Watch out: EBG and software RAID1

[Jan Kiszka]

Hi all,

just to ensure that not too many run into this trap again:

If you are considering to deploy EFI Boot Guard on a software-based
RAID1 system, do not put the EBG config partitions onto that setup as
well. While Linux will happily keep the RAID-duplicated config
partitions in sync, our EFI bootloader won't. The result can be
boot/update loops when state changes performed by the bootloader are not
recognized by Linux later on. There might be more error scenarios as well.

We are currently considering how to handle this case best. Short-term,
EBG could probably be made aware of Linux' MD RAID1, but there are many
devils in the details. Long-term, the config partition free vision for
EBG [1] would resolve the issue, but it is simply not available yet.

Hardware-based RAID systems are obviously not affected by this limitation.

Jan

[1] https://groups.google.com/g/efibootguard-dev/c/pCzKDkbuNjQ

--
Siemens AG, Foundational Technologies
Linux Expert Center