I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following;

I have a Lenovo Thinkpad that has secure-boot and bitlocker enabled. When turning on, I can press F12 to enter a boot-menu to boot Ubuntu from a bootable USB stick.

Old situation

In the past, this would always automatically add an 'Ubuntu' entry on the top of my boot menu that would in turn cause Bitlocker to complain the system had been changed (I assume the TPM detected the additional entry as a UEFI config modfication). The solution to prevent the TPM from detecting the change was to simply remove the 'Ubuntu' entry again after each boot using efibootmgr;

#this script is added to crontab, to remove our own entry on @reboot,
/bin/efibootmgr | /usr/bin/awk '/ubuntu$/ {sub("^Boot", "", $1); sub("*$", "", $1); print "Removing EFI entry: " $0; system("echo Command:efibootmgr -b " $1 " -B"); system("/bin/efibootmgr -b " $1 " -B")}'

New situation

However, since an upgrade of Ubuntu, that included the secure-boot stub, and a firmware upgrade of lenovo, the TPM/Bitlocker seems to be fine with having Ubuntu from USB set itself as the primary boot option when the USB is inserted on power-on, and Windows still boots without a hitch when the USB is not present.

This behavior seems curious to me, as the TPM did not seem to allow this before, which seemed logical to me from a security perspective. But now it does, and thus essentially allows the default boot order to be changed without requiring the bitlocker-key to be re-entered.

Can anyone explain this behavior, and say if this indicates a bug/config issue or works as intended? Doesn't this behavior affect the secure-boot integrity?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.