Secure Boot/fr: Difference between revisions

Latest revision as of 23:16, 9 December 2025

Le démarrage sécurisé est habituellement associé à la capacité d'un micrologiciel de plateforme de vérifier les composants de démarrage et de s'assurer que seul votre propre système peut démarrer.

Le démarrage sécurisé est implémenté de multiple façons. La plus connue est le démarrage sécurisé UEFI qui repose sur le micrologiciel de plateforme UEFI, mais d'autres implémentations existent sur les systèmes embarqués.

Checking Secure Boot status

The easiest way to check if your machine has Secure Boot enabled is through the use of Systemd's bootctl. There is no need to be using systemd-boot as your bootloader for this command to work.

$ bootctl status
System:
    Firmware: UEFI 2.80 (American Megatrends 5.25)
    Firmware Arch: x64
    Secure Boot: enabled (user)
    TPM2 Support: yes
    Measured UKI: yes
    Boot into FW: supported
...

The system above has secure boot enabled and enforced. Other values include disabled (setup) for Setup Mode, disabled (disabled) or disabled (unsupported). The unsupported tag only appears if your device firmware does not support Secure Boot at all.

If you see disabled (disabled), this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

Enabling Secure Boot on NixOS

On NixOS, there are currently two main ways to enable Secure Boot, Lanzaboote and Limine. See their respective wiki pages for step by step instructions on each.

For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:

The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.^[1] However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.

@@ Line 1: / Line 1: @@
+<languages/>
 Le démarrage sécurisé est habituellement associé à la capacité d'un micrologiciel de plateforme de vérifier les composants de démarrage et de s'assurer que seul votre propre système peut démarrer.
@@ Line 4: / Line 5: @@
 <div lang="en" dir="ltr" class="mw-content-ltr">
-On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
+[[Category:Security]]
-</div>
+[[Category:Booting]]
+</div>
-Lanzaboote dispose de deux composants: <code>lzbt</code> et <code>stub</code>.
+<div lang="en" dir="ltr" class="mw-content-ltr">
+== Checking Secure Boot status ==
-<code>lzbt</code> est la ligne de commande qui signe et installe les fichiers de démarrage sur l'ESP.
+The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">
-<code>stub</code> est une application UEFI qui charge le noyau et initrd depuis l'ESP. Elle diffère de systemd-stub, voir plus bas pour des précisions.
-{{warning|Lanzaboote est en développement et nécessite de réunir des pré-requis et de prendre des précautions. Il est pour le moment uniquement disponible pour nixos-unstable. Pour plus d'informations, voir le dépôt GitHub ou le guide de démarrage rapide.}}
-<span id="Requirements"></span>
-== Pré-requis ==
-L'implémentation du démarrage sécurisé de Lanzaboote nécessite un système installé en mode UEFI avec systemd-boot activé. Ceci peut être vérifier en exécutant <code>bootctl status</code>:
-<syntaxHighlight lang=console>
 $ bootctl status
 System:
-     Firmware: UEFI 2.70 (Lenovo 0.4720)
+    Firmware: UEFI 2.80 (American Megatrends 5.25)
-  Secure Boot: disabled (disabled)
+    Firmware Arch: x64
- TPM2 Support: yes
+    Secure Boot: enabled (user)
- Boot into FW: supported
+    TPM2 Support: yes
+    Measured UKI: yes
-Current Boot Loader:
+    Boot into FW: supported
-      Product: systemd-boot 251.7
 ...
-</syntaxHighlight>
+</syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
+If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.
+</div>
 <div lang="en" dir="ltr" class="mw-content-ltr">
-It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
+== Enabling Secure Boot on NixOS ==
+On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.
 </div>
 <div lang="en" dir="ltr" class="mw-content-ltr">
-== Setup ==
+For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:
 </div>
 <div lang="en" dir="ltr" class="mw-content-ltr">
-Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].
+# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
-</div>
+# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
+# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.
+</div>
 <div lang="en" dir="ltr" class="mw-content-ltr">
-== Key management ==
+== See Also ==
-At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.
+[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.
 </div>
-<div lang="en" dir="ltr" class="mw-content-ltr">
+<references />
-In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).
-</div>
-<div lang="en" dir="ltr" class="mw-content-ltr">
-{{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}
-</div>
-<div lang="en" dir="ltr" class="mw-content-ltr">
-== Differences with `systemd-stub` ==
-systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.
-</div>
-<div lang="en" dir="ltr" class="mw-content-ltr">
-Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.
-</div>
-<div lang="en" dir="ltr" class="mw-content-ltr">
-Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
-[[Category:Security]]
-[[Category:Booting]]
-</div>