Bug 2040107

Summary:	[RFE] Install shimx64.efi twice to be readable by non-root users
Product:	Red Hat Enterprise Linux 9	Reporter:	Steve Baker <sbaker>
Component:	shim	Assignee:	Bootloader engineering team <bootloader-eng-team>
Status:	CLOSED WONTFIX	QA Contact:	Release Test Team <release-test-team>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bstinson, jwboyer
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-07-13 07:31:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Steve Baker 2022-01-13 00:18:26 UTC

This is a request for packaging to also install the shim efi files in a /usr location which is accessible by all users.

There are use cases for shimx64.efi beyond booting the machine it is installed on. Specifically serving shimx64.efi over tftp to a remote machine will make it possible to enable secure boot for baremetal provisioning in OpenStack Ironic by using (signed) grub network boot instead of iPXE.

Requiring root just to copy shimx64.efi into the /tftpboot directory constrains /tftpboot population to a privileged tool. This has drawbacks, for example when the shim package is updated.

Comment 1 Robbie Harwood 2022-01-13 15:02:00 UTC

> Requiring root just to copy shimx64.efi into the /tftpboot directory constrains /tftpboot population to a privileged tool. This has drawbacks, for example when the shim package is updated.

Root is not required.  Just unpack the rpm cpio ball and get grubx64.efi from there.

Comment 5 RHEL Program Management 2023-07-13 07:31:53 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.