|
|
| (21 intermediate revisions by 3 users not shown) |
| Line 5: |
Line 5: |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr"> | | <div lang="en" dir="ltr" class="mw-content-ltr"> |
| On NixOS, Secure Boot can be enabled via the project [https://github.com/nix-community/lanzaboote Lanzaboote].
| | [[Category:Security]] |
| </div>
| | [[Category:Booting]] |
| | |
| Lanzaboote состоит из двух компонентов:
| |
| <code>lzbt</code> and <code>stub</code>.
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| <code>lzbt</code> is the command line that signs and installs the boot files on the ESP.
| |
| </div>
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| <code>stub</code> is a UEFI application that loads the kernel and initrd from the ESP, it's different from systemd-stub, see below to see precise differences.
| |
| </div>
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| {{warning|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}
| |
| </div>
| |
| | |
| <span id="Requirements"></span>
| |
| == Требования ==
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:
| |
| </div> | | </div> |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr">
| | == Проверка состояния безопасной загрузки == |
| <syntaxHighlight lang=console> | | самый лёгкий способ проверить, включена ли безопасная загрузка на вашем компьютере - использовать <code>bootctl</code> от [[Systemd]]. Необязательно использовать [[Systemd/boot|systemd-boot]] как ваш основной загрузчик, чтобы эта команда работала. |
| | <syntaxhighlight lang="console"> |
| $ bootctl status | | $ bootctl status |
| System: | | System: |
| Firmware: UEFI 2.70 (Lenovo 0.4720)
| | Firmware: UEFI 2.80 (American Megatrends 5.25) |
| Secure Boot: disabled (disabled)
| | Firmware Arch: x64 |
| TPM2 Support: yes
| | Secure Boot: enabled (user) |
| Boot into FW: supported
| | TPM2 Support: yes |
| </div>
| | Measured UKI: yes |
| | | Boot into FW: supported |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| Current Boot Loader:
| |
| Product: systemd-boot 251.7
| |
| ... | | ... |
| </syntaxHighlight> | | </syntaxhighlight> |
| </div> | | В продемонстрированной выше системе включена и используется безопасная загрузка. Другие значения включают <code>disabled (setup)</code> для режима настройки, <code>disabled (disabled)</code> или <code>disabled (unsupported)</code>. Тэг unsupported появляется только если ваша материнская плата или её программное обеспечение не поддерживает безопасную загрузку. |
| | | Если вы видите <code>disabled (disabled)</code>, это значит, что вам нужно включить безопасную загрузку в настройках UEFI перед тем как продолжить, чтобы использовать один из описанных ниже проектов |
| <div lang="en" dir="ltr" class="mw-content-ltr"> | |
| It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
| |
| </div> | |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr">
| | == Включение безопасной загрузки на NixOS == |
| == Setup ==
| | В NixOS на данный момент имеется два способа включения безопасной загрузки, [[Lanzaboote]] и [[Limine]]. Пошаговые инструкции по каждому из них вы найдете на соответствующих страницах вики. |
| </div>
| |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr">
| | Чтобы безопасная загрузка была максимально эффективна, должны быть соблюдены определённые условия. Самими важными являются: |
| Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].
| |
| </div>
| |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr"> | | <div lang="en" dir="ltr" class="mw-content-ltr"> |
| == Key management ==
| | # The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled. |
| At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.
| | # Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine. |
| </div> | | # Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS. |
| | </div> |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr"> | | <div lang="en" dir="ltr" class="mw-content-ltr"> |
| In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).
| | == See Also == |
| </div>
| | [https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs. |
| | | </div> |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| {{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}
| |
| </div>
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| == Differences with `systemd-stub` ==
| |
| systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.
| |
| </div> | |
|
| |
|
| <div lang="en" dir="ltr" class="mw-content-ltr"> | | <references /> |
| Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.
| |
| </div>
| |
| | |
| <div lang="en" dir="ltr" class="mw-content-ltr">
| |
| Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
| |
| [[Category:Security]]
| |
| [[Category:Booting]]
| |
| </div>
| |