[pve-devel] [PATCH qemu-server 4/4] vm start: ovmf: do not auto-enroll Microsoft UEFI CA 2023

[Fiona Ebner]

As reported in the community forum [0], enrolling the new certificate
will trigger BitLocker recovery. It doesn't seem to be possible to
detect whether BitLocker is used by looking at the EFI var store (no
telling difference in dumps with 'virt-fw-vars --output-json' before
and after).

Stop auto-enrolling the new Microsoft UEFI 2023 certificate and
produce a warning, telling users about the 'qm enroll-efi-keys'
command and what steps to take when BitLocker is used to avoid
triggering recovery. Thomas found [1], which suggests using
'manage-bde -protectors -disable' which will disable key protectors
for the next boot and this was also successfully tested.

[0]: https://forum.proxmox.com/threads/173417/post-817164
[1]: https://discussion.fedoraproject.org/t/warning-recent-kek-firmware-update-locks-out-windows-bitlocker-urgent-issue-for-dual-boot-users/155431/5

Suggested-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---
 src/PVE/QemuServer.pm | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 687335b8..678e9ec5 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5423,14 +5423,15 @@ my sub check_efi_vars {
     return if !$conf->{efidisk0};
     return if $conf->{ostype} ne 'win10' && $conf->{ostype} ne 'win11';
 
-    if (
-        my $updated = PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled(
-            $storecfg, $vmid, $conf->{efidisk0},
-        )
-    ) {
-        $conf->{efidisk0} = $updated;
-        PVE::QemuConfig->write_config($vmid, $conf);
+    if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($conf->{efidisk0})) {
+        log_warn("EFI disk without 'ms-cert=2023' option, suggesting that the Microsoft UEFI 2023"
+            . " certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!");
+        print "While the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll it.\n";
+        print "If the VM uses BitLocker, run the following command inside Windows Powershell:\n";
+        print "manage-bde -protectors -disable <drive>\n";
+        print "for each drive with BitLocker (for example, <drive> could be 'C:').\n";
     }
+
     return;
 }
 
@@ -5611,11 +5612,7 @@ sub vm_start_nolock {
         my $storage_hints = generate_storage_hints($conf, 1);
         PVE::Storage::activate_volumes($storecfg, $vollist, undef, $storage_hints);
 
-        # Can only exclusively access EFI disk during cold start. Also, check_efi_vars() might write
-        # the configuration, which must not be done at this stage of migration on the target.
-        if (!$statefile && !$resume && $conf->{bios} && $conf->{bios} eq 'ovmf') {
-            check_efi_vars($storecfg, $vmid, $conf);
-        }
+        check_efi_vars($storecfg, $vmid, $conf) if $conf->{bios} && $conf->{bios} eq 'ovmf';
 
         # Note that for certain cases like templates, the configuration is minimized, so need to ensure
         # the rest of the function here uses the same configuration that was used to build the command
-- 
2.47.3