#1142469 shim and grub built without NX_COMPAT flag

Package:
shim
Source:
shim
Submitter:
Stephan Verbücheln
Date:
2026-07-20 14:03:01 UTC
Severity:
normal
#1142469#5
Date:
2026-07-20 09:50:22 UTC
From:
To:
Since a new test was added to fwupdmgr with the last update, it now
reports on machines with UEFI Secure Boot that the device security
level is only basic (HSI-1):

$ fwupdmgr security
[...]
HSI-2
[...]
✘ UEFI memory protection:        Disabled
[...]

I suspect that this is caused by the fact that the shim and grub
binaries are not built with the flag NX_COMPAT. 

This can be checked with “objdump -p”:

fbx64.efi:      DllCharacteristics	00000000
fwupdx64.efi:   DllCharacteristics	00000540
grubx64.efi:    DllCharacteristics	00000000
mmx64.efi:      DllCharacteristics	00000000
shimx64.efi:    DllCharacteristics	00000000

Only fwupdx64.efi has the flag:

DllCharacteristics	00000540
			DYNAMIC_BASE
			NX_COMPAT
			NO_SEH

Regards
Stephan
#1142469#10
Date:
2026-07-20 10:57:41 UTC
From:
To:
Ubuntu 26.04 has two shim binaries in the shim-signed package:

shimx64.efi
shimx64.nx.efi

The second one has the flag.

Regards
#1142469#15
Date:
2026-07-20 13:13:00 UTC
From:
To:
Hi Stephan!

Nod. This was a deliberate decision for Trixie (and Bookworm). To add
NX, we need a complete NX-capable boot chain firmware -> shim -> grub
-> linux. We don't have that in Trixie, so I didn't enable NX there.

When you upgrade to forky, the complete chain is NX-compatible and is
tagged as such.