Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 22. Updating the Secure Boot Revocation List

You can update the UEFI Secure Boot Revocation List on your system so that Secure Boot identifies software with known security issues and prevents it from compromising your boot process.

22.1. The Secure Boot Revocation List
Link kopieren

The UEFI Secure Boot Revocation List, or the Secure Boot Forbidden Signature Database (dbx), is a list that identifies software that Secure Boot no longer allows to run.

When a security issue or a stability problem is found in software that interfaces with Secure Boot, such as in the GRUB boot loader, the Revocation List stores its hash signature. Software with such a recognized signature cannot run during boot, and the system boot fails to prevent compromising the system.

For example, a certain version of GRUB might contain a security issue that allows an attacker to bypass the Secure Boot mechanism. When the issue is found, the Revocation List adds hash signatures of all GRUB versions that contain the issue. As a result, only secure GRUB versions can boot on the system.

The Revocation List requires regular updates to recognize newly found issues. When updating the Revocation List, make sure to use a safe update method that does not cause your currently installed system to no longer boot.

22.2. Applying an online Revocation List update
Link kopieren

You can update the Secure Boot Revocation List on your system so that Secure Boot prevents known security issues. This procedure is safe and ensures that the update does not prevent your system from booting.

Prerequisites

  • Secure Boot is enabled on your system.
  • Your system can access the internet for updates.

Procedure

  1. Determine the current version of the Revocation List: 

    # fwupdmgr get-devices
    Copy to Clipboard Toggle word wrap

    See the Current version field under UEFI dbx.

  2. Enable the LVFS Revocation List repository: 

    # fwupdmgr enable-remote lvfs
    Copy to Clipboard Toggle word wrap

  3. Refresh the repository metadata: 

    # fwupdmgr refresh
    Copy to Clipboard Toggle word wrap

  4. Apply the Revocation List update:

    • On the command line: 

      # fwupdmgr update
      Copy to Clipboard Toggle word wrap

    • In the graphical interface:

      1. Open the Software application
      2. Navigate to the Updates tab.
      3. Find the Secure Boot dbx Configuration Update entry.
      4. Click Update.
  5. At the end of the update, fwupdmgr or Software asks you to reboot the system. Confirm the reboot.

Verification

  • After the reboot, check the current version of the Revocation List again: 

    # fwupdmgr get-devices
    Copy to Clipboard Toggle word wrap

22.3. Applying an offline Revocation List update
Link kopieren

On a system with no internet connection, you can update the Secure Boot Revocation List from RHEL so that Secure Boot prevents known security issues. This procedure is safe and ensures that the update does not prevent your system from booting.

Procedure

  1. Determine the current version of the Revocation List: 

    # fwupdmgr get-devices
    Copy to Clipboard Toggle word wrap

    See the Current version field under UEFI dbx.

  2. List the updates available from RHEL: 

    # ls /usr/share/dbxtool/
    Copy to Clipboard Toggle word wrap

  3. Select the most recent update file for your architecture. The file names use the following format: 

    DBXUpdate-date-architecture.cab
    Copy to Clipboard Toggle word wrap

  4. Install the selected update file: 

    # fwupdmgr install /usr/share/dbxtool/DBXUpdate-date-architecture.cab
    Copy to Clipboard Toggle word wrap
  5. At the end of the update, fwupdmgr asks you to reboot the system. Confirm the reboot.

Verification

  • After the reboot, check the current version of the Revocation List again: 

    # fwupdmgr get-devices
    Copy to Clipboard Toggle word wrap
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat