Comment on Secure Boot is completely broken on 200+ models from 5 big device makers
ilinamorato@lemmy.world 1 month agoOk, so I am not an expert, and I am not the OP. But my understanding is that Secure Boot is checking with a relatively small list of trustworthy signing certificates to make sure that the OS and hardware are what they claim to be on boot. One of those certificates belongs to a Microsoft application called Shim, which can be updated regularly as new stuff comes out. And technically you can whitelist other certificates, too, but I have no idea how you might do that.
The problem is, there’s no real way to get around the reality that you’re trusting Microsoft to not be compromised, to not go evil, to not misuse their ubiquity and position of trust as a way to depress competition, etc. It’s a single point of failure that’s presents a massive and very attractive target to attackers, since it could be used to intentionally do what CrowdStrike did accidentally last week.
But OP might have other reasons in mind, I dunno.
And technically you can whitelist other certificates, too, but I have no idea how you might do that.
When you enter the UEFI somewhere there will be a Secure Boot section, there there is usually a way to either disable Secure Boot or to change it into “Setup Mode”. This “Setup Mode” allows enrolling new keys, I don’t know of any programs on Windows that can do it, but sbctl can do it and the systemd-boot bootloader both can enroll your own custom keys.
Definitely not for the “normie” then.
cmnybo@discuss.tchncs.de 1 month ago
To use secure boot correctly, you need disable or delete the keys that come preinstalled and add your own keys. Then you have to sign the kernel and any drivers yourself. It is possible to automate the signing the kernel and kernel modules though. Just make sure the private key is kept secure. If someone else gets a hold of it, they can create code that your computer will trust.
NekkoDroid@programming.dev 1 month ago
The kernel modules usually are signed with a different key. That key is created at build time and its pubic key is discarded after the build (and after the modules have been signed) and the kernel uses the private key to validate the modules IIRC. That is how Archlinux enables can somewhat support Secure Boot without the user needing to sign every kernel module or firmware file (it is also the reason why all the kernel packages aren’t reproducable).
ilinamorato@lemmy.world 1 month ago
In any case, not for the average person.
jabjoe@feddit.uk 1 month ago
Your want to store a copy of the private key on the encrypted machine so it can automatically sign kernel updates.