswrv 0 0 asymmetric: Microsoft Windows Production PCA
2011: a92902398e16c49778cd90f99e4f9ae17c55af53
17001967: ---lswrv 0 0 asymmetric: Fedora kernel signing key:
123842f3d8cc3f140fa50a22fc9bc014cefcf2bf
462910956: ---lswrv 0 0 asymmetric: Fedora Secure Boot CA:
fde32599c2d61db1bf5807335d7b20e4cd963b42
837240830: ---lswrv 0 0 asymmetric: Microsoft Corporation UEFI CA 2011:
13adbf4309bd82709c8cd54f316ed522988a1bd4
--
You are receiving this mail because:
You are the QA Contact for the bug.
1:52 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
--- Comment #1 from Stephen Wadeley <swadeley(a)redhat.com> ---
Thank you for raising this bug
--
You are receiving this mail because:
You are the QA Contact for the bug.
3:02 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
Stephen Wadeley <swadeley(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
CC| |bugzilla(a)colorremedies.com
Flags| |needinfo?(bugzilla@colorrem
| |edies.com)
--- Comment #2 from Stephen Wadeley <swadeley(a)redhat.com> ---
Hello
What do you see for:
dmesg | grep 'EFI: Loaded cert'
Thank you
--
You are receiving this mail because:
You are the QA Contact for the bug.
3:21 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
Chris Murphy <bugzilla(a)colorremedies.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(bugzilla@colorrem |
|edies.com) |
--- Comment #3 from Chris Murphy <bugzilla(a)colorremedies.com> ---
(In reply to Stephen Wadeley from comment #2)
dmesg | grep 'EFI: Loaded cert'
Returns no results.
Possibly more reliable indicator of Secure Boot state is:
[chris@f23s ~]$ journalctl -k | grep 'Secure boot'
May 12 14:02:05 f23s.localdomain kernel: Secure boot enabled
Or
[chris@f23s ~]$ mokutil --sb-state
SecureBoot enabled
Where on a non-secure boot system:
[chris@f24m ~]$ journalctl -k | grep 'Secure boot'
[chris@f24m ~]$ mokutil --sb-state
Failed to read SecureBoot
--
You are receiving this mail because:
You are the QA Contact for the bug.
3:21 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
--- Comment #4 from Stephen Wadeley <swadeley(a)redhat.com> ---
Thank you Chris for comment 3
My feeling would be to go for a command that did not require using grep.
I will try to get someone to confirm.
--
You are receiving this mail because:
You are the QA Contact for the bug.
4:03 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
Stephen Wadeley <swadeley(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |ON_QA
--- Comment #5 from Stephen Wadeley <swadeley(a)redhat.com> ---
Hello
Peter Jones confirms this is the best:
~]$ mokutil --sb-state
SecureBoot enabled
= = = =
commit d14f565da512a70f079cb0a10cfd7e1981366c23
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Mon May 23 22:57:50 2016 +0200
To confirm if Secure Boot is enabled
Bug 1322076 - uefi secure boot, update examples that are fedora specific
--
You are receiving this mail because:
You are the QA Contact for the bug.
4:20 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
--- Comment #6 from Stephen Wadeley <swadeley(a)redhat.com> ---
Re this bit:
~]# keyctl list %:.system_keyring
5 keys in keyring:
...asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c497...
...asymmetric: Fedora kernel signing key: ba8e2919f98f3f8e2e27541cde0d...
...asymmetric: Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4...
...asymmetric: Red Hat Test Certifying CA: 08a0ef5800cb02fb587c12b4032...
...asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8...
The above output shows the addition of two keys from the UEFI Secure Boot
"db" keys plus the Fedora Secure Boot CA which is embedded in the shim.efi boot
loader
the description, or explanation, is not very clear.
--
You are receiving this mail because:
You are the QA Contact for the bug.
2:43 p.m.
New subject: [Bug 1322076] uefi secure boot, update examples that are fedora
specific
https://bugzilla.redhat.com/show_bug.cgi?id=1322076
Stephen Wadeley <swadeley(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |CURRENTRELEASE
Last Closed| |2017-07-11 15:43:12
--
You are receiving this mail because:
You are the QA Contact for the bug.
2494
days inactive
2963
days old
docs-qa@lists.fedoraproject.org
7 comments
2 participants
participants (2)
-
bugzilla＠redhat.com -
Red Hat Bugzilla