15

ad 1) MOK (Machine Owner Key) is about securing the boot process by only allowing approved OS components and drivers to run. MOK must be implemented by the "BIOS" - or some startup code inside the computer, anyway. The main idea is that only code which is signed is allowed to run while loading the operating system (OS). Once that is booted, the ...


10

As mentioned in the manpage, Unencrypted hibernation/suspend to swap are disallowed as the kernel image is saved to a medium that can then be accessed. Unencrypted hibernation stores the contents of the hibernated system’s memory as-is on disk. This allows an attacker to modify those contents while the system is hibernated, resulting in changes to the ...


5

For secure boot to work, your Hardware should support secure boot and your OS should support secure booting. For HW, you can check in UEFI setting menus and you need to add the certificates/keys provided by the OS For OS, you can check the support by following commands : [root@secureboot-guest ~]# cat /sys/kernel/security/securelevel If output of above ...


5

Flash the ISO on the usb key as you would normally do. Then: navigate to ~\EFI\boot\ rename BOOTx64.EFI as loader.efi download signed shim.efi in the same folder rename it as BOOTx64.EFI boot the thing and enroll from disk the ~\EFI\boot\loader.efi hash EDIT: relevant bug


4

First at all: generate own key openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \ -subj "/CN=Kernel Key" -outform DER -out kernel.der \ -keyout kernel.key Try to compile linux kernel with CONFIG_EFI_STUB and embed initramfs into it as described here: https://prosauce.org/blog/2015/10/31/booting-linux-securely, to sign modules ...


3

I had the same issue following the same procedure and couldn't figure out why it wasn't working, then i realized that the issue was running again vboxconfig after signing the modules since it would trigger the kernel modules rebuild: " vboxdrv.sh: Building VirtualBox kernel modules." At that point i just signed the modules and loaded them using ...


3

Yes, it only applies to older versions of Ubuntu. The current release supports secure boot and there's no reason to disable it.


3

For the most part an AV just scans files. It will remove malicious Windows payloads when running on Linux (and vice versa). The detection doesn't depend on the host architecture or operating system at all, as malware code is not being run by the AV at runtime. So, as long as you mount your Windows NTFS partition somewhere under Linux, you can tell your Linux ...


3

For installing it you will need to disable Secure Boot in the BIOS, but after installation you can re-enable it if you want.


3

I found great article which describes such setup: https://ruderich.org/simon/notes/secure-boot-with-grub-and-signed-linux-and-initrd tl;dr: Sign grub config and initrd with GPG, generate grub binary which will enforce checks and sign it with secureboot keys. Package for ubuntu which implements similar idea: https://github.com/JohnstonJ/ubuntu-secure-boot


3

Your OS Loader needs to include a copy of the public part (a.k.a. the certificate) of the key you'll be using to sign your own kernel. Any time that key changes, you will need to have your OS Loader re-signed by Microsoft. You might want to study the source code of the shimx64.efi Secure Boot shim bootloader that is used by many major distributions to handle ...


2

Following is the TYPICAL boot order for a secure boot supported Linux OS : Shim.efi is loaded BOOTX64.efi is loaded BOOTX64.efi requests for grubx64.efi grubx64.efi request for grub.cfg grub.cfg loads vmlinuz and initrd So, in order to support secure boot, you must have BOOTX64.efi signed with your keys. Register your PK(primary key), KEK (Key exchange ...


2

Aaargh - Ubuntu 16.04 version of efitools: 1.4.2. Latest version of efitools: 1.7.0. Problem solved!


2

The answer was very simply, run it as root sudo mokutil --import MOK.der


2

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key? No. You misunderstand the chain of trust. Earlier things need to verify later things. Later things can't meaningfully verify earlier things. ...


2

TLDR: Enter BIOS, this enabled the keyboard in MOK Manager for me. You don't need to change any setting there, you can directly exit it after entering it. I had the same problem after installing Linux Mint 20.1 on my Lenovo Legion 5 Pro 16ACH6H. After MOK Manager started it didn't recognize my keyboard. I had to shortly press the power button to turn it of. ...


2

Secure boot does not in itself protect against an attacker with physical access to the machine. I recommend using a password to protect against unauthorized access to the firmware setup. The primary goal of secure boot is to prevent malware from inserting compromised kernels and boot loaders. A user with physical access can enroll new public keys (i.e. store ...


1

With Fedora 34 and VirtualBox 6.1.22 the steps are as follows: Build VirtualBox modules sudo /sbin/vboxconfig Install openssl sudo dnf install openssl Create key and enroll it openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=My Name/" -nodes sudo mokutil --import MOK.der echo "...


1

The only Debian Secure Boot certificate I know of can be found here: https://dsa.debian.org/secure-boot-ca According to Secure Boot specifications, if you delete the current PK, Secure Boot should transition into "Setup Mode" which should allow you to edit all the key variables without signature requirements. If you plan to take control of the firmware-...


1

You should disable the secure boot. Booting an install media Note: The official installation image does not support Secure Boot (FS#53864). To successfully boot the installation medium you will need to disable Secure Boot. Secure Boot support was removed starting with archlinux-2016.06.01-dual.iso. At that time prebootloader was replaced with efitools, even ...


1

I know this questions is old, but since it's still unanswered, and this was a question I had, I figured I'd share what I'd found in my own searches. https://www.rodsbooks.com/efi-bootloaders/secureboot.html#using_signed I can't give detailed instructions as I never followed through with making my Debian live usb Secure Boot enabled, but this site should ...


1

As Linux does not support Secure Boot as of yet (without some kernel modification), there is no significant consequence of doing this. is using this "insecure" mode somehow making me more susceptible to any "attacks" or the like Maybe if you're using Windows, but if you care about security, then you wouldn't be using Windows in the first place. Linux is ...


1

In X.509v3 certificate lingo, a certificate extension can be specified as critical if the creator of the certificate (and/or the certifying authority) requires that whoever is validating this certificate must understand this extension or else treat this certificate as not valid. The "Basic constraints" extension is the most fundamental certificate extension:...


1

More and more Linux distributions are adding the necessary facilities for full support of Secure Boot. That can include include configuring Secure Boot with a custom certificate, and signing third-party modules using that certificate when installed using the distribution's standard procedure. If the provider of the third-party modules provides pre-signed ...


1

The efibootmgr step only configures the UEFI boot variables of your system to add that particular bootloader on that particular disk (identified by disk UUID in the GPT partition table header) in your system's boot order. It has nothing to do with Secure Boot. When preparing a UEFI-bootable removable media, you won't need that. For UEFI, a removable media ...


1

For starters, your computer is NOT BRICKED. Bricked implies you cannot restore functionality easily. Go back into the BIOS Utility (using whichever key is appropriate for your motherboard) and disable Secure Boot. You should then be able to boot from any medium your motherboard supports. If worst comes to worst and you cannot disable Secure Boot, use a ...


1

Check this guide, maybe it can help you. I can't find how to modify to install debian, because i'm not familiarized with debian. https://thanhsiang.org/faqing/node/221 If you get it, please share the solution.


1

Actually, the part that verifies Secure Boot signatures is open. It's a part of Intel's TianoCore. The problem is, when you buy off-the-shelf hardware there's no way to check what the hardware vendor actually put inside. But that's a general problem with PC firmware, not Secure Boot as such. The system-side of Secure Boot in Open Source operating systems ...


1

Closest thing to UEFI alternative is coreboot.


1

Grub appears to support signature verification using detached signatures. I suspect that's your answer.


Only top voted, non community-wiki answers of a minimum length are eligible