Public bug reported: I can reproduce a boot failure caused by shim 15.8 when the Secure Boot dbx variable is large.
System information: - Distribution: Linux Mint 22.2, based on Ubuntu 24.04 Noble - Motherboard: MSI Z270 GAMING M3 (MS-7A62) - CPU: Intel Core i7-7700 - Firmware vendor: American Megatrends Inc. - Firmware version: 1.00 - Firmware date: 2016-11-30 - TPM: Intel PTT / TPM 2.0 enabled - Secure Boot: enabled - Dual boot: Windows 11 Pro and Linux Mint 22.2 Package version: shim-signed: Installed: 1.58+15.8-0ubuntu1 Candidate: 1.58+15.8-0ubuntu1 Repository: Ubuntu Noble main The firmware Forbidden Signatures / dbx variable grew to approximately: - Size: 18036 bytes - Entries: 374 - Source: Mixed On the following Linux boot, shim failed before GRUB was displayed with: Could not create MokListRT: Volume Full Could not create MokListXRT: Volume Full Could not create SbatLevelRT: Volume Full Could not create MokListTrustedRT: Volume Full Something has gone seriously wrong: import_mok_state() failed: Volume Full Expected result: shim should display a warning when the TPM event log is full and continue booting, because the TPM extend operation has already occurred. Actual result: shim treats EFI_VOLUME_FULL as fatal and prevents Linux from booting. Workaround: Deleting only the dbx / Forbidden Signatures variable in the UEFI setup allows Linux to boot immediately again. Secure Boot remains enabled, the enrolled MOK remains present, and signed NVIDIA and VirtualBox kernel modules load normally. Re-enrolling the large dbx causes the failure to return. The behavior matches this upstream issue: https://github.com/rhboot/shim/issues/654 The upstream fix appears to be: https://github.com/rhboot/shim/pull/657 The fix changes EFI_VOLUME_FULL handling so that a full TPM event log produces a warning instead of aborting the boot process. Ubuntu Noble still provides: shim-signed 1.58+15.8-0ubuntu1 Please consider backporting the upstream EFI_VOLUME_FULL handling fix to Ubuntu 24.04 Noble's shim/shim-signed packages. A temporary workaround on this machine is: - Secure Boot enabled - TPM 2.0 enabled - dbx cleared - Windows Secure-Boot-Update scheduled task disabled I understand that clearing dbx reduces Secure Boot revocation protection and is not an appropriate permanent solution. ** Affects: shim-signed (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161200 Title: shim 15.8 on Ubuntu Noble fails to boot with EFI_VOLUME_FULL when dbx is large To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/2161200/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
