Secure Boot: Difference between revisions
No edit summary |
m Replacing dead link with docs from the GitHub repository. |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 8: | Line 8: | ||
<!--T:3--> | <!--T:3--> | ||
On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote]. | On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote]. | ||
Alternatively, by using the [[Limine]] project. | |||
<!--T:12--> | |||
It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot. | |||
<!--T:4--> | <!--T:4--> | ||
== Lanzaboote == | |||
Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>. | Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>. | ||
| Line 22: | Line 27: | ||
{{warning|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}} | {{warning|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}} | ||
== Requirements == <!--T:8--> | === Requirements === <!--T:8--> | ||
<!--T:9--> | <!--T:9--> | ||
| Line 42: | Line 47: | ||
</syntaxHighlight> | </syntaxHighlight> | ||
== Setup == <!--T:13--> | |||
=== Setup === <!--T:13--> | |||
<!--T:14--> | <!--T:14--> | ||
Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/ | Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/getting-started/prepare-your-system.md Quick Start guide]. | ||
<!--T:15--> | <!--T:15--> | ||
== Key management == | === Key management === | ||
At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files. | At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files. | ||
| Line 61: | Line 65: | ||
<!--T:18--> | <!--T:18--> | ||
== Differences with `systemd-stub` == | === Differences with `systemd-stub` === | ||
systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system. | systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system. | ||