Secure Boot/en - Revision history

FuzzyBot: Updating to match new version of source page

2025-12-09T23:16:49Z

Updating to match new version of source page

@@ Line 3: / Line 3: @@
 Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.
 [[Category:Security]]
@@ Line 23: / Line 19: @@
 ...
 </syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
-If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined here.
+If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

FuzzyBot: Updating to match new version of source page

2025-12-09T22:22:42Z

Updating to match new version of source page

@@ Line 7: / Line 7: @@
 It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.
 [[Category:Security]]
 [[Category:Booting]]

FuzzyBot: Updating to match new version of source page

2025-12-08T23:20:53Z

Updating to match new version of source page

@@ Line 1: / Line 1: @@
 <languages/>
-Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.
+Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system is allowed to boot.
-Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.
+Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.
-On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
+On NixOS, Secure Boot can be enabled using the [[Lanzaboote]] or [[Limine]] projects.
-It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
+It is recommended to set a BIOS password and enable full disc encryption to prevent attacks which can bypass Secure Boot.
 [[Category:Security]]
 [[Category:Booting]]

FuzzyBot: Updating to match new version of source page

2025-10-07T20:55:16Z

Updating to match new version of source page

← Older revision		Revision as of 20:55, 7 October 2025
Line 4:		Line 4:
	Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.		Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.

	On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].		On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
			Alternatively, by using the [[Limine]] project.

			It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.

			== Lanzaboote ==
	Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.		Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.

Line 14:		Line 18:
	{{warning\|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}		{{warning\|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}

	== Requirements ==		=== Requirements ===

	The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:		The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:
Line 31:		Line 35:
	</syntaxHighlight>		</syntaxHighlight>

	~~It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.~~

	== Setup ==
			=== Setup ===

	Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].		Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].

	== Key management ==		=== Key management ===
	At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.		At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.

Line 44:		Line 48:
	{{Warning\|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}		{{Warning\|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}

	== Differences with `systemd-stub` ==		=== Differences with `systemd-stub` ===
	systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.		systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.

FuzzyBot: Updating to match new version of source page

2024-07-12T21:29:02Z

Updating to match new version of source page

← Older revision		Revision as of 21:29, 12 July 2024
Line 1:		Line 1:
			<languages/>
	Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.		Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.

FuzzyBot: Updating to match new version of source page

2024-07-12T21:06:45Z

Updating to match new version of source page

New page

Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.

Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.

On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].

Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.

<code>lzbt</code> is the command line that signs and installs the boot files on the ESP.

<code>stub</code> is a UEFI application that loads the kernel and initrd from the ESP, it's different from systemd-stub, see below to see precise differences.

{{warning|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}

== Requirements ==

The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:

<syntaxHighlight lang=console>
$ bootctl status
System:
Firmware: UEFI 2.70 (Lenovo 0.4720)
Secure Boot: disabled (disabled)
TPM2 Support: yes
Boot into FW: supported

Current Boot Loader:
Product: systemd-boot 251.7
...
</syntaxHighlight>

It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.

== Setup ==

Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].

== Key management ==
At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.

In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).

{{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}

== Differences with `systemd-stub` ==
systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.

Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.

Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
[[Category:Security]]
[[Category:Booting]]