update-secureboot-policy: fails to trigger mok loading

[Andy Whitcroft]

In both eoan and bionic I have had cases where I add a new dkms package and dkms triggers update-secureboot-policy to try and enroll a key for me. When it does this I reboot and nothing is prompted and the key is not enrolled.

Tracking this through update-secureboot-policy is calling mokutil as below:

  enroll_mok()
  {
[...]
    echo "Adding '$SB_KEY' to shim:"
    printf '%s\n%s\n' "$key" "$again" | mokutil --timeout -1 --import "$SB_KEY" >/dev/null || true
  }

If I try this at the command line this is reported as invalid, dispite listing both options as valid:

 # printf "%s\n%s\n" '12345678' '12345678' | mokutil --timeout 1 --import MOK.der
 Usage:
  mokutil OPTIONS [ARGS...]

 Options:
[...]
  --import <der file...> Import keys
[...]
  --timeout <-1,0..0x7fff> Set the timeout for MOK prompt
[...]

Dropping --timeout allows the command to complete:

 # printf "%s\n%s\n" '12345678' '12345678' | mokutil --import MOK.der
 input password:
 input password again:

And on reboot I am prompted and the key is enrolled.

[Andy Whitcroft (apw)]

Oh and this is simply because --timeout and --import are essentially mutually exclusive. When you specify both the command is IMPORT|TIMEOUT and so not recognised.

[Andy Whitcroft (apw)]

So either we should invoke twice against mokutil or mokutil should accept these together.

[Dimitri John Ledkov (xnox)]

So ubiquity does it right:

printf '%s\n%s\n' "$RET" "$RET" | mokutil --import /var/lib/shim-signed/mok/MOK.der >/dev/null || true
mokutil --timeout -1 >/dev/null || true

I.e. do it as two actions.

[Steve Langasek (vorlon)]

Duplicate of LP: #1869187.