Plaintext
jxself.org
UEFI Secure Boot Home
Wed, 7 Aug 2019 Linux-libre
My kernel packages for 32- and 64-bit x86 now support UEFI Secure Boot.
GitWeb
I've generated a Machine Owner Key (MOK) for this purpose. People that have
machines that support Secure Boot, and that want to use it, can enroll this key on their How To
computer to verify the kernel when booting.
Articles
It's possible to enable Secure Boot on a system that already has an existing Linux-
libre installation. This is a multi-step process.
RSS Feed
First you should make sure that your GNU/Linux distro and your hardware really do
support UEFI Secure Boot. About Me
If they do, and you want to use it, you should fetch and install the key with which the
kernels are signed:
Contact Me
wget https://jxself.org/linux-libre-mok.cer GPL enforced
Check that it's the right one. The fingerprint is provided below as both SHA-1 and
SHA-256 because SHA-256 is more secure but the mokutil program and MOK If you appreciate any of the things I
Manager will show the SHA-1. Providing both here allows for easy comparison. am doing you can make a donation.
openssl x509 -noout -fingerprint -sha1 -inform der -in linux-
libre-mok.cer
EA:6D:07:60:A3:DC:1E:8A:BF:41:F4:4A:F1:FF:D1:2E:C8:63:E5:7B
openssl x509 -noout -fingerprint -sha256 -inform der -in linux-
libre-mok.cer
5A:39:E0:D2:DD:1E:EF:F4:DB:D3:0A:F4:1E:CA:72:7E:B7:E7:FC:1F:5A:4B:88:CC:CE:3B:52:0C:D9:66:76:FF
As long as it matches, enroll the key. Note that enrolling a key is a multistep process.
mokutil is used to start the process but the change can only be confirmed at boot
time. First:
sudo mokutil --import linux-libre-mok.cer
You will be asked for a temporary password for this enrollment request. Remember
this password; MOK Manager will ask you for it later.
Check that it's prepared to be enrolled:
sudo mokutil --list-new
Then restart:
sudo reboot
The MOK Manager screen should appear after your UEFI boot screen but before your
GNU/Linux distro boots to confirm that the key should be added. Follow the on-screen
instructions to finish enrolling the key.
Once completed you can check that it was enrolled:
sudo mokutil --list-enrolled
Once the key has been enrolled you should also enable validation in the shim
bootloader:
sudo mokutil --enable-validation
Once again you will be asked for a temporary password. Make sure to remember it.
Restart again:
sudo reboot
The MOK Manager screen should appear once again. Follow the on-screen
instructions to enable validation.
As the last step, make sure that Secure Boot is enabled at the firmware level:
mokutil --sb-state
You should see:
SecureBoot enabled
If not please reboot and modify your UEFI firmware settings to turn on Secure Boot.
There are many different user interfaces and I can't cover them all. It may be
necessary to refer to the information about the make and model of your computer to
finalize Secure Boot.
Copyright © 2019 Jason Self. See license.shtml for license conditions. Please copy and share.