←back to thread

Linux and Secure Boot certificate expiration

(lwn.net)
253 points pabs3 | 2 comments | 18 Jul 25 03:53 UTC | HN request time: 0s | source
Show context
saidinesh5 ◴[18 Jul 25 06:54 UTC] No.44601960[source]▶
Just out of curiosity, how good is the secure boot experience these days?

I've had to disable it on all my installations because of either nvidia drivers or virtual box modules. In general Arch based distros didn't seem too friendly for secure boot set up.

replies(11): >>44602000 #>>44602120 #>>44602279 #>>44602520 #>>44602559 #>>44602593 #>>44602696 #>>44602761 #>>44602773 #>>44603004 #>>44607063 #
EnPissant ◴[18 Jul 25 09:18 UTC] No.44602696[source]▶
UKI + secure boot works really well, but it is somewhat manual of a set up on Arch (what isnt).

If properly set up the only files you generate are:

- /efi/loader/random-seed

- /efi/EFI/Linux/arch-linux.efi

- /efi/EFI/Linux/arch-linux-fallback.efi

and the .efi are all automatically signed by hooks.

You can even skip a bootloader and boot the images directly.

replies(1): >>44611213 #
1. IHawkMike ◴[19 Jul 25 00:03 UTC] No.44611213[source]▶
I just finished setting this up and it's definitely this easy. The hardest part was growing the ESP to dual boot with Windows but that is basically just copy/paste the files to a bigger partition and change the partition type GUIDs.

Most of the guides focus on creating the PK, KEK, and db certs for enrolling/updating certs from userspace with signed .auth files but that is kind of pointless and seriously over-complicates it. I just created a 20-year db key pair with openssl (and PK and KEK just to make sbctl happy due to a bug), then installed the public db cert into the UEFI manually via the ESP. Didn't even need to use setup mode, although I suspended BitLocker on the Windows partition to let it reseal its key with the new PCR 7 measurement after the db update.

To finish securing it I have a separate key for PK and KEK and have already installed Microsoft's 2023 UEFI certs in the db (and added the 2011 cert to dbx with the updated bootmgr).

replies(1): >>44613963 #
2. EnPissant ◴[19 Jul 25 09:38 UTC] No.44613963[source]▶
I just used sbctl to generate and install a platform key in setup mode. It worked well.