Secure Boot - Revision history

Ben9986: Marked this version for translation

2025-12-09T23:16:46Z

Marked this version for translation

← Older revision		Revision as of 23:16, 9 December 2025
Line 26:		Line 26:
	If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.		If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

			<!--T:23-->
	== Enabling Secure Boot on NixOS ==		== Enabling Secure Boot on NixOS ==
	On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.		On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.

			<!--T:24-->
	For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:		For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:

			<!--T:25-->
	# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.		# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
	# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.		# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
	# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.		# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.

			<!--T:26-->
	== See Also ==		== See Also ==
	[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.		[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.

Ben9986: Add "Enabling Secure Boot on NixOS" section

2025-12-09T23:15:41Z

Add "Enabling Secure Boot on NixOS" section

@@ Line 6: / Line 6: @@
 <!--T:2-->
 Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.
 <!--T:21-->
@@ Line 30: / Line 24: @@
 ...
 </syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
-If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined here. </translate>
+If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

Ben9986: Marked this version for translation

2025-12-09T22:22:40Z

Marked this version for translation

← Older revision		Revision as of 22:22, 9 December 2025
Line 13:		Line 13:
	It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.		It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.

			<!--T:21-->
	[[Category:Security]]		[[Category:Security]]
	[[Category:Booting]]		[[Category:Booting]]

			<!--T:22-->
	== Checking Secure Boot status ==		== Checking Secure Boot status ==
	The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot\|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">		The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot\|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">

Ben9986: Add "Checking Secure Boot Status" section

2025-12-09T22:21:17Z

Add "Checking Secure Boot Status" section

@@ Line 12: / Line 12: @@
 <!--T:12-->
 It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.
 [[Category:Security]]
 [[Category:Booting]]
 </translate>

Ben9986: Move Lanzaboote section to its own page. Fix grammar on remaining secure boot info. Minor wording change to put Lanzaboote and Limine on the same level

2025-12-08T23:18:25Z

Move Lanzaboote section to its own page. Fix grammar on remaining secure boot info. Minor wording change to put Lanzaboote and Limine on the same level

@@ Line 2: / Line 2: @@
 <translate>
 <!--T:1-->
-Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.
+Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system is allowed to boot.
 <!--T:2-->
-Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.
+Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.
 <!--T:3-->
-On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
+On NixOS, Secure Boot can be enabled using the [[Lanzaboote]] or [[Limine]] projects.
 <!--T:12-->
-It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
+It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.
 [[Category:Security]]
 [[Category:Booting]]
 </translate>

Nullptrs: Replacing dead link with docs from the GitHub repository.

2025-11-30T06:23:10Z

Replacing dead link with docs from the GitHub repository.

← Older revision		Revision as of 06:23, 30 November 2025
Line 52:		Line 52:

	<!--T:14-->		<!--T:14-->
	Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/~~QUICK_START~~.md Quick Start guide].		Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/getting-started/prepare-your-system.md Quick Start guide].

	<!--T:15-->		<!--T:15-->

Ardenet: Marked this version for translation

2025-10-07T20:55:14Z

Marked this version for translation

← Older revision		Revision as of 20:55, 7 October 2025
Line 14:		Line 14:
	It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.		It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.

			<!--T:4-->
	== Lanzaboote ==		== Lanzaboote ==
	~~<!--T:4-->~~
	Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.		Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.

0x4A6F: Move Limine implementation specifics to existing page and removed opinionated preference for Limine

2025-08-05T20:28:07Z

Move Limine implementation specifics to existing page and removed opinionated preference for Limine

@@ Line 7: / Line 7: @@
 Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.
-There are at present two ways to enable Secure Boot for NixOS. The first is by using [[Limine]]. This has the advantage of being entirely in tree in nixpkgs.
+<!--T:3-->
+On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
-Secondly, one can use the [https://github.com/nix-community/lanzaboote Lanzaboote] project.
+Alternatively, by using the [[Limine]] project.
 <!--T:12-->
 It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
-== Limine ==
+== Lanzaboote ==
 <!--T:4-->
 Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.

Delliott at 11:26, 4 August 2025

2025-08-04T11:26:51Z

← Older revision		Revision as of 11:26, 4 August 2025
Line 27:		Line 27:
	Enable Secure Boot Setup Mode. This usually involves entering the BIOS and selecting an option to do so. On some BIOS implementations, there is not an explicit option to do so, but it will enter setup mode if one clears all Secure Boot keys.		Enable Secure Boot Setup Mode. This usually involves entering the BIOS and selecting an option to do so. On some BIOS implementations, there is not an explicit option to do so, but it will enter setup mode if one clears all Secure Boot keys.

	Now, run <code>sbctl enroll-keys -m -f.</code> to actually enroll your keys.		Now, run <code>sbctl enroll-keys -m -f</code> to actually enroll your keys.

	You can now rebuild with <code>boot.loader.limine.secureBoot.enable</true> set to true, and disable Secure Boot setup mode.		You can now rebuild with <code>boot.loader.limine.secureBoot.enable</true> set to true, and disable Secure Boot setup mode.

Delliott at 11:26, 4 August 2025

2025-08-04T11:26:26Z

← Older revision		Revision as of 11:26, 4 August 2025
Line 7:		Line 7:
	Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.		Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.

	<!--T:3-->		There are at present two ways to enable Secure Boot for NixOS. The first is by using [[Limine]]. This has the advantage of being entirely in tree in nixpkgs.
	~~On NixOS,~~ Secure Boot ~~can be enabled via~~ the ~~project~~ [https://~~github~~.~~com~~/~~nix~~-~~community~~/~~lanzaboote Lanzaboote]~~.
			Secondly, one can use the [https://github.com/nix-community/lanzaboote Lanzaboote] project.

			<!--T:12-->
			It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.

			== Limine ==
			Limine Secure Boot support is principally controlled by the [https://search.nixos.org/options?channel=unstable&show=boot.loader.limine.secureBoot.enable&query=boot.loader.limine.secureBoot.enable module options].

			To enable Secure Boot, first switch to Limine as your bootloader. You may find the existing documentation for both [[Limine]] and [[Bootloader]] helpful.

			Then

			Add <code>sbctl</code> to you systems packages. It must be installed on a system level.

			Generate keys with <core>sbctl create-keys</code>

			Enable Secure Boot Setup Mode. This usually involves entering the BIOS and selecting an option to do so. On some BIOS implementations, there is not an explicit option to do so, but it will enter setup mode if one clears all Secure Boot keys.

			Now, run <code>sbctl enroll-keys -m -f.</code> to actually enroll your keys.

			You can now rebuild with <code>boot.loader.limine.secureBoot.enable</true> set to true, and disable Secure Boot setup mode.

			If this has been successful, you can check using <code>bootctl status</code>

			<syntaxHighlight lang=console>
			$ bootctl status
			systemd-boot not installed in ESP.
			System:
			Firmware: n/a (n/a)
			Firmware Arch: x64
			Secure Boot: enabled (user)
			...
			</syntaxHighlight>


	<!--T:4-->		<!--T:4-->
			== Lanzaboote ==
	Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.		Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.

Line 22:		Line 57:
	{{warning\|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}		{{warning\|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}

	== Requirements == <!--T:8-->		=== Requirements === <!--T:8-->

	<!--T:9-->		<!--T:9-->
Line 42:		Line 77:
	</syntaxHighlight>		</syntaxHighlight>

	~~<!--T:12-->~~
	~~It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.~~

	== Setup == <!--T:13-->
			=== Setup === <!--T:13-->

	<!--T:14-->		<!--T:14-->
Line 51:		Line 85:

	<!--T:15-->		<!--T:15-->
	== Key management ==		=== Key management ===
	At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.		At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.

Line 61:		Line 95:

	<!--T:18-->		<!--T:18-->
	== Differences with `systemd-stub` ==		=== Differences with `systemd-stub` ===
	systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.		systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.