I would disagree. The idea is great; eliminate preboot malware by trusting the whole boot stack. It has a place in computing and I would like to see it be something easier to work with.
Pretty much everything about how it's currently implemented is a mistake, I'll agree with.
More like who is implementing it. Take MS out of the picture and set it as an open standard.
Depends on the distro! I could do it in 5 minutes with my bazzite installation: https://docs.bazzite.gg/...
Very happy surprise when setting up my new PC :)
imo the only useful place to use secure boot is on a laptop with password protected bios and encrypted disk, in case someone wants to steal it they can't recover your data or if they want to put a virus in your pc they literally can't.
I don't see any reason to put secure boot on a desktop PC that's already locked inside your house.
To play battlefield
I am using secure boot on a laptop with password-protected UEFI and disk encryption.
What's the password?
hunter2
How do you know my cats name and favourite number
That is not the purpose of Secure Boot. The purpose is to establish a chain of trust of all code running on the system from boot and as such eliminate rootkits that can hide from the OS. A classic example is the MBR bootkit. Of course that this is mostly out of the window if at some point in the chain the trusted code just runs untrusted code, like the bootloader or the OS running unsigned code. Also the implementation is terrible, a proper implementation would allow the user to use their own certificates and only their own certificates, otherwise a compromised generic certificate fucks everything up like it already happened.
Secure boot is in case the OS gets tainted. It only allows a signed OS to boot.
For example when new nvidia drivers are autocompiled into my Tumbleweed kernel during an update, on reboot the srcureboot asks if I want to view the new key or allow it. I then have to enter a password to add the key...otherwise it won't boot with that kernel.
Woo, Tumbleweed! Their support of it is a pretty strong plus. I would get that screen sometimes too but it confused me a lot and I ended up just being like "Accept key I guess? Oh cool it boots."
What are you supposed to compare the key to? Nvidia's repo on a website using a different device, or before you update or what? Is it like comparing checksums in Dolphin?
I'm not particularly afraid of Evil Maids vs. my Tumbleweed desktop, as I'm much too poor for hired help (lol), so I just turned it off.
They make compelling points about using it for laptops though.
Yeah Tumbleweed supports a lot of things. Whenever people have complained about Linux not doing something, I'm like "Uh, OpenSUSE does"
Since I'm updating the Kernel and nVidia driver modules, the system is making its own keypair, so I guess its not a check against a known supplied key but a machine specific key pair. Enrolling the key stores it to check against the kernel on boot.
I suppose it protects against Random malware installs changing files, or if somebody swaps a drive on you.
Right? OpenSUSE stopped my distrohopping way before I thought I would. I love it.
Ahhh thank you, that makes a lot more sense! I don't feel too at-risk on my desktop, but if I ever find myself having to take a laptop to like, DEF-CON, then sounds like it'd be pretty essential, along with full-disk-encryption, AppArmor/SElinux, and all those other "wildly inconvenient but more secure" protocols set up.π (Lmao that would be terrifying.)
I might try to re-enable it just for the experience. After all, never know when some insane automated malware will hit the 'net that somehow exploits boot like that, and freaks out everyone who said "Nahh that's not possible."
That's exactly mz setup, as I need to leave my work laptop unauthorized in a shared space for prolonged periods.
Can't set up secure boot though because even fckin lenovo doesn't provide the needed bios options for Linux nowadays -.-
Which bios options do you need for that? Not enough to enter secure boot setup mode (restore factory keys) and enroll your keys?
Maybe I am not informed enough, i don't exactly know if i missed something , but i did what i would do under microslop, I reset to factory keys I enable secure boot in user mode and I boot.
When checking in the KDE security info, secure boot isn't enabled.
I asked lenovo support on how to do it (along with how to do an bios update under Debian) and the just replied there is no support for Linux. For either of those for my model and disabled the option to get support from a real human for my serial number.
Maybe I would have needed to "enroll my keys", I did not do that, mainly because I didn't knew I needed to, and still dont know where to get my keys from and how to enroll them. Maybe you could enlighten me.
Side rant: That I had to enter my full details including age and address and my serial number to even be able to get a support ticket is unbelievable imho
My device isn't included in the fwupd.
Okay, apparently Debian uses shim which is signed by Microsoft. That means you do not need to enroll custom keys.
disk encryption is much better with secure boot, because disk encryption requires a unencrypted partition, since the boot has to start somewhere unencrypted, and secure boot secures the unencrypted partition
Secured boot has nothing to do with encrypting your hard drive.
I agree, bricks have been known to get rid of problems.
sbctl is a nice tool for setting up secure boot:
https://github.com/Foxboron/sbctl
Thanks, but this is the very tool I used.
Yes works well for me.
Deciding to turn on secureboot on any distro that doesn't support it out of the box is always a mistake.
Still have nightmares from that one time i tried doing it under nixOS...
Oof, I tried alpine for a bit, nothing worked. That was just beyond me for little gain.
Alpine is dead simple if used for whatβs itβs good at. The LBU is its best feature. Itβs great on shitty ARM boards that digest SD cards. I use it on NUT servers throughout my network.
That is not my use case, I don't know any of those words !
Now I'm curious. What did you try that didn't work?
It was on an 08/ish laptop I wanted to just use for simple dvd watching and such. Had a lot of sound and disc issues. I'm a noob tho so went back to mint.
Same here, I run Mint everywhere I can, and the XFCE edition works especially well in old machines.
Alpine is better suited for servers and especially containers, because the images can be really small. If you got enough RAM, there's an installation mode that runs on it without writing to disk, pretty cool for systems where you want always to reboot in the same state.
Yea I wouldn't choose a musl/BusyBox distro for my daily driver.
if only secureboot support hibernate
My secure boot with hibernate works perfectly fine, or rather it did work fine before hibernate started freezing my system, secure boot or not.
There are no lockdown mode restrictions on my system. Kernel is not signed, but i switched to UKIs a couple months ago (hibernation worked fine with these).
It is worth noting that the failure is hibernating, not resuming. Normally hibernate takes ~1 minute with fans spinning at max speed, but it recently started not finishing and instead being stuck on a black screen for more than 30 minutes without the fans running until i run out of patience (i hibernate before i go to sleep or head out) and force power off the system (power button 10 second press on my system).
it worked fine before, so why break now?
5gb ram usage of 64gb total & 0gb used on a 128gb swap partition is quite unlikely to run out of swap space during hibernate
I will just never bother with any of this Secure boot nonsense. I leave that bs to the windows users.
What kind of attack does it actually protect against?
Evil maid attacks. Trusted boot is necessary to prevent the modification of unencrypted boot code like bootloader + kernel + initrd. Modified boot code could potentially steal the master key for the root volume while it gets entered. Also rootkits that inject below the os.
@lemmy.world
Hint: :q!
Community rules (click to expand)
sudo in Windows.We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations.
Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
go to feed...
@lemmy.world
Hint: :q!
Community rules (click to expand)
sudo in Windows.We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations.
Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
go to feed...
Everything about secure boot is a mistake.
save