Locking the bootloader

6 months ago by med to c/postmarketos

I've been looking through the documentation and installation guides for PostmarketOS, and I've noticed there seems to be no mention of locking the bootloader after flashing.

Is that because there's no issue with doing so, or because you can't?

I'm looking at installing on a Fairphone 5, but anyone with any device that's able to share their experience would be appreciated.

moonpiedumplings 7 points 6 months ago

Only pixels let you relock the bootloader after flashing.

Frustratingly, grapheneos only supports pixels because of that.

save

path: 0 23104403, hotness: undefined, score: 7, children: 5

erebion 3 points 6 months ago

That's just plain wrong. Some others also allow it, for example: you could lock a Fairphone.

save

path: 0 23104403 23111193, hotness: undefined, score: 3, children: 4

med 2 points 6 months ago

After installing a different os? So if I installed PostmarketOS, could I lock the bootloader? After looking in to it more, it seems like a pretty clear no.

save

path: 0 23104403 23111193 23118763, hotness: undefined, score: 2, children: 3

erebion 4 points 6 months ago

postmarketOS does not seem to have implemented Android Verified Boot yet and I am not aware of Linux distros that do it.

Have a look at iodéOS, CalyxOS, GrapheneOS if you want that, at least for now.

save

path: 0 23104403 23111193 23118763 23118982, hotness: undefined, score: 4, children: 2

med 3 points 6 months ago

I have Graphene, and I'll be sticking with it for now.

I think my next step will have to be getting involved with implementing verified boot, because unless every phone suddenly starts shipping with TPMs and open bootloaders, I won't ever be able to switch.

Finding a starting point is half the battle I guess!

save

path: 0 23104403 23111193 23118763 23118982 23155295, hotness: undefined, score: 3, children: 1

oddsys 3 points 6 months ago

My experience with the FP4 is you can only lock the bootloader with a couple of "official" distro's. And even then there are conditions where this can go bad.

I can use the default factory version provided by fairphone, I can use e/os.

While I can install and use postmarketos or a lineage image, I can't lock the bootloader without turning it into a brick. I believe it is to do with boot partition signing by the CPU manufacturer and the android bootloader checking it.

save

path: 0 23105259, hotness: undefined, score: 3, children: 2

hornedfiend 3 points 6 months ago

i think it's simpler than that. It merely stores the latest security update you had when you locked your bootloader and doesn't allow you to rollback to an earlier version,but anything newer - regardless of the ROM being official or eOS/iodé , would allow you to relock it.

TLDR: flashing ROM security patch version > your existing security patch version.

save

path: 0 23105259 23105443, hotness: undefined, score: 3, children: 1

oddsys 3 points 6 months ago

Partially true, this applies to signed boot loaders, postmarketos can't be locked like e/os or the default distro by FP

save

path: 0 23105259 23105443 23152533, hotness: undefined, score: 3, children: 0

PureTryOut 3 points 6 months ago

That's not a supported setup or possible atm.

save

path: 0 23201009, hotness: undefined, score: 3, children: 0