Jump to content

Secure Boot: Difference between revisions

From Official NixOS Wiki
← Older edit
VisualWikitext
No edit summary
Ben9986 (talk | contribs)
25 edits
Marked this version for translation
 
(7 intermediate revisions by 4 users not shown)
Line 2: Line 2:
<translate>
<translate>
<!--T:1-->
<!--T:1-->
Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system to boot.  
Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system is allowed to boot.  


<!--T:2-->
<!--T:2-->
Secure Boot has multiple implementations, the most known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but others implementations can exist on embedded systems.  
Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.  


There are at present two ways to enable Secure Boot for NixOS. The first is by using [[Limine]]. This has the advantage of being entirely in tree in nixpkgs.
<!--T:21-->
[[Category:Security]]
[[Category:Booting]]


Secondly, one can use the [https://github.com/nix-community/lanzaboote Lanzaboote] project.
<!--T:22-->
 
== Checking Secure Boot status ==
<!--T:12-->
The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">
It is recommended to enable a BIOS password and full disc encryption to prevent attacks against UEFI and Secure Boot.
 
== Limine ==
Limine Secure Boot support is principally controlled by the [https://search.nixos.org/options?channel=unstable&show=boot.loader.limine.secureBoot.enable&query=boot.loader.limine.secureBoot.enable module options].
 
To enable Secure Boot, first switch to Limine as your bootloader. You may find the existing documentation for both [[Limine]] and [[Bootloader]] helpful.
 
Then
 
Add <code>sbctl</code> to you systems packages. It must be installed on a system level.
 
Generate keys with <core>sbctl create-keys</code>
 
Enable Secure Boot Setup Mode. This usually involves entering the BIOS and selecting an option to do so. On some BIOS implementations, there is not an explicit option to do so, but it will enter setup mode if one clears all Secure Boot keys.
 
Now, run <code>sbctl enroll-keys -m -f</code> to actually enroll your keys.
 
You can now rebuild with <code>boot.loader.limine.secureBoot.enable</true> set to true, and disable Secure Boot setup mode.  
 
If this has been successful, you can check using <code>bootctl status</code>
 
<syntaxHighlight lang=console>
$ bootctl status
$ bootctl status
systemd-boot not installed in ESP.
System:
System:
      Firmware: n/a (n/a)
    Firmware: UEFI 2.80 (American Megatrends 5.25)
Firmware Arch: x64
    Firmware Arch: x64
  Secure Boot: enabled (user)
    Secure Boot: enabled (user)
    TPM2 Support: yes
    Measured UKI: yes
    Boot into FW: supported
...
...
</syntaxHighlight>
</syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.


<!--T:23-->
== Enabling Secure Boot on NixOS ==
On NixOS, there are currently two main ways to enable Secure Boot, [[Lanzaboote]] and [[Limine]]. See their respective wiki pages for step by step instructions on each.


<!--T:4-->
<!--T:24-->
== Lanzaboote ==
For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:
Lanzaboote has two components: <code>lzbt</code> and <code>stub</code>.


<!--T:5-->
<!--T:25-->
<code>lzbt</code> is the command line that signs and installs the boot files on the ESP.
# The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
# Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
# Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.<ref>https://habr.com/ru/articles/446238/</ref> However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.  


<!--T:6-->
<!--T:26-->
<code>stub</code> is a UEFI application that loads the kernel and initrd from the ESP, it's different from systemd-stub, see below to see precise differences.
== See Also ==
 
[https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot Arch Wiki/Secure Boot] Extensive information on Secure Boot including using UKIs.  
<!--T:7-->
</translate>
{{warning|Lanzaboote is still in development and requires some prerequisites and precautions. Currently it's only available for nixos-unstable. For more information, please see the GitHub repository or the Quick Start guide.}}
 
=== Requirements === <!--T:8-->
 
<!--T:9-->
The Secure Boot implementation of Lanzaboote requires a system installed in UEFI mode together with systemd-boot enabled. This can be checked by running <code>bootctl status</code>:


<!--T:10-->
<references />
<syntaxHighlight lang=console>
$ bootctl status
System:
    Firmware: UEFI 2.70 (Lenovo 0.4720)
  Secure Boot: disabled (disabled)
TPM2 Support: yes
Boot into FW: supported
 
<!--T:11-->
Current Boot Loader:
      Product: systemd-boot 251.7
...
</syntaxHighlight>
 
 
 
=== Setup === <!--T:13-->
 
<!--T:14-->
Follow the instructions in the [https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md Quick Start guide].
 
<!--T:15-->
=== Key management ===
At the time of writing, Lanzaboote offers only local storage of the keyring, otherwise, it is not possible to rebuild the system and sign the new resulting files.
 
<!--T:16-->
In the future, Lanzaboote will offer two new signature backends: remote signing (an HTTP server which receives signature requests and answers with signatures) and PKCS#11-based signing (that is, bringing an HSM-like device, e.g. YubiKey, NitroKey, etc.).
 
<!--T:17-->
{{Warning|Key management is a hard problem which is out of scope for Lanzaboote project, many recipes exist and there is no single perfect solution. Taking the time to learn how to key manage and figure out the right level of threat protection is crucial to achieve an effective boot protection.}}
 
<!--T:18-->
=== Differences with `systemd-stub` ===
systemd and distribution upstream have an existing solution called `systemd-stub` but this is not a realistic solution for NixOS as there's too many generations on a system.
 
<!--T:19-->
Using `systemd-stub`, a kernel and an initrd has to be duplicated for '''each generation''', using Lanzaboote's stub, a kernel and initrd can be '''deduplicated''' without compromising on the security.
 
<!--T:20-->
Tracking the feature parity with `systemd-stub` can be done in this issue: https://github.com/nix-community/lanzaboote/issues/94.
[[Category:Security]]
[[Category:Booting]]
</translate>

Latest revision as of 23:16, 9 December 2025

Other languages:

Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system is allowed to boot.

Secure Boot has multiple implementations, the most well known one is UEFI Secure Boot, which relies on the UEFI platform firmware, but other implementations can exist on embedded systems.

Checking Secure Boot status

The easiest way to check if your machine has Secure Boot enabled is through the use of Systemd's bootctl. There is no need to be using systemd-boot as your bootloader for this command to work. 

$ bootctl status
System:
    Firmware: UEFI 2.80 (American Megatrends 5.25)
    Firmware Arch: x64
    Secure Boot: enabled (user)
    TPM2 Support: yes
    Measured UKI: yes
    Boot into FW: supported
...

The system above has secure boot enabled and enforced. Other values include disabled (setup) for Setup Mode, disabled (disabled) or disabled (unsupported). The unsupported tag only appears if your device firmware does not support Secure Boot at all.

If you see disabled (disabled), this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined below.

Enabling Secure Boot on NixOS

On NixOS, there are currently two main ways to enable Secure Boot, Lanzaboote and Limine. See their respective wiki pages for step by step instructions on each.

For Secure Boot to be most effective, there are certain conditions which should also be met. The most important are:

  1. The UEFI firmware is protected by a strong password to prevent an untrusted drive from being booted or Secure Boot being disabled.
  2. Full disk encryption is enabled so that your drive cannot simply be read by putting it another another machine.
  3. Ideally, default OEM/third party keys are not in use as these have been shown to weaken the security of Secure Boot significantly.[1] However, this may brick some devices which use Microsoft-signed OpROMS for certain hardware during the boot process, particularly some laptops, so you must be certain before removing them. It may be impossible to fix if, for example, the GPU relies on these OpROMS.

See Also

Arch Wiki/Secure Boot Extensive information on Secure Boot including using UKIs.

  1. ↑ https://habr.com/ru/articles/446238/
Retrieved from "https://wiki.nixos.org/w/index.php?title=Secure_Boot&oldid=28962"