search for: shim

This is a quick recovery and fix for the machines rendered unbootable after the grub2/shim yum update. It is written for CentOS 8.2.2004 but similar should work for any CentOS 8 or 7 as long as you get the correct shim file, that is, the one from the latest installation media. I am running on an x86_64 architecture (see uname -i). Please use the correct shim file for your architectur...

><snip> > > I'll post here again once we have pushed the EL8 and CentOS Stream updates. > >OK .. I have also now pushed the CentOS Linux 8 update .. you should see >an update to SHIM .. the new versions are: > >PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm >BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm >BaseOS/x86_64/os/Packages/shim-x64-15-15.el8_2.x86_64.rpm > >For CentOS Linux 7 .. the new files are: > >x86_64/Packag...

...; > >> <snip> > > > > > > > >> > I'll post here again once we have pushed the EL8 and CentOS Stream > >> updates. > >> > >> OK .. I have also now pushed the CentOS Linux 8 update .. you should see > >> an update to SHIM .. the new versions are: > >> > >> PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm > >> BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm > >> BaseOS/x86_64/os/Packages/shim-x64-15-15.el8_2.x86_64.rpm > >> > >> For C...

...> >> >> > I'll post here again once we have pushed the EL8 and CentOS Stream > >> >> updates. > >> >> > >> >> OK .. I have also now pushed the CentOS Linux 8 update .. you > >> should see > >> >> an update to SHIM .. the new versions are: > >> >> > >> >> PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm > >> >> BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm > >> >> BaseOS/x86_64/os/Packages/shim-x64-15-15.el8_2.x86_64.r...

...om: Alan McRae via CentOS <centos at centos.org> Date: Sat, Aug 1, 2020, 19:22 Subject: [CentOS] 8.2.2004 Quick recovery and fix for unbootable machines To: CentOS mailing list <centos at centos.org> This is a quick recovery and fix for the machines rendered unbootable after the grub2/shim yum update. It is written for CentOS 8.2.2004 but similar should work for any CentOS 8 or 7 as long as you get the correct shim file, that is, the one from the latest installation media. I am running on an x86_64 architecture (see uname -i). Please use the correct shim file for your architecture...

...system simply fails to >>> boot.? I don't even get a grub screen. I'll have to rebuild the >>> systems from scratch. >>> >>> >> >> You should be able to boot off of installation media into rescue mode, >> and downgrade the grub2* and/or shim* RPMs. >> >> -Greg >> > I did the downgrade on a fresh install of c8.2 but yum said that all > selected packages (grub2,shim...) are already to the lowest version and > the downgrade is not possibile, ending with "nothing to do". Ok .. We are running through so...

...om: Alan McRae via CentOS <centos at centos.org> Date: Sat, Aug 1, 2020, 19:22 Subject: [CentOS] 8.2.2004 Quick recovery and fix for unbootable machines To: CentOS mailing list <centos at centos.org> This is a quick recovery and fix for the machines rendered unbootable after the grub2/shim yum update. It is written for CentOS 8.2.2004 but similar should work for any CentOS 8 or 7 as long as you get the correct shim file, that is, the one from the latest installation media. I am running on an x86_64 architecture (see uname -i). Please use the correct shim file for your architecture...

...; >> > >> > >> >> > I'll post here again once we have pushed the EL8 and CentOS Stream >> >> updates. >> >> >> >> OK .. I have also now pushed the CentOS Linux 8 update .. you >> should see >> >> an update to SHIM .. the new versions are: >> >> >> >> PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm >> >> BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm >> >> BaseOS/x86_64/os/Packages/shim-x64-15-15.el8_2.x86_64.rpm >> >>...

...'ll post here again once we have pushed the EL8 and CentOS >> Stream >> >> >> updates. >> >> >> >> >> >> OK .. I have also now pushed the CentOS Linux 8 update .. you >> >> should see >> >> >> an update to SHIM .. the new versions are: >> >> >> >> >> >> PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm >> >> >> BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm >> >> >> BaseOS/x86_64/os/Packages/shim-x64-15-1...

...39;t even get a grub screen. I'll have to rebuild the >>>>> systems from scratch. >>>>> >>>>> >>>> >>>> You should be able to boot off of installation media into rescue mode, >>>> and downgrade the grub2* and/or shim* RPMs. >>>> >>>> -Greg >>>> >>> I did the downgrade on a fresh install of c8.2 but yum said that all >>> selected packages (grub2,shim...) are already to the lowest version and >>> the downgrade is not possibile, ending with "not...

On 8/2/20 8:04 AM, david wrote: > >> <snip> > > > >> > I'll post here again once we have pushed the EL8 and CentOS Stream >> updates. >> >> OK .. I have also now pushed the CentOS Linux 8 update .. you should see >> an update to SHIM .. the new versions are: >> >> PowerTools/x86_64/os/Packages/shim-unsigned-x64-15-8.el8.x86_64.rpm >> BaseOS/x86_64/os/Packages/shim-ia32-15-15.el8_2.x86_64.rpm >> BaseOS/x86_64/os/Packages/shim-x64-15-15.el8_2.x86_64.rpm >> >> For CentOS Linux 7 .. the new files...

...up, covering all arches (so basically x86_64, i386, ppc64le, ppc64, aarch64 and armhfp those days), we wanted also to add redundancy where it was possible to. The interesting "SecureBoot" corner case came on the table and we had to find a different way to build the following packages: - shim (both signed and unsigned) - grub2 - fwupdate - kernel The other reason why we considered rebuilding it is that the cert we were using has expired : curl --location --silent https://github.com/CentOS/sig-core-SecureBoot/raw/master/CentOS_7/kernel/SOURCES/centos.cer | openssl x509 -inform der -...

Hi, On Thu, Oct 19, 2017 at 09:43:41AM +1100, Damien Miller wrote: > You've got this exactly backwards. We don't want a shim that allows > OpenSSL-1.1 to present a OpenSSL-1.0 API. We want a shim that allows > us to use the OpenSSL-1.1 API when using OpenSSL-1.0, so we don't have > to maintain a forest of #ifdefs. For obvious reasons this shim cannot exist. If the structure member is not visible anymore (a...

Once upon a time, Johnny Hughes <johnny at centos.org> said: > The issues should now be resolved. > > If you just mount /mnt/sysimage, set an ip address and upgrade (to get > th new shim) .. then: > > yum reinstall <latest-version> I'm curious - why does the kernel need to be reinstalled? The shim-x64 package installs its files directly to the EFI partition where they are needed. -- Chris Adams <linux at cmadams.net>

...v() to change LD_LIBRARY_PATH dynamically, since (for security reasons) ld.so uses only a value of the environment variable cached prior to main(). Instead, we can fix the problem by relying on the fact that Linux provides dlmopen(), which opens a shared library in a new namespace. We first load a shim library into this namespace which overrides the dlopen() present in the main executable, then load the VDDK library. All further dlopen() calls made during VDDK initialization now go through our shim, at which point we can rewrite them to be absolute calls before the real dlopen() kicks in. Note t...

...>>> boot.? I don't even get a grub screen. I'll have to rebuild the >>>> systems from scratch. >>>> >>>> >>> >>> You should be able to boot off of installation media into rescue mode, >>> and downgrade the grub2* and/or shim* RPMs. >>> >>> -Greg >>> >> I did the downgrade on a fresh install of c8.2 but yum said that all >> selected packages (grub2,shim...) are already to the lowest version and >> the downgrade is not possibile, ending with "nothing to do". > &g...

...d=15522 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 0ae55996308b507ba878377b35b71225c1fa28d4fb453c938a0d5dc9568501cc mokutil-15-2.el7.centos.x86_64.rpm 4e5cac6435cf60cd50610751e8dedc1df42d5b127a6aac033028d3dd049f01f6 shim-ia32-15-2.el7.centos.x86_64.rpm c8ba12bfa3c2cf5626e901e636536acba5c597a10d1081c0d5f780828c1a8a1d shim-unsigned-ia32-15-2.el7.centos.x86_64.rpm affdaf712818dfdaa17ebbad94f08361bb318baf0db038c0131a10a4b2fa40c7 shim-unsigned-x64-15-2.el7.centos.x86_64.rpm 8a8a958be8c80e53553199058f7612841e98f10bb1af...

...tOS Stream and the Boot Hole vulnerability (Brian Stinson) 2. [Correction/Additions] CentOS Linux, CentOS Stream and the Boot Hole vulnerability (Brian Stinson) 3. CESA-2020:3220 Important CentOS 7 kernel Security Update (Johnny Hughes) 4. CESA-2020:3217 Moderate CentOS 7 shim Security Update (Johnny Hughes) 5. CESA-2018:3140 Moderate CentOS 7 fwupdate Security Update (Johnny Hughes) 6. CESA-2020:3217 Moderate CentOS 7 shim-signed Security Update (Johnny Hughes) 7. CESA-2020:3217 Moderate CentOS 7 grub2 Security Update (Johnny Hughes) -...

...#39;t checked the details, and maybe the PR and the fedora patch are a bit different). ?The problems that were signaled during the september/november 2016 discussion and the recent one are: * it breaks LibreSSL builds * the changes are only relevant to openssh-portable * it involves maintaining a shim which might be buggy * openssl 1.0.2 is LTS and support is longer than for openssl 1.1.0 * a few major distributions (including some older RHEL versions) are stuck with even older releases ?* changes in openssl 1.1 are not a sufficient motive to do the job anyway? * this is quite a large change (th...

...eleasing new packages for CentOS Linux 7, CentOS Linux 8 and CentOS Stream in response. These should make it out to a mirror near you shortly. /!\ Secureboot Systems - Please do a full update /!\ CentOS Linux 8 and CentOS Stream systems with secureboot enabled MUST update the kernel, grub2, and shim packages together. As part of this CVE, we have re-issued the kernel and shim signing certificate authorities, and previously released EL8 kernels cannot boot in secureboot mode with the newer shim/grub2. The following packages boot together in secureboot mode on CentOS Stream: * kernel-4...