4

The conundrum

My wife’s laptop has been running openSUSE Leap 15.0 for several years, and she has once or twice been flummoxed by this prompt at the very beginning of the boot sequence, most recently this morning:

Trust openSUSE Certificate

Do you agree to use the built-in openSUSE certificate to verify boot loaders and kernels?

This unusual behaviour has worried her, and left her uncertain how to proceed (especially as she could not use the mouse or most of the keyboard). The system appeared to boot quite normally when I selected Yes.

I should like to know why this happens, and particularly if it could be a sign of a security problem.

The system

The system (openSUSE Leap 15.0) has been in almost daily use for several years with frequent reboots without the above prompt; it has not been changed recently apart from installing updates, none of which I believe were installed since the previous boot. (I ought to get round to updating to a new version of Suse, but that is another matter!)

Sources consulted

I searched for the above prompt and found nothing that helped me much. I looked at:

  • SUSE and Secure Boot: The Details, a 2012 description of the boot process. This includes the following, which reassures me somewhat by describing a built-in key and possibility to override it, but does not explain the sporadic appearance of the prompt:

The shim then goes on to verify that the GRUB2 bootloader it wants to load is trusted. It will not use the SUSE KEK1 nor the Microsoft cert for this. In a default situation the shim will use an independent SUSE certificate embedded in its body. In addition, the shim will allow to “Enroll” additional keys, overriding the default SUSE key. Let’s call them “Machine Owner Keys” or MOKs for short.

1 Key Exchange Key “The Platform Key (PK) allows almost everything. The Key Exchange Key (KEK) allows all a PK can except changing the PK.”

2
  • Please not that 15.0 is EOL since 2019-12-03; you should upgrade to at least 15.1 (supported till 2020-11-30) or 15.2. Sep 17, 2020 at 21:10
  • @MartinSchröder: Thanks for the reminder. Oddly enough I still see updates coming, but I really must indeed do this.
    – PJTraill
    Sep 18, 2020 at 18:52

1 Answer 1

2

This is related to UEFI boot security. According to the OpenSUSE wiki, this should happen at first boot:

For the very first time of loading openSUSE 'shim', it asks the user if the openSUSE certificate built in 'shim' is trusted to verify grub2 and linux kernels.

So this should happen only once. There was a recent security bug regarding UEFI boot security that may have triggered a refresh of the shim; this might have caused the message.

4
  • 1
    Thanks, that sounds plausible; I have been meaning (in order to investigate my suspicion that my four NVIDIA packages are interfering with my BIOS battery management) to see if I can look up when packages were installed, and now have another reason to do so. If your know a command that does it, it would make a slight improvement to your already useful answer!
    – PJTraill
    Sep 18, 2020 at 19:01
  • P.S. My NVIDIA issue has nothing to do with this question: it occurs on my own laptop, not my wife’s.
    – PJTraill
    Sep 18, 2020 at 19:13
  • 1
    The screenshot in the article you referenced shows exactly what occurs, so I am sure you are on the right track.
    – PJTraill
    Sep 18, 2020 at 19:15
  • @PJTraill Try sudo less /var/log/zypp/history Sep 18, 2020 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .