• cmnybo@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    22
    ·
    3 months ago

    To use secure boot correctly, you need disable or delete the keys that come preinstalled and add your own keys. Then you have to sign the kernel and any drivers yourself. It is possible to automate the signing the kernel and kernel modules though. Just make sure the private key is kept secure. If someone else gets a hold of it, they can create code that your computer will trust.

    • NekkoDroid@programming.dev
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      3 months ago

      The kernel modules usually are signed with a different key. That key is created at build time and its private key is discarded after the build (and after the modules have been signed) and the kernel uses the public key to validate the modules IIRC. That is how Archlinux enables can somewhat support Secure Boot without the user needing to sign every kernel module or firmware file (it is also the reason why all the kernel packages aren’t reproducible).

    • jabjoe@feddit.uk
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      Your want to store a copy of the private key on the encrypted machine so it can automatically sign kernel updates.