linux refusing the creation of PK on thinkpad T460s

[dkwo]

I'm trying to use sbctl on Void linux, but it appears I'm not mounting the efivars correctly.
Could you please point out the correct way to do it, without relying on dbus, udev etc?

$ doas sbctl status
Installed:      ✔ Sbctl is installed
Owner GUID:     <some stuff>
Setup Mode:     ✔ Disabled
Secure Boot:    ✘ Disabled
$ doas sbctl enroll-keys
Enrolling keys to EFI variables...✘
couldn't sync keys: couldn't open file: open /sys/firmware/efi/efivars/<some string>: no such file or directory
$ doas mount -t efivarfs efivarfs /sys/firmware/efi/efivars
$ doas sbctl status
Installed:      ✔ Sbctl is installed
Owner GUID:     <same stuff>
Setup Mode:     ✘ Enabled
Secure Boot:    ✘ Disabled
$ doas sbctl enroll-keys
Enrolling keys to EFI variables...✘
sbtl requires root to run: couldn't sync keys: couldn't write efi variable: write /sys/firmware/efi/efivars/<some different string>: permission denied

Thanks.

[dkwo]

this is on a thinkpad t460s

[dkwo]

$ doas lsattr /sys/firmware/efi/efivars/<string>
---------------------- /sys/firmware/efi/efivars/<string>

[Foxboron]

Please post complete errors. I'm unable to figure out anything if you keep censoring values for no good reason.

I don't know how Void mounts efivarfs, so that is something you need to figure out on your own. As for rest of the errors you need to reset the User Mode. And give me the output of:

lsattr /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f

[dkwo]

Let me do it again: this is with efivars mounted via doas mount -t efivarfs efivarfs /sys/firmware/efi/efivars

$ doas sbctl status
Installed:      ✔ Sbctl is installed
Owner GUID:     81b996f5-236f-43ab-b5c9-282b933f006c
Setup Mode:     ✘ Enabled
Secure Boot:    ✘ Disabled
$ doas sbctl enroll-keys
Enrolling keys to EFI variables...✘
sbtl requires root to run: couldn't sync keys: couldn't write efi variable: write /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c: permission denied
$ doas lsattr /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00
e098032b8c /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
---------------------- /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c
---------------------- /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c
---------------------- /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f

[Foxboron]

Output of ls -lah /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f please

[dkwo]

 ls -lah /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098
032b8c /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f
-rw-r--r-- 1 root root 1.4K Oct 18 19:12 /sys/firmware/efi/efivars/KEK-8be4df61-93ca-11d2-aa0d-00e098032b8c
-rw-r--r-- 1 root root    0 Oct 18 19:12 /sys/firmware/efi/efivars/PK-8be4df61-93ca-11d2-aa0d-00e098032b8c
-rw-r--r-- 1 root root 1.3K Oct 18 19:12 /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f

[Foxboron]

Did you select User Mode in the Secure Boot menu on your thinkpad?

[dkwo]

I first cleared keys and then selected setup mode.

[dkwo]

is user mode something different?

[Foxboron]

It's refusing to accept the Platform Key so I'm not quite sure what state the secure boot mode should be in for that to be a thing. To me it seems like everything should be working.

[dkwo]

In my bios, I have under secure boot:

secure boot: disabled
platform mode: setup mode (cannot change)
secure boot mode: custom (cannot change)
reset to setup mode: enter (did as 2)
restore factory keys: enter
clear all secure boot keys: enter (did as 1)

As for the OS, I don't think it mounts by default efivars, so I used the mount command above.

[dkwo]

could it be an issue with thinkpads? have you had experience with those?

[Foxboron]

sbctl is developed on a t480s. It should just work. Everything seems in order so this is weird. Never seen this before frankly.

[dkwo]

I see. And you're not questioning the way I mount efivars, right?
(if I don't mount them, there's nothing there)

[Foxboron]

systemd mount efivarfs like this on Arch Linux

λ ~ » mount | grep efivar
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)

I don't think anything here matters? It did manage to create KEK and db so PK is linux refusing the creation.