Package: shim Version: 16.1-2~deb13u1 Since a new test was added to fwupdmgr with the last update, it now reports on machines with UEFI Secure Boot that the device security level is only basic (HSI-1):
$ fwupdmgr security
[...]
HSI-2
[...]
✘ UEFI memory protection: Disabled
[...]
I suspect that this is caused by the fact that the shim and grub
binaries are not built with the flag NX_COMPAT.
This can be checked with “objdump -p”:
fbx64.efi: DllCharacteristics 00000000
fwupdx64.efi: DllCharacteristics 00000540
grubx64.efi: DllCharacteristics 00000000
mmx64.efi: DllCharacteristics 00000000
shimx64.efi: DllCharacteristics 00000000
Only fwupdx64.efi has the flag:
DllCharacteristics 00000540
DYNAMIC_BASE
NX_COMPAT
NO_SEH
Regards
Stephan
signature.asc
Description: This is a digitally signed message part
