sbctl sign-all does not sign all efi binaries

[hboetes]

Hi there,

the sbctl sign-all command does not sign all files as I would expect. As a workaround, I added the following function to my shellrc:

efisign () {
	for i in $(sbctl verify | awk '/\/efi\// {print $2}')
	do
		sbctl sign $i
	done
}

root@fedora:~# sbctl verify
Verifying file database and EFI images in /efi...
✓ /efi/2afb3b8938a147c883226360efa9ca5e/0-rescue/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.5-301.fc40.x86_64/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.7-300.fc40.x86_64/linux is signed
✓ /efi/EFI/BOOT/BOOTIA32.EFI is signed
✓ /efi/EFI/BOOT/BOOTX64.EFI is signed
✓ /efi/EFI/BOOT/fbia32.efi is signed
✓ /efi/EFI/BOOT/fbx64.efi is signed
✓ /efi/EFI/fedora/gcdia32.efi is signed
✓ /efi/EFI/fedora/gcdx64.efi is signed
✓ /efi/EFI/fedora/mmia32.efi is signed
✓ /efi/EFI/fedora/mmx64.efi is signed
✓ /efi/EFI/fedora/shim.efi is signed
✓ /efi/EFI/fedora/shimia32.efi is signed
✓ /efi/EFI/fedora/shimx64.efi is signed
✓ /efi/EFI/systemd/systemd-bootx64.efi is signed
root@fedora:~# bootctl install
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/BOOT/BOOTX64.EFI".
Random seed file /efi/loader/random-seed successfully refreshed (32 bytes).
Created EFI boot entry "Linux Boot Manager".
root@fedora:~# sbctl verify
Verifying file database and EFI images in /efi...
✓ /efi/2afb3b8938a147c883226360efa9ca5e/0-rescue/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.5-301.fc40.x86_64/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.7-300.fc40.x86_64/linux is signed
✓ /efi/EFI/BOOT/BOOTIA32.EFI is signed
✗ /efi/EFI/BOOT/BOOTX64.EFI is not signed
✓ /efi/EFI/BOOT/fbia32.efi is signed
✓ /efi/EFI/BOOT/fbx64.efi is signed
✓ /efi/EFI/fedora/gcdia32.efi is signed
✓ /efi/EFI/fedora/gcdx64.efi is signed
✓ /efi/EFI/fedora/mmia32.efi is signed
✓ /efi/EFI/fedora/mmx64.efi is signed
✓ /efi/EFI/fedora/shim.efi is signed
✓ /efi/EFI/fedora/shimia32.efi is signed
✓ /efi/EFI/fedora/shimx64.efi is signed
✗ /efi/EFI/systemd/systemd-bootx64.efi is not signed
root@fedora:~# sbctl sign-all
root@fedora:~# sbctl verify
Verifying file database and EFI images in /efi...
✓ /efi/2afb3b8938a147c883226360efa9ca5e/0-rescue/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.5-301.fc40.x86_64/linux is signed
✓ /efi/2afb3b8938a147c883226360efa9ca5e/6.8.7-300.fc40.x86_64/linux is signed
✓ /efi/EFI/BOOT/BOOTIA32.EFI is signed
✗ /efi/EFI/BOOT/BOOTX64.EFI is not signed
✓ /efi/EFI/BOOT/fbia32.efi is signed
✓ /efi/EFI/BOOT/fbx64.efi is signed
✓ /efi/EFI/fedora/gcdia32.efi is signed
✓ /efi/EFI/fedora/gcdx64.efi is signed
✓ /efi/EFI/fedora/mmia32.efi is signed
✓ /efi/EFI/fedora/mmx64.efi is signed
✓ /efi/EFI/fedora/shim.efi is signed
✓ /efi/EFI/fedora/shimia32.efi is signed
✓ /efi/EFI/fedora/shimx64.efi is signed
✗ /efi/EFI/systemd/systemd-bootx64.efi is not signed
root@fedora:~# efisign 
✓ Signed /efi/2afb3b8938a147c883226360efa9ca5e/0-rescue/linux
✓ Signed /efi/2afb3b8938a147c883226360efa9ca5e/6.8.5-301.fc40.x86_64/linux
✓ Signed /efi/2afb3b8938a147c883226360efa9ca5e/6.8.7-300.fc40.x86_64/linux
✓ Signed /efi/EFI/BOOT/BOOTIA32.EFI
✓ Signed /efi/EFI/BOOT/BOOTX64.EFI
✓ Signed /efi/EFI/BOOT/fbia32.efi
✓ Signed /efi/EFI/BOOT/fbx64.efi
✓ Signed /efi/EFI/fedora/gcdia32.efi
✓ Signed /efi/EFI/fedora/gcdx64.efi
✓ Signed /efi/EFI/fedora/mmia32.efi
✓ Signed /efi/EFI/fedora/mmx64.efi
✓ Signed /efi/EFI/fedora/shim.efi
✓ Signed /efi/EFI/fedora/shimia32.efi
✓ Signed /efi/EFI/fedora/shimx64.efi
✓ Signed /efi/EFI/systemd/systemd-bootx64.efi

[Foxboron]

Please describe what you are expecting sbctl sign-all to do in these cases. From what I can tell you haven't told sbctl to sign the given file with sbctl sign -s.

[hboetes]

I would expect sbctl sign-all to sign all enrolled EFI binaries, as it is documented:

       sign-all
           Signs all enrolled EFI binaries.

[Foxboron]

sign-all isn't printing any files, so there isn't any enrolled files.

[hboetes]

Hmm confusing, OK, let's then make this a feature request. Wouldn't it be nice if there was an sbctl option that signs all files that need signing, just like my efisign function?

[Foxboron]

There is no way for us to know nor infer that.

If the system follows BLS then we can figure out the current bootchain, and maybe inspect the efivariables for other boot loaders. But that is probably not going to cover all of it, and it won't be possible on arbitrary bootloaders.