←back to thread

Linux and Secure Boot certificate expiration

(lwn.net)
253 points pabs3 | 1 comments | 18 Jul 25 03:53 UTC | HN request time: 0s | source
Show context
saidinesh5 ◴[18 Jul 25 06:54 UTC] No.44601960[source]▶
Just out of curiosity, how good is the secure boot experience these days?

I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

replies(11): >>44602000 #>>44602120 #>>44602279 #>>44602520 #>>44602559 #>>44602593 #>>44602696 #>>44602761 #>>44602773 #>>44603004 #>>44607063 #
bravetraveler ◴[18 Jul 25 07:01 UTC] No.44602000[source]▶
Signature maintenance for modules can be fully automated. Enrollment requires navigating a mildly-intimidating interface a single time to accept the new PKI.

Fine for systems you physically manage, anything remote in a datacenter I wouldn't bother (without external motivation)

replies(1): >>44602333 #
mormegil ◴[18 Jul 25 07:59 UTC] No.44602333[source]▶
Which is strange because secure boot should be useful in _exactly_ the situation you don't have physical control of the HW, shouldn't it? I guess the threat model for a common not-that-important company does not include evil data center (and it's dubious if SecureBoot would protect you in reality), but wasn't that one of the motivations?
replies(3): >>44602388 #>>44602396 #>>44602630 #
1. michaelt ◴[18 Jul 25 08:59 UTC] No.44602630{3}[source]▶
> Which is strange because secure boot should be useful in _exactly_ the situation you don't have physical control of the HW, shouldn't it?

One of the ways you can introduce your own signing key is as a Machine Owner Key, using the "MOK Manager"

But a design goal of this software was: We don't want malware with root to be able to introduce a MOK without the user's consent, as then the malware could sign itself. So "MOK Manager" was deliberately designed to require keyboard-and-mouse interaction, early in boot before the network has been brought up.

Of course if your server has a KVM attached, you can still do this remotely, I guess.