Efivars 96% full after upgrade to opensuse leap 15.6

English Install/Boot/Login
1

After installing OpenSuse Leap 15.6 I noticed that the efivars filesystem was 96% full.

The largest file under /sys/firmware/efi/efivars was:

MokListRT-605dab50-e046-4300-abb6-3dd810dd8b23

which at 47K is nearly 50% of the total usage. I assume this file contains a list of
enrolled keys but I don’t know.

Running “mokutil --list-enrolled” shows 49 keys - most of which are for various updates of the nvidia drivers. Everytime a new driver is installed I install a new key but I assume the old keys are not removed.

If I create a new directory and run “mokutil --export” files are created from MOK-0001.der to MOK-0049.der. I assume I could work out which are the keys for old versions of the nvidia driver and do “mokutil --delete ” to remove the keys that are no longer needed. The man page for mokutil says that this command will form a deleting request to shim - so I assume on re-booting the box I will be presented with the blue screens of the MOK Management utility and will have to confirm which keys are to be deleted.

So I have two questions - is this what I need to do to prevent the efivars filesystem
from filling up and does in work in the way that I think it does? I would be grateful
for any further information on the mokutil commands and the MOK Management application.

2

Of course not. It will just free some space once, but it has no impact on the future behavior.

They should be when NVIDIA package is removed. If you can reproduce it with enough evidences (certificates and packages present before and after NVIDIA installation/update, full output of zypper install) you most certainly need to open bug report.

3

Thank you for the reply. I will see what happens when the next release of nvidia drivers occurs and if I can get the evidence that the keys are not being deleted. I am a little confused as to why manually deleting the keys now would not free up space? Looking at the output of “mokutil --list-enrolled” shows that of the 49 keys enrolled, 46 of them are for nvidia going back to 2021. So presumably some of these could be deleted - I’m just unsure of the exact procedure to do this?

4

It will. Your question was

and deleting the current content will not prevent it from filling up again in the future.

1 Like
5

You can compare the existing certificates under /var/lib/nvidia-pubkeys or /usr/share/nvidia-pubkeys and delete everything not present there or delete all NVIDIA certificates and then import those currently present on your system.

This assumes that only certificates for the currently installed packages are present. If not you can check what certificate was used to sign kernel modules are leave it deleting others.

If you have questions how to do it, you better start with showing the actual content of this directory (whatever you have, it did change at some point).

6

Thank you for the information and apologies for not framing my initial questions more carefully. I will have a go at deleting some of the earlier nvidia keys. If I can prove that the old keys are not being deleted then I will raise a bug. Just for information this is the content of the /var/lib/nvidia-pubkeys directory:
-rw-r–r-- 1 root root 900 Sep 6 2023 MOK-nvidia-driver-G06-535.104.05-lp155.11.1-default.der
-rw-r–r-- 1 root root 900 Sep 28 2023 MOK-nvidia-driver-G06-535.113.01-lp155.14.1-default.der
-rw-r–r-- 1 root root 900 Nov 2 2023 MOK-nvidia-driver-G06-535.129.03-lp155.15.1-default.der
-rw-r–r-- 1 root root 898 Jun 28 2023 MOK-nvidia-driver-G06-535.54.03-lp155.10.1-default.der
-rw-r–r-- 1 root root 898 Jul 21 2023 MOK-nvidia-driver-G06-535.86.05-lp155.10.1-default.der
-rw-r–r-- 1 root root 898 Nov 16 2023 MOK-nvidia-driver-G06-545.29.02-lp155.18.1-default.der
-rw-r–r-- 1 root root 898 Nov 28 2023 MOK-nvidia-driver-G06-545.29.06-lp155.18.1-default.der
-rw-r–r-- 1 root root 898 Feb 28 07:23 MOK-nvidia-driver-G06-550.54.14-lp155.20.1-default.der
-rw-r–r-- 1 root root 892 Mar 20 21:09 MOK-nvidia-driver-G06-550.67-lp155.20.1-default.der
-rw-r–r-- 1 root root 892 Apr 30 07:53 MOK-nvidia-driver-G06-550.78-lp155.22.1-default.der
-rw-r–r-- 1 root root 869 Oct 15 2020 MOK-nvidia-gfxG05-450.80.02-lp152.32.1-default.der
-rw-r–r-- 1 root root 869 Nov 16 2020 MOK-nvidia-gfxG05-450.80.02-lp152.35.1-default.der
-rw-r–r-- 1 root root 869 Nov 16 2020 MOK-nvidia-gfxG05-450.80.02-lp152.35.1-preempt.der
-rw-r–r-- 1 root root 890 Nov 17 2020 MOK-nvidia-gfxG05-450.80.02-lp152.37.1-default.der
-rw-r–r-- 1 root root 890 Nov 17 2020 MOK-nvidia-gfxG05-450.80.02-lp152.37.1-preempt.der
-rw-r–r-- 1 root root 890 Dec 18 2020 MOK-nvidia-gfxG05-460.27.04-lp152.33.1-default.der
-rw-r–r-- 1 root root 889 Dec 18 2020 MOK-nvidia-gfxG05-460.27.04-lp152.33.1-preempt.der
-rw-r–r-- 1 root root 890 Jan 9 2021 MOK-nvidia-gfxG05-460.32.03-lp152.33.1-default.der
-rw-r–r-- 1 root root 890 Jan 9 2021 MOK-nvidia-gfxG05-460.32.03-lp152.33.1-preempt.der
-rw-r–r-- 1 root root 884 Feb 2 2021 MOK-nvidia-gfxG05-460.39-lp152.34.1-default.der
-rw-r–r-- 1 root root 884 Feb 2 2021 MOK-nvidia-gfxG05-460.39-lp152.34.1-preempt.der
-rw-r–r-- 1 root root 884 Mar 2 2021 MOK-nvidia-gfxG05-460.56-lp152.35.1-default.der
-rw-r–r-- 1 root root 884 Mar 2 2021 MOK-nvidia-gfxG05-460.56-lp152.35.1-preempt.der
-rw-r–r-- 1 root root 884 Mar 19 2021 MOK-nvidia-gfxG05-460.56-lp152.36.1-default.der
-rw-r–r-- 1 root root 884 Mar 19 2021 MOK-nvidia-gfxG05-460.56-lp152.36.1-preempt.der
-rw-r–r-- 1 root root 884 Mar 20 2021 MOK-nvidia-gfxG05-460.67-lp152.36.1-default.der
-rw-r–r-- 1 root root 884 Mar 20 2021 MOK-nvidia-gfxG05-460.67-lp152.36.1-preempt.der
-rw-r–r-- 1 root root 890 Apr 16 2021 MOK-nvidia-gfxG05-460.73.01-lp152.37.1-default.der
-rw-r–r-- 1 root root 890 Apr 16 2021 MOK-nvidia-gfxG05-460.73.01-lp152.37.1-preempt.der
-rw-r–r-- 1 root root 890 May 5 2021 MOK-nvidia-gfxG05-460.73.01-lp152.39.1-default.der
-rw-r–r-- 1 root root 890 May 5 2021 MOK-nvidia-gfxG05-460.73.01-lp152.39.1-preempt.der
-rw-r–r-- 1 root root 884 Jun 5 2021 MOK-nvidia-gfxG05-460.80-lp152.38.1-default.der
-rw-r–r-- 1 root root 884 Jun 5 2021 MOK-nvidia-gfxG05-460.80-lp152.38.1-preempt.der
-rw-r–r-- 1 root root 884 Jun 23 2021 MOK-nvidia-gfxG05-460.84-lp152.40.1-default.der
-rw-r–r-- 1 root root 884 Jun 23 2021 MOK-nvidia-gfxG05-460.84-lp152.40.1-preempt.der
-rw-r–r-- 1 root root 884 Jul 7 2021 MOK-nvidia-gfxG05-460.84-lp153.40.1-default.der
-rw-r–r-- 1 root root 884 Jul 7 2021 MOK-nvidia-gfxG05-460.84-lp153.40.1-preempt.der
-rw-r–r-- 1 root root 892 Feb 3 2022 MOK-nvidia-gfxG05-470.103.01-lp153.48.1-default.der
-rw-r–r-- 1 root root 892 Feb 3 2022 MOK-nvidia-gfxG05-470.103.01-lp153.48.1-preempt.der
-rw-r–r-- 1 root root 892 Feb 17 2022 MOK-nvidia-gfxG05-470.103.01-lp153.50.1-default.der
-rw-r–r-- 1 root root 892 Feb 17 2022 MOK-nvidia-gfxG05-470.103.01-lp153.50.1-preempt.der
-rw-r–r-- 1 root root 892 Feb 23 2022 MOK-nvidia-gfxG05-470.103.01-lp153.52.1-default.der
-rw-r–r-- 1 root root 892 Feb 23 2022 MOK-nvidia-gfxG05-470.103.01-lp153.52.1-preempt.der
-rw-r–r-- 1 root root 892 May 18 2022 MOK-nvidia-gfxG05-470.129.06-lp153.50.1-default.der
-rw-r–r-- 1 root root 892 May 18 2022 MOK-nvidia-gfxG05-470.129.06-lp153.50.1-preempt.der
-rw-r–r-- 1 root root 892 Jun 15 2022 MOK-nvidia-gfxG05-470.129.06-lp153.54.1-default.der
-rw-r–r-- 1 root root 892 Jun 15 2022 MOK-nvidia-gfxG05-470.129.06-lp153.54.1-preempt.der
-rw-r–r-- 1 root root 892 Jul 21 2022 MOK-nvidia-gfxG05-470.129.06-lp154.54.1-default.der
-rw-r–r-- 1 root root 892 Jul 22 2022 MOK-nvidia-gfxG05-470.129.06-lp154.57.1-default.der
-rw-r–r-- 1 root root 892 Aug 3 2022 MOK-nvidia-gfxG05-470.141.03-lp154.53.1-default.der
-rw-r–r-- 1 root root 892 Oct 12 2022 MOK-nvidia-gfxG05-470.141.03-lp154.56.1-default.der
-rw-r–r-- 1 root root 892 Nov 15 2022 MOK-nvidia-gfxG05-470.141.03-lp154.58.1-default.der
-rw-r–r-- 1 root root 892 Nov 23 2022 MOK-nvidia-gfxG05-470.161.03-lp154.54.1-default.der
-rw-r–r-- 1 root root 892 Nov 30 2022 MOK-nvidia-gfxG05-470.161.03-lp154.57.1-default.der
-rw-r–r-- 1 root root 892 Jan 11 2023 MOK-nvidia-gfxG05-470.161.03-lp154.58.1-default.der
-rw-r–r-- 1 root root 892 Feb 14 2023 MOK-nvidia-gfxG05-470.161.03-lp154.59.1-default.der
-rw-r–r-- 1 root root 892 Apr 5 2023 MOK-nvidia-gfxG05-470.182.03-lp154.53.1-default.der
-rw-r–r-- 1 root root 892 May 10 2023 MOK-nvidia-gfxG05-470.182.03-lp154.54.1-default.der
-rw-r–r-- 1 root root 892 Jun 21 2023 MOK-nvidia-gfxG05-470.182.03-lp154.56.1-default.der
-rw-r–r-- 1 root root 890 Jul 21 2021 MOK-nvidia-gfxG05-470.57.02-lp153.42.1-default.der
-rw-r–r-- 1 root root 890 Jul 23 2021 MOK-nvidia-gfxG05-470.57.02-lp153.43.1-default.der
-rw-r–r-- 1 root root 890 Jul 23 2021 MOK-nvidia-gfxG05-470.57.02-lp153.43.1-preempt.der
-rw-r–r-- 1 root root 890 Aug 31 2021 MOK-nvidia-gfxG05-470.63.01-lp153.43.1-default.der
-rw-r–r-- 1 root root 890 Aug 31 2021 MOK-nvidia-gfxG05-470.63.01-lp153.43.1-preempt.der
-rw-r–r-- 1 root root 884 Oct 27 2021 MOK-nvidia-gfxG05-470.74-lp153.44.1-default.der
-rw-r–r-- 1 root root 884 Oct 27 2021 MOK-nvidia-gfxG05-470.74-lp153.44.1-preempt.der
-rw-r–r-- 1 root root 890 Nov 3 2021 MOK-nvidia-gfxG05-470.82.00-lp153.45.1-default.der
-rw-r–r-- 1 root root 890 Nov 3 2021 MOK-nvidia-gfxG05-470.82.00-lp153.45.1-preempt.der
-rw-r–r-- 1 root root 884 Nov 19 2021 MOK-nvidia-gfxG05-470.86-lp153.46.1-default.der
-rw-r–r-- 1 root root 884 Nov 19 2021 MOK-nvidia-gfxG05-470.86-lp153.46.1-preempt.der
-rw-r–r-- 1 root root 884 Jan 5 2022 MOK-nvidia-gfxG05-470.94-lp153.47.1-default.der
-rw-r–r-- 1 root root 884 Jan 5 2022 MOK-nvidia-gfxG05-470.94-lp153.47.1-preempt.der
-rw-r–r-- 1 root root 884 Jan 15 2022 MOK-nvidia-gfxG05-470.94-lp153.48.1-default.der
-rw-r–r-- 1 root root 884 Jan 15 2022 MOK-nvidia-gfxG05-470.94-lp153.48.1-preempt.der

7

Always use preformatted text to post computer output. Otherwise post becomes barely readable.

Anyway, you tagged your topic with 15.6, but I do not see any key for 15.6 packages. Which means you likely can safely remove all keys there. Did you check /usr/share/nvidia-pubkeys?

8

I checked /var/lib/nvidia-pubkeys but didn’t realise that there could be files in
/usr/share/nvidia-pubkeys as well. The 15.6 entry is there - apologies for not checking before.

-rw-r--r--   1 root root   894 Jul 17 10:21 MOK-nvidia-driver-G06-550.100-lp155.25.1-default.der
-rw-r--r--   1 root root   894 Aug 13 14:30 MOK-nvidia-driver-G06-550.100-lp156.25.1-default.der
-rw-r--r--   1 root root   898 Jun  6 07:25 MOK-nvidia-driver-G06-550.90.07-lp155.23.1-default.der
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.