REFIND-SB-HEALTHCHECK(8)

📦 version 0.14.2, in arch rolling, debian trixie, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💖 REFIND-SB-HEALTHCHECK(8) 💖

okay bestie, welcome to the rEFInd manual, and specifically to refind-sb-healthcheck — the little script that gives your Secure Boot setup a full glow-up checkup. ✨

heads up, the top of this page also just says "any later version" — that's the license vibe floating up there, so we're keeping it, fr fr.

✨ NAME ✨

refind-sb-healthcheck — interactively check and update Shim and Secure Boot keys 🎀

🦋 SYNOPSIS 🦋

refind-sb-healthcheck

💅 DESCRIPTION 💅

okay so here's the tea. Booting via Secure Boot relies upon a number of keys and, in most cases under Linux, an EFI binary known as Shim (typically shimx64.efi for x86-64 computers). This Shim binary, and the keys upon which the whole process relies, can age out of usefulness. And because most distributions are not rEFInd-centric, keeping the keys and the Shim binary up-to-date falls on the individual system administrator — that's you, bestie, sorry 😭. The refind-sb-healthcheck script helps with that; it performs a number of checks, and can optionally update binaries and key files (but not public keys stored in NVRAM):

  • The script first attempts to identify the Shim binary that launched the current boot session. The script then searches the EFI System Partition (ESP) and /usr for newer Shim binaries (as identified by the files' timestamps). If any newer Shim binaries are found, the script offers to update the currently-in-use Shim with the newer binary. The MokManager program (mmx64.efi on x86-64 systems) is updated along with Shim. 🫶
  • The refind-install script generates local rEFInd keys, to be used when signing rEFInd binaries that are not signed or to override existing signatures. These keys have a 10-year lifespan by default. The refind-sb-healthcheck script checks the age of the current local rEFInd signing key and, if it's expired or within one year of expiration, offers to replace the existing key. Note that, even if the user opts to update the key, existing rEFInd binaries are not re-signed. The new key may be added to the MOK list, but if the rEFInd key was added to the Secure Boot db, updating the db is left to the user. 👑
  • The Machine Owner Key (MOK) list is stored in NVRAM. It can contain keys for rEFInd, Linux distributions, and other keys, all of which will eventually expire. The refind-sb-healthcheck script scans the MOK and reports if there are any expired keys or keys that will expire within a year. If the user wants to update such keys, the user must track down appropriate updates and install them manually with mokutil or MokManager. Note that keeping expired keys in the MOK is not necessarily a problem, although deleting expired keys is advisable from a security point of view. Also, expired keys have probably been updated by their maintainers, so their updates should probably be installed. 🌸
  • refind-sb-healthcheck scans the Secure Boot db, KEK, and PK for expired keys much as it scans the MOK list. The issues here are similar, except that these keys cannot be easily updated by the user without first taking full control of the Secure Boot subsystem. Updates provided by Microsoft, a Linux distribution, or a computer manufacturer may, however, include updates to one or more of these key sets. 🔥

🌈 OPTIONS 🌈

refind-sb-healthcheck is an interactive program that provides no command-line options. Instead, the program scans for the information it needs, or occasionally asks the user for input depending on the environment it discovers. it's giving "we'll figure it out together" energy, and honestly? iconic. 💅

💀 LIMITATIONS 💀

refind-sb-healthcheck is a tool to assist in maintaining a rEFInd installation that uses Secure Boot. It is not meant to completely and automatically handle all Secure Boot maintenance tasks. Some notable limitations include:

  • refind-sb-healthcheck cannot update Secure Boot variables (except for the MOK). Even updating the MOK requires a reboot and manual interaction with MokManager at reboot. no cap. 😭
  • refind-sb-healthcheck relies on files' timestamps to locate Shim binaries that are newer than the one currently in use. This is not completely reliable; a binary that was recently copied using the default cp flags will appear to be recent, even if it's very old by version number standards. 🫠
  • The script does not attempt to maintain non-rEFInd key files, such as those a user might maintain to sign kernel binaries or kernel modules.
  • refind-sb-healthcheck incorporates a number of assumptions about the locations of rEFInd key files, the existence of common support programs, and the nature of the current installation. It may fail in unusual ways if these assumptions are violated.

q

not me pointing out that the original page literally ends its limitation list with two empty bullets and a lone q 💀 bestie I am not making this up, I'm just the messenger. keeping it exactly as it is, periodt.

🧚 AUTHORS 🧚

Primary author: Roderick W. Smith (rodsmith@rodsbooks.com)

⭐ SEE ALSO ⭐

mvrefind(8), mkrlconf(8), refind-install(8), refind-mkdefault(8), efibootmgr(8).

https://www.rodsbooks.com/refind/

👑 AVAILABILITY 👑

The refind-mkdefault command is part of the rEFInd package and is available from Roderick W. Smith.

and that's the whole page, bestie!! this one was written by Roderick W. Smith, sitting pretty at version 0.14.2 of the rEFInd Manual. go keep those keys fresh, you main character 🦋✨💖

📦 where this page comes from