could you boot an EFI+secure boot enabled livecd and post the output of "efibootmgr -v"?
shim SBAT data failed after upgraded to latest kernel.
- Thread starter chchia
- Start date
I have a Beelink mini-PC which with Proxmox 8.1 was using secure boot just fine. Trying to do a fresh install of 8.2, and I get the same message as the OP.
Update: I found a workaround. In my Beelink BIOS I had to go into the secure boot settings and manually enroll all the EFI keys contained in the boot image. I had to do that for both the bootable installer (USB stick) and the post-install Proxmox VE image.
Update: I found a workaround. In my Beelink BIOS I had to go into the secure boot settings and manually enroll all the EFI keys contained in the boot image. I had to do that for both the bootable installer (USB stick) and the post-install Proxmox VE image.
Last edited:
Did you do this with the USB in the unit? I wonder if that is what we have to do..
I do have the option to enroll custom keys but that's still an additional step we have to do in order to get secure boot support.
In my case the problem was that the shim used by the Proxmox Installer (8.2-1) was on the SBAT revocation list (you can check it with
I had the following revocations set: https://github.com/rhboot/shim/blob...0850d43d937a2b/SbatLevel_Variable.txt#L95-L98 which fix the CVEs listed above in that file.
I'm not sure which software added the shim to the revocation list, perhaps it was set when I booted the Ubuntu 24.04 live CD to perform a few ZFS operations. I can't think of anything else, Secure Boot was working fine before.
mokutil --list-sbat-revocations). Once I cleared this list (mokutil --set-sbat-policy delete) I could boot the Proxmox Installer with Secure Boot enabled.I had the following revocations set: https://github.com/rhboot/shim/blob...0850d43d937a2b/SbatLevel_Variable.txt#L95-L98 which fix the CVEs listed above in that file.
I'm not sure which software added the shim to the revocation list, perhaps it was set when I booted the Ubuntu 24.04 live CD to perform a few ZFS operations. I can't think of anything else, Secure Boot was working fine before.
the new 15.8 shim used by PVE once you've upgraded to the current version revokes the old 15.7 shim, but the 8.2 ISO still contains that version. we'll respin the ISO with an updated shim binary to avoid the issue.
Awesome!!! Thank you Fabian! Looking forward to reinstalled Proxmox for the 100th time, gives me a reason to AGAIN!!!!
Where did you run mokutil? I tried running it from proxmox itself and it didn't help. I'm facing this same issue.
I was able to run within Proxmox's CLI. I don't think we can run it once/as we get the error message. So it still means disable secure boot, install Proxmox, then do the 'fixes', and then enable secure boot:
Yeah, or wait for the ISO without the revoked shim... not a great look when I'm trying to evaluate it to replace VMware
Last edited:
Thanks for the explanation! When exactly is the revocation list updated? I installed all available updates (
apt dist-upgrade), but my revocation list only contains two entries (with older date):
Code:
root@pve:~# mokutil --list-sbat-revocations
sbat,1,2022052400
grub,2
Code:
sbat,1,2024010900
shim,4
grub,3
grub.debian,4On the Proxmox host.
When you run
mokutil --set-sbat-policy delete and start Proxmox again, is the list cleared? You can also check these instructions: https://en.opensuse.org/openSUSE:UEFI#Step_by_step_for_re-setting_SBATYeah, I missed that I need to disable secure boot before doing so, so that command didn't actually do anything. I'll have to try again when I have some more time to lab it.
It’ll be done when it’s done. This is why developers don’t tell us we are expecting an update/revamp.
A little different when you have an issue preventing your installer from booting on literally any system that has had a kernel update in the recent past... Really something they should have done before the shim was revoked.
it's currently in internal testing, once that is done it will be published
Good to hear
Release notes
22. August 2024: ship newer EFI secure boot shim on ISO
24. April 2024: Proxmox VE 8.2 ISO Installer
Note: Please always update a new ISO install to the latest available packages via GUI updater or via CLI (apt update && apt dist-upgrade), following the upgrade guide on https://pve.proxmox.com/wiki/Downloads