{"id":2133,"date":"2026-03-31T14:03:24","date_gmt":"2026-03-31T21:03:24","guid":{"rendered":"https:\/\/wp.c9h.org\/cj\/?p=2133"},"modified":"2026-03-31T14:03:24","modified_gmt":"2026-03-31T21:03:24","slug":"finding-promoting-seabios-cloud-images-to-uefi-secure-boot-proxmox","status":"publish","type":"post","link":"https:\/\/wp.c9h.org\/cj\/?p=2133","title":{"rendered":"Finding: Promoting SeaBIOS Cloud Images to UEFI Secure Boot (Proxmox)"},"content":{"rendered":"

Discovery<\/h2>\n

Legacy cloud templates often lack the partitioning and bootloader
\nbinaries required for UEFI Secure Boot. Attempting to switch such a VM
\nto OVMF in Proxmox results in \u201cnot a bootable disk.\u201d We discovered that
\na surgical promotion is possible by manipulating the block device and
\nEFI variables from the hypervisor.<\/p>\n

The Problem<\/h2>\n
    \n
  1. Protective MBR Flags:<\/strong> Legacy installers often set
    \nthe pmbr_boot<\/code> flag on the GPT\u2019s protective MBR. Strict UEFI
    \nimplementations (OVMF) will ignore the GPT if this flag is present.<\/li>\n
  2. Missing ESP:<\/strong> Cloud images often lack a FAT32 EFI
    \nSystem Partition (ESP).<\/li>\n
  3. Variable Store:<\/strong> A fresh Proxmox
    \nefidisk0<\/code> is empty and lacks both the trust certificates
    \n(PK\/KEK\/db) and the BootOrder entries required for an automated
    \nboot.<\/li>\n<\/ol>\n

    The \u201cPromotion\u201d Rule<\/h2>\n

    To upgrade a SeaBIOS VM to Secure Boot without a full OS reinstall:
    \n1. Surgical Partitioning:<\/strong> Map the disk on the host and
    \nadd a FAT32 partition (Type EF00<\/code>). Clear the
    \npmbr_boot<\/code> flag from the MBR. 2. Binary
    \nPreparation:<\/strong> Boot the VM in SeaBIOS mode to install
    \nshim<\/code> and grub-efi<\/code> packages. Use
    \ngrub2-mkconfig<\/code> to populate the new ESP. 3. Trust
    \nInjection:<\/strong> Use the virt-fw-vars<\/code> utility on the
    \nhypervisor to programmatically enroll the Red Hat\/Microsoft CA keys and
    \nany custom certificates (e.g., FreeIPA CA) into the VM\u2019s
    \nefidisk<\/code>. 4. Boot Pinning:<\/strong> Explicitly set
    \nthe UEFI BootOrder<\/code> to point to the shimx64.efi<\/code>
    \npath via virt-fw-vars --append-boot-filepath<\/code>.<\/p>\n

    Solution (Example Command
    \nSequence)<\/h2>\n

    On the Proxmox Host (root<\/code>):<\/p>\n

    \n<\/a># Map and Clean MBR<\/span><\/span>\n<\/a>DEV<\/span>=<\/span>$(<\/span>rbd<\/span> map pool\/disk)<\/span><\/span>\n<\/a>parted<\/span> -s<\/span> $DEV<\/span> disk_set pmbr_boot off<\/span>\n<\/a><\/span>\n<\/a># Inject Trust and Boot Path (VM must be stopped)<\/span><\/span>\n<\/a>virt-fw-vars<\/span> --inplace<\/span> \/dev\/rbd\/mapped_efidisk \\<\/span><\/span>\n<\/a> --enroll-redhat<\/span> \\<\/span><\/span>\n<\/a> --add-db<\/span> <<\/span>GUID><\/span> \/path\/to\/ipa-ca.crt \\<\/span><\/span>\n<\/a> --append-boot-filepath<\/span> '\\EFI\\centos\\shimx64.efi'<\/span> \\<\/span><\/span>\n<\/a> --sb<\/span><\/span><\/code><\/pre>\n<\/div>\n

    This workflow enables high-integrity Secure Boot environments using
    \nexisting SeaBIOS infrastructure templates.<\/p>\n\n

    Tweet<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

    Discovery Legacy cloud templates often lack the partitioning and bootloader binaries required for UEFI Secure Boot. Attempting to switch such a VM to OVMF in Proxmox results in \u201cnot a bootable disk.\u201d We discovered that a surgical promotion is possible by manipulating the block device and EFI variables from the hypervisor. The Problem Protective MBR […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[17,341,340,101,184,100],"tags":[],"class_list":["post-2133","post","type-post","status-publish","format-standard","hentry","category-debian","category-proxmox","category-secure-boot","category-security","category-virtualization","category-x509"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1YDIB-yp","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/posts\/2133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2133"}],"version-history":[{"count":2,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/posts\/2133\/revisions"}],"predecessor-version":[{"id":2135,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=\/wp\/v2\/posts\/2133\/revisions\/2135"}],"wp:attachment":[{"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.c9h.org\/cj\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}