fwupd HSI audit helper for Bluefin DX NVIDIA systems: s2idle, suspend-to-ram, polkit, firmware warnings

[GloverChris]

Updated Post

What this script does

It checks:

• fwupdmgr security output
• whether polkit is running, since that can cause the Authorization not available error
• Secure Boot state
• boot chain hints from bootctl
• kernel lockdown state
• kernel taint status
• whether NVIDIA modules are loaded
• current suspend mode from /sys/power/mem_sleep
• whether mem_sleep_default=s2idle is already set
• TPM presence
• IOMMU / DMA-related hints
• swap / disk encryption hints
• firmware update visibility through fwupdmgr
• a few basic hardening checks like SSH, firewalld, and fstrim

By default it is read-only. It should mostly just explain what it finds and help users decide whether something is actually actionable.

The one optional change path is suspend-related: if the machine supports s2idle, the script can apply mem_sleep_default=s2idle through rpm-ostree kargs when explicitly requested.

The goal is not to turn every HSI warning into a todo list. Some findings are firmware, hardware, or vendor capability issues. The script is mostly meant to separate “you should probably fix this” from “this is just how this platform reports itself.”

chmod +x bluefin_security_audit.sh
./bluefin_security_audit.sh

bluefin_security_audit.sh

[Original Post] Keeping so context doesn't get lost

I noticed a common set of fwupd HSI findings on Bluefin DX NVIDIA systems:

• NVIDIA kernel taint causing HSI runtime suffix
• suspend-to-ram enabled by default
• s2idle available but not default
• polkit/auth hiccups with fwupdmgr security
• firmware-only HSI findings that users probably should not chase
  bluefin_security_audit.sh

I put together a read-only-by-default helper script that audits the common states and optionally applies mem_sleep_default=s2idle via rpm-ostree kargs.

Would this be useful as:

1. a docs troubleshooting page,
2. a ujust helper,
3. a community snippet,
4. or should it live outside the main project?

Happy to clean it up to project standards if maintainers think it’s useful. (Script Attached)

[castrojo]

Shoving it in here is fine the bots index this forum.

[GloverChris]

Awesome, thanks — I’ll keep it here then.

I’ll clean up the script a bit so it is safe-by-default and easy for others to inspect before running. I’ll make sure the post calls out:

• NVIDIA kernel taint / runtime suffix is expected on NVIDIA systems
• firmware-only HSI findings probably should not be treated as user-actionable
• the mem_sleep change is optional and explicit
• the script is read-only by default unless the user passes the apply flag

[GloverChris]

All done. Thanks!