From dd7962cdcfb60ad6e57a5b041d91e0d1707d7e96 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:07:22 +0000 Subject: op-mode: T9269: report Secure Boot as "n/a (container)" A container is not booted by any firmware, so neither the UEFI nor the BIOS wording applies. Worse, is_uefi_system() probes /sys/firmware/efi which a container inherits from its host, thus a container on a UEFI host reported the Secure Boot state of that host. Check is_running_as_container() first and report "n/a (container)", leaving the UEFI and BIOS detection untouched for everything else. --- src/op_mode/version.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/op_mode/version.py b/src/op_mode/version.py index b93e3081b..d6d8aaca1 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -26,6 +26,7 @@ import vyos.version import vyos.limericks from vyos.utils.boot import is_uefi_system +from vyos.system.image import is_running_as_container from vyos.utils.system import get_secure_boot_state from jinja2 import Template @@ -61,11 +62,16 @@ Copyright: VyOS maintainers and contributors def _get_raw_data(funny=False): version_data = vyos.version.get_full_version_data() - version_data["secure_boot"] = "n/a (BIOS)" - if is_uefi_system(): - version_data["secure_boot"] = "disabled" - if get_secure_boot_state(): - version_data["secure_boot"] = "enabled" + # A container has no firmware of its own - it is not booted at all, thus + # neither the UEFI nor the BIOS wording applies + if is_running_as_container(): + version_data["secure_boot"] = "n/a (container)" + else: + version_data["secure_boot"] = "n/a (BIOS)" + if is_uefi_system(): + version_data["secure_boot"] = "disabled" + if get_secure_boot_state(): + version_data["secure_boot"] = "enabled" if funny: version_data["limerick"] = vyos.limericks.get_random() -- cgit v1.2.3