CP-12697 Enable SB for AWS on first boot (no shim)

[tonynguien]

Background

Secure boot have keys (auth files) enrolled in the instance's EFI firmware. Given we deliver an VM image, we want to enroll the keys on the instance's first boot.

Solution

A new delphix-sb-enroll.service that enrolls the keys and immediately reboots the system. This way our appliance will boot with secure boot as early as possible, before delphix-platform.service runs for the first time.

The delphix-sb-enroll service will activate secure-boot only for VMs running on AWS, i.e. does nothing for VMs on other cloud platforms. And enrollment is done only once, subsequent reboots have no effect.

Testing Done

• AWS installation

delphix@ip-10-110-210-77:~$ sudo dpkg -i delphix-platform-aws_2025.08.22.17_amd64.deb
(Reading database ... 180788 files and directories currently installed.)
Preparing to unpack delphix-platform-aws_2025.08.22.17_amd64.deb ...
+ case $1 in
+ systemctl disable delphix.target
Removed "/etc/systemd/system/default.target.wants/delphix.target".
+ systemctl disable delphix-platform.service
Removed "/etc/systemd/system/delphix.target.wants/delphix-platform.service".
....
+ systemctl enable delphix.target
Created symlink /etc/systemd/system/default.target.wants/delphix.target → /usr/lib/systemd/system/delphix.target.
+ systemctl unmask delphix-sb-enroll.service
+ systemctl enable delphix-sb-enroll.service
Created symlink /etc/systemd/system/multi-user.target.wants/delphix-sb-enroll.service → /usr/lib/systemd/system/delphix-sb-enroll.service.
+ id -u postgres
++ id -u postgres
+ [[ 65437 -ne 65437 ]]
+ DEFAULT_UDEV_NET_SETUP_LINK_DIR=/usr/lib/udev/rules.d
+ MODIFIED_UDEV_NET_SETUP_LINK_DIR=/etc/udev/rules.d
+ [[ ! -e /usr/lib/udev/rules.d/80-net-setup-link.rules ]]
++ get-appliance-platform
+ [[ aws == \a\w\s ]]
+ mkdir -p /etc/udev/rules.d
+ cp /usr/lib/udev/rules.d/80-net-setup-link.rules /etc/udev/rules.d
+ sed -i 's/NAME=="", ENV{ID_NET_NAME}!="", NAME="$env{ID_NET_NAME}"/NAME=="", ENV{ID_NET_NAME_MAC}!="", NAME="$env{ID_NET_NAME_MAC}"/' /etc/udev/rules.d/80-net-setup-link.rules
++ uname -r
+ update-initramfs -u -t -k 6.14.0-1010-dx2025082120-f9bbb315e-aws
update-initramfs: Generating /boot/initrd.img-6.14.0-1010-dx2025082120-f9bbb315e-aws
Couldn't find EFI system partition. It is recommended to mount it to /boot or /efi.
Alternatively, use --esp-path= to specify path to mount point.
+ exit 0
delphix@ip-10-110-210-77:~$ sudo init 6

Secure boot is enabled after reboot

delphix@ip-10-110-210-77:~$ bootctl status | grep -i "secure boot"
Couldn't find EFI system partition. It is recommended to mount it to /boot or /efi.
Alternatively, use --esp-path= to specify path to mount point.
   Secure Boot: enabled (user)

Verified service ran and rebooted

delphix@ip-10-110-210-77:~$ sudo journalctl -xu delphix-sb-enroll
Aug 22 18:43:57 ip-10-110-210-77 systemd[1]: Starting delphix-sb-enroll.service - Enroll Secure Boot variables (PK/KEK/db) from .auth files...
░░ Subject: A start job for unit delphix-sb-enroll.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit delphix-sb-enroll.service has begun execution.
░░
░░ The job identifier is 114.
Aug 22 18:43:58 ip-10-110-210-77 sb_enroll_efivars.sh[4516]: [sb-enroll] AWS detected (via DMI)
Aug 22 18:43:58 ip-10-110-210-77 sudo[4560]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/efi-updatevar -f /var/delphix/server/sb_keys//db.auth db
Aug 22 18:43:58 ip-10-110-210-77 sudo[4560]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Aug 22 18:43:58 ip-10-110-210-77 sudo[4560]: pam_unix(sudo:session): session closed for user root
Aug 22 18:43:58 ip-10-110-210-77 sb_enroll_efivars.sh[4516]: [sb-enroll] db: update submitted
Aug 22 18:43:58 ip-10-110-210-77 sudo[4865]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/efi-updatevar -f /var/delphix/server/sb_keys//KEK.auth KEK
Aug 22 18:43:58 ip-10-110-210-77 sudo[4865]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Aug 22 18:43:58 ip-10-110-210-77 sudo[4865]: pam_unix(sudo:session): session closed for user root
Aug 22 18:43:58 ip-10-110-210-77 sb_enroll_efivars.sh[4516]: [sb-enroll] KEK: update submitted
Aug 22 18:43:58 ip-10-110-210-77 sudo[4891]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/efi-updatevar -f /var/delphix/server/sb_keys//PK.auth PK
Aug 22 18:43:58 ip-10-110-210-77 sudo[4891]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Aug 22 18:43:58 ip-10-110-210-77 sudo[4891]: pam_unix(sudo:session): session closed for user root
Aug 22 18:43:58 ip-10-110-210-77 sb_enroll_efivars.sh[4516]: [sb-enroll] PK: update submitted
Aug 22 18:43:58 ip-10-110-210-77 sb_enroll_efivars.sh[4516]: [sb-enroll] Rebooting...
Aug 22 18:43:59 ip-10-110-210-77 systemd[1]: delphix-sb-enroll.service: Deactivated successfully.
░░ Subject: Unit succeeded
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support

• Azure installation

delphix@tonyn-azure-sb1:~$ sudo dpkg -i delphix-platform-azure_2025.08.22.17_amd64.deb
(Reading database ... 208638 files and directories currently installed.)
Preparing to unpack delphix-platform-azure_2025.08.22.17_amd64.deb ...
+ case $1 in
+ systemctl disable delphix.target
Removed "/etc/systemd/system/default.target.wants/delphix.target".
+ systemctl disable delphix-platform.service
Removed "/etc/systemd/system/delphix.target.wants/delphix-platform.service".
+ systemctl disable delphix-rpool-upgrade.service
Removed "/etc/systemd/system/delphix.target.wants/delphix-rpool-upgrade.service".
....
+ systemctl enable delphix-rpool-upgrade.service
Created symlink /etc/systemd/system/delphix.target.wants/delphix-rpool-upgrade.service → /usr/lib/systemd/system/delphix-rpool-upgrade.service.
+ systemctl enable delphix.target
Created symlink /etc/systemd/system/default.target.wants/delphix.target → /usr/lib/systemd/system/delphix.target.
+ systemctl unmask delphix-sb-enroll.service
+ systemctl enable delphix-sb-enroll.service
Created symlink /etc/systemd/system/multi-user.target.wants/delphix-sb-enroll.service → /usr/lib/systemd/system/delphix-sb-enroll.service.
+ id -u postgres
++ id -u postgres
+ [[ 65437 -ne 65437 ]]
+ DEFAULT_UDEV_NET_SETUP_LINK_DIR=/usr/lib/udev/rules.d
+ MODIFIED_UDEV_NET_SETUP_LINK_DIR=/etc/udev/rules.d
+ [[ ! -e /usr/lib/udev/rules.d/80-net-setup-link.rules ]]
++ get-appliance-platform
+ [[ azure == \a\w\s ]]
+ exit 0

Verify service does nothing on start (not AWS)

delphix@tonyn-azure-sb1:~$ systemctl status delphix-sb-enroll
○ delphix-sb-enroll.service - Enroll Secure Boot variables (PK/KEK/db) from .auth files
     Loaded: loaded (/usr/lib/systemd/system/delphix-sb-enroll.service; enabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:efi-updatevar(1)
delphix@tonyn-azure-sb1:~$ sudo systemctl start delphix-sb-enroll
delphix@tonyn-azure-sb1:~$
delphix@tonyn-azure-sb1:~$
delphix@tonyn-azure-sb1:~$
delphix@tonyn-azure-sb1:~$ systemctl status delphix-sb-enroll
○ delphix-sb-enroll.service - Enroll Secure Boot variables (PK/KEK/db) from .auth files
     Loaded: loaded (/usr/lib/systemd/system/delphix-sb-enroll.service; enabled; preset: enabled)
     Active: inactive (dead) since Fri 2025-08-22 18:55:46 UTC; 4s ago
       Docs: man:efi-updatevar(1)
    Process: 15674 ExecStart=/var/lib/delphix-sb-enroll/sb_enroll_efivars.sh (code=exited, status=0/SUCCESS)
   Main PID: 15674 (code=exited, status=0/SUCCESS)
        CPU: 8ms
        
delphix@tonyn-azure-sb1:~$ sudo journalctl -xu delphix-sb-enroll
Aug 22 18:55:46 tonyn-azure-sb1 systemd[1]: Starting delphix-sb-enroll.service - Enroll Secure Boot variables (PK/KEK/db) from .auth files...
░░ Subject: A start job for unit delphix-sb-enroll.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit delphix-sb-enroll.service has begun execution.
░░
░░ The job identifier is 1633.
Aug 22 18:55:46 tonyn-azure-sb1 sb_enroll_efivars.sh[15674]: [sb-enroll] Not AWS; skipping Secure Boot enrollment.
Aug 22 18:55:46 tonyn-azure-sb1 systemd[1]: delphix-sb-enroll.service: Deactivated successfully.
░░ Subject: Unit succeeded
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit delphix-sb-enroll.service has successfully entered the 'dead' state.