[SOLVED] QUICK HELP How to disable secureboot VM?

[shodan]

This is a classic long tail problem issue,
a solution just annoying enough to discover, that wastes just a little time once in a while
a solution that looks easy once you've figured out that it does not feel worth fixing for real



Since that is a bios nvram setting, it should be easy to just break out this rather important setting
into the VM Option screen, like this


That is really were this setting should be

 

[Impact]

Something like this (LVM-Thin example) seems to work but that requires some knowledge about storage and it's probably best to stop the VM first

virt-fw-vars --inplace /dev/pve/vm-102-disk-1 --set-false SecureBootEnable

pvesm path can tell you the path to a vdisk and also supports completion. Or try something like this with your VM's ID

pvesm path $(qm config 102 | awk -F '[ ,]' '/^efidisk0:/ {print $2}')

 

[shodan]

Yes this works

But it should still be in VM Options

DisableSecureBoot() ( command -v virt-fw-vars >/dev/null 2>&1 || DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-virt-firmware >/dev/null 2>&1 || exit 1; virt-fw-vars --inplace "$(pvesm path "$(qm config "$1" | awk '/^efidisk0:/ {sub(/^efidisk0:[[:space:]]*/,""); sub(/,.*/,""); print; exit}')")" --set-false SecureBootEnable; )

EnableSecureBoot() ( command -v virt-fw-vars >/dev/null 2>&1 || DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-virt-firmware >/dev/null 2>&1 || exit 1; virt-fw-vars --inplace "$(pvesm path "$(qm config "$1" | awk '/^efidisk0:/ {sub(/^efidisk0:[[:space:]]*/,""); sub(/,.*/,""); print; exit}')")" --set-true SecureBootEnable; )

DisableSecureBoot 109
EnableSecureBoot 109

VM has to be stopped, I tried while live and the VM no longer boots
But this should be able to work live/ setting hotswap mode

 

[Impact]

Nice. It shouldn't be necessary to install it (on PVE) though. It's a dependency of qemu-server which is a dependency of pve-manager

# aptitude why python3-virt-firmware
i   qemu-server Depends python3-virt-firmware

# aptitude why qemu-server
i   pve-manager Depends qemu-server (>= 9.1.13)

As for the actual issue/request, I'd log this as a feature request in the issue tracker: https://bugzilla.proxmox.com/

 

[shodan]

I'm on proxmox 8.4 so maybe it didn't come standard back then, if it's installed then that path will just skip.

 

[nomizfs]

Excellent, there is a way to toggle it.

It's not that i don't know how to set it in BIOS menu, it's that i hate having to go there at all, it's annoying having to resize that tiny spice screen over and over again and go look for that stupid menu entry again and again and again..

And this time i just created a VM and attached some disks to it and just forgot about the secure boot issue, so spent time finding the problem which was nvidia drivers were not signed and so would not load. Then remembering the secureboot issue and it's like 'god damn i have to reboot and get into that stupid menu thing again' it's exhausting after you've done it 50 times over the years.

Thanks @Impact and @shodan