#1142469 shim and grub built without NX_COMPAT flag

Package:
shim
Source:
shim
Submitter:
Stephan Verbücheln
Date:
2026-09-15 08:15:01 UTC
Severity:
normal
#1142469#5
Date:
2026-07-20 09:50:22 UTC
From:
To:
Since a new test was added to fwupdmgr with the last update, it now
reports on machines with UEFI Secure Boot that the device security
level is only basic (HSI-1):

$ fwupdmgr security
[...]
HSI-2
[...]
✘ UEFI memory protection:        Disabled
[...]

I suspect that this is caused by the fact that the shim and grub
binaries are not built with the flag NX_COMPAT. 

This can be checked with “objdump -p”:

fbx64.efi:      DllCharacteristics	00000000
fwupdx64.efi:   DllCharacteristics	00000540
grubx64.efi:    DllCharacteristics	00000000
mmx64.efi:      DllCharacteristics	00000000
shimx64.efi:    DllCharacteristics	00000000

Only fwupdx64.efi has the flag:

DllCharacteristics	00000540
			DYNAMIC_BASE
			NX_COMPAT
			NO_SEH

Regards
Stephan
#1142469#10
Date:
2026-07-20 10:57:41 UTC
From:
To:
Ubuntu 26.04 has two shim binaries in the shim-signed package:

shimx64.efi
shimx64.nx.efi

The second one has the flag.

Regards
#1142469#15
Date:
2026-07-20 13:13:00 UTC
From:
To:
Hi Stephan!

Nod. This was a deliberate decision for Trixie (and Bookworm). To add
NX, we need a complete NX-capable boot chain firmware -> shim -> grub
-> linux. We don't have that in Trixie, so I didn't enable NX there.

When you upgrade to forky, the complete chain is NX-compatible and is
tagged as such.
#1142469#20
Date:
2026-09-05 08:03:39 UTC
From:
To:
I have booted Forky from weekly image and “fwupdmr security” still
shows:

✘ UEFI memory protection:        Unlocked

What am I missing here?

Regards
Stephan
#1142469#25
Date:
2026-09-06 13:30:16 UTC
From:
To:
Also: which weekly image did you use please?

And what does the following say:

$ dpkg -s shim-signed grub-efi-amd64-signed linux-image-amd64
#1142469#30
Date:
2026-09-15 08:14:08 UTC
From:
To:
Hi again

It was Forky weekly live CD from August 31. See the attachments for
fwupdmgr outputs.



The GRUB binary on the Forky live CD has the correct bits set:
$ objdump -x EFI/boot/grubx64.efi | grep -i DllCh
DllCharacteristics	00000100

For comparison, the Trixie installation:
# objdump -x EFI/boot/bootx64.efi | grep -i DllCh
DllCharacteristics	00000000

The laptop is a Lenovo ThinkPad X1 Carbon Gen 11, officially sold with
Ubuntu and Fedora.

Regards