From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 767C91FF15E for ; Wed, 21 Jan 2026 16:45:23 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 2B2023670; Wed, 21 Jan 2026 16:45:38 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Wed, 21 Jan 2026 16:44:34 +0100 Message-ID: <20260121154453.285642-2-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260121154453.285642-1-f.ebner@proxmox.com> References: <20260121154453.285642-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1769010246608 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.016 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [qm.pm, qemuserver.pm] Subject: [pve-devel] [PATCH qemu-server v3 1/3] vm start: check efi: always check for certificates when pre-enrolled-keys=1 X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Standard Linux distributions use a shim signed by the Microsoft KEK, so secure boot update requires the new certificates too. Also update the notice to mention this and improve it further. While the checks for Windows could be limited to 10 and 11, if there is an EFI disk with pre-enrolled keys, it could still be that some specialized application actually uses them or simply that the OS type was misconfigured, so do not special case that. While skipping enrollment of the Windows CA could be skipped for Linux with only the MS CA being enrolled, it doesn't hurt to do so and just makes it consistent with what newly created EFI disk have. Suggested-by: Thomas Lamprecht Signed-off-by: Fiona Ebner --- New in v3. src/PVE/CLI/qm.pm | 6 ------ src/PVE/QemuServer.pm | 12 ++++++------ 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm index bdae9641..5326db5f 100755 --- a/src/PVE/CLI/qm.pm +++ b/src/PVE/CLI/qm.pm @@ -721,12 +721,6 @@ __PACKAGE__->register_method({ die "VM $vmid is a template\n" if PVE::QemuConfig->is_template($conf); die "VM $vmid has no EFI disk configured\n" if !$conf->{efidisk0}; - my $ostype = $conf->{ostype}; - if (!defined($ostype) || ($ostype ne 'win10' && $ostype ne 'win11')) { - print "skipping - OS type is neither Windows 10 nor Windows 11\n"; - return; - } - my $storecfg = PVE::Storage::config(); my $efidisk = parse_drive('efidisk0', $conf->{efidisk0}); diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm index fc735aa3..7e3bf2f2 100644 --- a/src/PVE/QemuServer.pm +++ b/src/PVE/QemuServer.pm @@ -5405,16 +5405,16 @@ my sub check_efi_vars { return if PVE::QemuConfig->is_template($conf); return if !$conf->{efidisk0}; - return if !$conf->{ostype}; - return if $conf->{ostype} ne 'win10' && $conf->{ostype} ne 'win11'; my $efidisk = parse_drive('efidisk0', $conf->{efidisk0}); if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($efidisk)) { # TODO: make the first print a log_warn with PVE 9.2 to make it more noticeable! - print "EFI disk without 'ms-cert=2023w' option, suggesting that the Microsoft UEFI 2023" - . " certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n"; - print "While the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll it.\n"; - print "If the VM uses BitLocker, run the following command inside Windows Powershell:\n"; + print "EFI disk without 'ms-cert=2023w' option, suggesting that the Microsoft UEFI 2023\n"; + print "certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n"; + print "The new certificate is required for secure boot update for Windows and common\n"; + print "Linux distributions. Use 'Disk Action > Enroll Updated Certificates' in the UI\n"; + print "or, while the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll it.\n\n"; + print "For Windows with BitLocker, run the following command inside Powershell:\n"; print " manage-bde -protectors -disable \n"; print "for each drive with BitLocker (for example, could be 'C:').\n"; } -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel