On two UEFI systems, one with F23 Workstation, the other with F23 Cloud Atomic, I'm finding the grubx64.efi do not have the same hash, even though rpm -q reports the same rpm installed on both. This is unexpected.
Does the atomic tree include /boot/efi/EFI/fedora? And if not, is that on the future feature list?
CVE-2015-8370 is what made me look at this. On BIOS computers, whether conventional or atomic, GRUB2 user space tools are updated with grub2-2.02-0.25.fc23, but that only updates user space tools. The user has to manually run grub2-install to actually fix the problem. On UEFI conventional installations, grubx64.efi is replaced automatically when the RPM is updated; but apparently not on UEFI atomic installations. Using grub2-install fails because grub2-efi-modules isn't installed by default, and even if it were the resulting grubx64.efi is now no longer signed by Fedora so it'll fail UEFI Secure Boot code signing checks.
On Tue, Dec 22, 2015 at 1:31 PM, Chris Murphy lists@colorremedies.com wrote:
On two UEFI systems, one with F23 Workstation, the other with F23 Cloud Atomic, I'm finding the grubx64.efi do not have the same hash, even though rpm -q reports the same rpm installed on both. This is unexpected.
I've found the sha256sum for /boot/efi/EFI/fedora/grubx64.efi on a system with atomic tree version 23.38 matches that of the grux64.efi in grub2-efi-2.02-0.23.fc23.x86_64.rpm, despite the fact rpm -q reports grub2-efi-2.02-0.25.fc23.x86_64 is installed. So the grub2-efi package is disconnected with the actual efi binary installed.
UEFI bootloader is not updated by rpm-ostree, even though rpm package version suggests otherwise https://bugzilla.redhat.com/show_bug.cgi?id=1293725