Secure Boot/ru: Difference between revisions

Line 9:

Рекомендуется включить пароль BIOS и полное шифрование диска, чтобы предотвратить атаки на UEFI и Secure Boot.

[[Category:Security]]

[[Category:Booting]]

</div>

== Checking Secure Boot status ==

The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">

$ bootctl status

System:

Firmware: UEFI 2.80 (American Megatrends 5.25)

Firmware Arch: x64

Secure Boot: enabled (user)

TPM2 Support: yes

Measured UKI: yes

Boot into FW: supported

...

</syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.

If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined here.

</div>

@@ Line 9: / Line 9: @@
 Рекомендуется включить пароль BIOS и полное шифрование диска, чтобы предотвратить атаки на UEFI и Secure Boot.
+<div lang="en" dir="ltr" class="mw-content-ltr">
+[[Category:Security]]
+[[Category:Booting]]
+</div>
+<div lang="en" dir="ltr" class="mw-content-ltr">
+== Checking Secure Boot status ==
+The easiest way to check if your machine has Secure Boot enabled is through the use of [[Systemd]]'s <code>bootctl</code>. There is no need to be using [[Systemd/boot|systemd-boot]] as your bootloader for this command to work. <syntaxhighlight lang="console">
+$ bootctl status
+System:
+    Firmware: UEFI 2.80 (American Megatrends 5.25)
+    Firmware Arch: x64
+    Secure Boot: enabled (user)
+    TPM2 Support: yes
+    Measured UKI: yes
+    Boot into FW: supported
+...
+</syntaxhighlight>The system above has secure boot enabled and enforced. Other values include <code>disabled (setup)</code> for Setup Mode, <code>disabled (disabled)</code> or <code>disabled (unsupported)</code>. The unsupported tag only appears if your device firmware does not support Secure Boot at all.
+If you see <code>disabled (disabled)</code>, this means you will need to enable Secure Boot in your UEFI firmware settings before proceeding to use one of the projects outlined here.
+</div>