http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c2 --- Comment #2 from Josef Reidinger --- Also please attach content of /etc/grub.d/42_password ( you can remove salted pwd in file ). As if it contain unrestricted_menu set to yes, it is grub2 issue if grub2-mkconfig passes properly -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c4 Stakanov Schufter changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jsrain@suse.com Flags| |needinfo?(jsrain@suse.com) --- Comment #4 from Stakanov Schufter --- Created attachment 745192 --> http://bugzilla.opensuse.org/attachment.cgi?id=745192&action=edit 42_password from /etc as requested. You said: "As if it contain unrestricted_menu set to yes, it is grub2 issue if grub2-mkconfig passes properly" For what I see it does. Please advice me how to handle the size problem of yast2logs. Thank you -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c6 Josef Reidinger changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(stakanov@freenet. |needinfo?(mchang@suse.com) |de), | |needinfo?(jsrain@suse.com) | --- Comment #6 from Josef Reidinger --- michael please can you check it? From YaST POV it is properly configured for unrestricted menu. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c7 Michael Chang changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mchang@suse.com) |needinfo?(stakanov@freenet. | |de) --- Comment #7 from Michael Chang --- I've verified on openSUSE Leap 42.3 and "protect only modification" works as usual. Please attach your /etc/sysconfig/bootloader. I wonder are you using TPM variation of grub2 (aka TrustedGrub2) ? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c9 --- Comment #9 from Stakanov Schufter --- Sorry. Spec page wrong language: https://support.lenovo.com/gb/en/solutions/pd010141 That is the English one. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c11 Michael Chang changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #11 from Michael Chang --- Close as resolved fix because patch has been submitted to openSUSE:Factory. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c16 Stakanov Schufter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- Assignee|mchang@suse.com |stakanov@freenet.de Flags| |needinfo?(stakanov@freenet. | |de) --- Comment #16 from Stakanov Schufter --- Created attachment 793238 --> http://bugzilla.opensuse.org/attachment.cgi?id=793238&action=edit 42_password after update I have unfortunately to reopen this bug as the patch does not work. I am prompted for password at every boot. So something changed since the time the patch was done. I join the attachment of 42_password after the application of the update. I will then post also yast2log. Please inform me if you need anything else. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c18 Michael Chang changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(stakanov@freenet. | |de) | --- Comment #18 from Michael Chang --- Hi Stakanov, Did you run ?

update-bootloader --reinit

It is required to reinstall trustedgrub2 manually in case the pcr value got changed unexpectedly so you're unable to unseal any secrets, if any .. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1052420 http://bugzilla.opensuse.org/show_bug.cgi?id=1052420#c20 Stakanov Schufter changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(mchang@suse.com) --- Comment #20 from Stakanov Schufter --- (In reply to Michael Chang from comment #18)

Hi Stakanov,

Did you run ?

...

update-bootloader --reinit

It is required to reinstall trustedgrub2 manually in case the pcr value got changed unexpectedly so you're unable to unseal any secrets, if any ..

Thanks.

Hello Michael. I did run the command as of your indication. I restarted the system. As before, everything works, but the setting to not ask for the password if no changes are requested to grub is not honored. So what it does: you start, you unlock the bios, unlock the tpm with its password, you go to grub and you are presented with that CLI asking for the grub password. You give it, slot 0 has been unlocked, and then the boot goes on to the lvm were a second time a password is requested and then, I boot to the system. What it should do is to jump the password for grub, as it should ask for it if, e.g. I go into advanced and ask him to change a boot parameter. Unfortunately it always asks for that password. This is a bit weird because, in principle that bug was gone. The symbol table thing is gone perfectly but somewhere something changed so that the password request for grub at every boot does reappear. Should I try to uninstall trusted grub then reinstall it after a reboot? (In reply to Michael Chang from comment #18)

Hi Stakanov,

Did you run ?

...

update-bootloader --reinit

It is required to reinstall trustedgrub2 manually in case the pcr value got changed unexpectedly so you're unable to unseal any secrets, if any ..

Thanks.

Yes I did. But it does not change the behavior. I am asked the password for grub at every boot, it takes a long time, (about 15 seconds) then it claims: slot0 unlocked and proceeds as expected. Maybe I do have to uninstall it completely and reinstall it completely? -- You are receiving this mail because: You are on the CC list for the bug.