PXE boot shows SBAT self-check failed: Security Policy Violation
This bug report will be marked for expiration in 48 days if no further activity occurs. (find out why)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MAAS |
Incomplete
|
Undecided
|
Unassigned |
Bug Description
Hello,
I'm getting "SBAT self-check failed: Security Policy Violation" on all my MAAS PXE CLients.
Here is the version of Maas i'm using.
# apt list maas
Listing... Done
maas/jammy 1:3.3.7-
To reproduce, under Images, I did an update selection on 22.04 LTS and checked the amd64. I saw it got sync(1.2 GB Synced) and then Rack got updated and was also showing as synced.
But I noticed that MAAS created two amd64 bootx64.efi files with different chksum.
# ls -ld /var/lib/
-rw-r--r-- 2 maas maas 960472 Jul 3 11:54 /var/lib/
-rw-r--r-- 1 maas maas 955656 Jul 3 11:57 /var/lib/
# cksum /var/lib/
2344477150 955656 /var/lib/
74947783 960472 /var/lib/
#
At this point, PXE client is unable to boot and will get powered off automatically.
The error in the console is showing as "SBAT self-check failed: Security Policy Violation"
I tried disabling the secure boot under the Client BIOS config but didn't make any difference.
Then I tried to manually remove the bootx64.efi from snapshot-
# cd /var/lib/
# mv bootx64.efi /home/corpunix/
# ls -lt bootx64.efi
lrwxrwxrwx 1 root root 33 Jul 3 13:00 bootx64.efi -> bootloader/
*******
Then the PXE boot started working
*******
Question: Any reason why would MAAS create two amd64 bootx64.efi files with different cksum and what is the best way to have this fix going forward without any manual intervention.
any takers for this issue? maas/boot- resources get a refresh?
And what are the criteria, when and how the /var/lib/