No boot after setting hardened kags

[sour crater]

I've tried (rebased on Silverblue) to install Secureblue but after setting hardened kags (both with or without unstable hardening) it won't boot again, just freezes at the boot screen.

I'm on a NUC7I3BNH. What could it be?

[sour crater]

Messed around in BIOS, changed settings one by one, set it to default (it's up to date btw) to no avail 🤔

Also tried with Kinoite, same problem

[hardy pasture]

That's odd. One of them must be unstable on your hardware for some reason. Probably has to do with the i3-7100U being 9 years old. You may have performance problems on secureblue as a number of our security changes decrease performance to improve security, and a dual core 2.4 GHz processor is fairly anemic by modern standards. Regardless I would go through the kargs that the script sets and manually set them and see which one(s) cause problems.

[sour crater]

Ait! Will do, I managed to install Secureblue on a 14 year old Lenovo laptop tho (i7 3rd gen) and with half the RAM of the NUC (got 16gb on the NUC, 8 on the Lenovo) hmm

Thanks!

[hardy pasture]

That's awesome to hear, just wanted to set expectations if the desktop experience isn't smooth. Let us know if you have other problems.

[forest turtle]

@sour crater in addition to what @hardy pasture said, you can try binary searching

set half of them, then half of half, etc

until you find the problem karg

[sour crater]

Alrighty! Now I tried with only denying 32-bit in that part and it does the same! Might be something with that then hmm

Stuck again...

[forest turtle]

wdym stuck

you can always reboot into the prior deployment

[sour crater]

Sorry, I'm doing 10 things simultaneously here, I let it restart to the snapshot it chose itself and it seemed stuck. But if I chose the other snapshot it carried on. Only just now did the audit and all is good except I'm still a wheel user apparently, tho I've tried twice in the admin account to fix that, soooo looking good apart from having to chose another snapshot (1 instead of 0 which it defaults)

[forest turtle]

wait im confused

so was it the 32 bit karg?

[sour crater]

After I did the karg hardening part it would always do something it didn't on the laptop with the snapshots, not sure if it was the 32 bit karg or not, I'm confused myself 😵‍💫

Working fine if I just choose the other snapshot tho

[forest turtle]

https://tenor.com/view/tim-allen-home-improvement-grunt-gif-23152896

[sour crater]

Yea...

[forest turtle]

🤔 do you mind posting rpm-ostree status and rpm-ostree kargs

would give a better idea of what state your system is in

[sour crater]

One sec

That's the status

And the kargs

[forest turtle]

interesting yeah

if that staged boot is broken for some reason

you can remove it

rpm-ostree cleanup --pending

[sour crater]

Ah thanks, was gonna look up the possibility, I'll have a go at that!

[forest turtle]

one of the many benefits of atomic 😄

you basically never need to reinstall even if you bork your shit

[sour crater]

Praise the lord, it worked! Snapped right in there. Thanks! And thanks for what seems an amazing project, if that's the right word even

[forest turtle]

for sure 🙂

[sour crater]

Did you see anything with the status and karg reports that should need any doing?

[forest turtle]

nope

[sour crater]

Sweet

[forest turtle]

it's very very very weird that you would have boot issues with the 32bit karg applied tho

like

it makes zero sense 😄

wait...

ia32_emulation=0

it's not that

must have been something else

[sour crater]

Yea, I'm far from good with any of this tho so you need to pop around far fuck off in the forest of Sweden to find out I suppose 😆

[forest turtle]

I what?

i think i know what you're saying but you're inadvertently using north american slang i think 😄

[sour crater]

I've no idea what kinda English I'm using either 😄

[forest turtle]

i was mostly chuckling because "pop" is slang for "shoot" 😛

[sour crater]

Didn't know, so you're in the USB?

[forest turtle]

USA yeah

lol

[sour crater]

A

[forest turtle]

https://tenor.com/view/usb-flash-drive-insert-connect-flip-gif-17588800

[sour crater]

Yea, but does only brits use "pop around"?

Like in come ovet

[forest turtle]

idk ive never heard that phrase 😄

[sour crater]

Over

Oh, believe they do, do you say someone is "a sandwich short of a picnic"?

[hardy pasture]

I thought pop was slang for carbonate beverages

[forest turtle]

as a noun yeah

[forest turtle]

never heard that

but also pop as a soft drink is a regional thing

[sour crater]

Or that someone is not the "full ticket"?

Toodle pip?

[forest turtle]

at this point im convinced you're making stuff up 😄

[sour crater]

Useful!

[forest turtle]

but then as a verb, "to pop" means "to shoot" 😛

[sour crater]

I see

Gonna pop some shells

?

[forest turtle]

nah

[sour crater]

No damn clue...

[forest turtle]

it's about violence

that's why it was unintentionally funny

[sour crater]

Aha

[forest turtle]

https://old.reddit.com/r/EnglishLearning/comments/1eqmgwy/okay_what_would_you_think_of_if_i_said_to_you/lhsl2oc/

it can also mean to punch

[sour crater]

Fäkk

[forest turtle]

like "i got popped in the mouth" = socked/punched

but it means violence

lol

[sour crater]

I knew that come to think of it

[forest turtle]

almost like the cartoon sound for a punch

[sour crater]

Bust a cap?

Hehe

[forest turtle]

that too

[sour crater]

Alrighty, too late already, half twelve, gotta sleep, thanks!

[forest turtle]

cya

[sour crater]

Btw what's "half twelve" in the USB?

In numbers?

[forest turtle]

idk i wouldnt say that

idk what half twelve is 😄

do you mean maybe "half past twelve"

would mean 12:30

am

[sour crater]

In the UK it'd be 12.30 too yea, confusing as hell

To a swede it means 11.30

[forest turtle]

uk english and american english are pretty different yeah

[sour crater]

But they leave out the "past"

Oki