11 ms·
Debian 9 not including support for UEFI Secure Boot
- ergo14 9y agoA pity - however I always disabled UEFI boot for my partitions... At least the good news is that the release is very near now.
- btgeekboy 9y agoOut of curiosity, why have you disabled it?
- Esau 9y agoI can't speak for OP but for me, I disable it because UEFI is an over-engineered mess that solves no problems for me.
- swiley 9y agoI love EFI! No more bootloaders!!!! Just rename your bzimage bzimage.efi, put it on a FAT fs, and select it with the firmware!
- alerighi 9y agoYes, and if for some reason then you clear the CMOS (BIOS configuration error, discharged battery, or whatever) you can no longer boot your PC because the boot information regarding the parameters to pass to the kernel is lost...
- floatboth 9y agoThat's why EFI variables should never be used. Just put whatever you want to boot into BOOTX64.EFI!
- hollander 9y agoAh the lovely naming hacks of UEFI. :-P I remember the troubles it took to boot Ubuntu on a Lenovo laptop because the EFI was 32 bit, while the system supported 64 bit.
- floatboth 9y agoYeah, old devices with 32-bit EFI… I have a Mac mini 2006 (upgraded to 2007). I compiled GRUB 2 for 32-bit EFI and it boots 64-bit FreeBSD from ZFS just fine :)
- swiley 9y agoThen just select it again? It's maybe 4 key presses unless you have a lot of .efi files laying around...
- JdeBP 9y agoEFI variables are not stored in the "CMOS", note (misnomer that that is). They are stored in flash RAM. * https://superuser.com/a/708332/38062 https://superuser.com/a/708332/38062
- abrowne 9y agoYou realize that in most cases "disabling UEFI" is really enabling a poorly-tested emulation of BIOS running on top of UEFI?
- int_19h 9y agoNot OP, but I also disable it on my home boxes that run Linux, mainly because 1) I know how the BIOS boot process works very well (and I kinda like knowing how things work, especially on critical paths that can get broken sometimes), and 2) I know how to set up Linux with BIOS boot because I did it so many times before. So I guess it boils down to "it's not broken for me, why change it?"
- bitwize 9y agoWhy would you do this? I doubt support for legacy mode will exist for much longer, either on motherboards or in distributions.
- int_19h 9y agoI would be surprised if distros got rid of it anytime soon. There's still a vast amount of relatively old non-UEFI hardware that people still use, and it's not going to suddenly change, because that hardware is plainly "good enough" for all practical purposes - so it's only going to be replaced if and when it fails. Even Windows hasn't so much as announced a switch to UEFI boot only, and Linux generally supports old hardware for much longer. So I wouldn't be surprised if it's still there in a decade - maybe not in all distros, but at least in some mainstream ones, especially more "hackerish" like Arch and Gentoo. As for motherboards, I doubt they'd get rid of it that soon, either. If only because having it there means that OEMs can ship devices with FreeDOS preinstalled to dodge the licensing fees. As I understand, legacy mode is basically just an emulation layer on top of UEFI, and it's fairly cheap (and already there). This is different for mobile and tablet devices like Surface, which aren't really advertised as general-purpose PCs in the first place. Since they're only expected to run whatever's preinstalled on them, so long as it only needs UEFI, they will likely ship with UEFI only. But I'm not running Linux on such things.
- floatboth 9y agoBecause it's old. Because it's painfully slow. Because messing with a FAT partition feels much better than messing with MBR or whatever weird "boot partition" thing that happens in a "legacy-BIOS-plus-GPT" situation.
- _jal 9y agoUEFI, or Secure Boot? I boot UEFI, but have SB disabled, so this will have zero impact on my systems.
- cmurf 9y agoUEFI cannot be disabled. The "disable" UI is a big fat fucking lie by morons who think everyone else is a moron, therefore they concoct big fat fucking lies like this one. What they've done with the "disable" option is enable a compatibility support module for UEFI to present a faux-BIOS to the operating system. The point of a CSM was to provide backward compatibility to legacy operating system that have no idea how to talk to UEFI, but can interface with BIOS. So all you're doing is using UEFI and also a fake BIOS layer. But they call this "disabling" UEFI. Hence it's a big fat fucking lie. The things liars tell people who they think are stupid. So, you know, you should be a little pissed at people who think you're a moron that you need to be lied to. Ohhhhh but we were just trying to make things easier to understand, we were just trying to be nice! Well, guess what? Go fuck yourself. Stop being nice. Try being honest.
- sctb 9y agoWe ban accounts that continue to violate the guidelines like this. Please stop. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- cmurf 9y agoI don't see a single item in the guidelines that applies to what I wrote. My derogatory comments were clearly directed at the manufacturers of firmware who lie to users about how the firmware functions. Those lies are far worse and more damaging to users than my appropriate and diplomatic ad hominem attack. I haven't written anything I would not say to any product or marketing manager or CEO of any of the firmware manufacturers, to their face, should the opportunity present itself.
- giancarlostoro 9y agoAnyone know what other distros support UEFI? I hope Debian supports it in a later release I wouldn't mind going back to my second distro ever (first one was Slackware, not an option for me these days).
- blcknight 9y agoAFAIK both Fedora and Ubuntu support it.
- btgeekboy 9y agoI can vouch that Fedora does, decently well. My only issue is that if you're using Nvidia-vended graphics drivers, you'll need to sign the kernel modules after every kernel update & subsequent akmod build. And since you don't have RedHat's key, you need to generate your own key, upload it into your BIOS/EFI control panel, and run sign-file against each of the .ko that akmod generates. If you don't do this before rebooting, the drivers will fail to load and GDM will crash. This is a rough overview of the process, though it's slightly outdated: http://www.pellegrino.link/2015/11/29/signing-nvidia-proprietary-driver-on-fedora.html http://www.pellegrino.link/2015/11/29/signing-nvidia-proprie... (I believe there's 4 modules to sign now.)
- cmurf 9y agoFedora is using their own patches. Upstream are basically doing the ignorant asshole "ostrich maneuver" and refusing to settle the Secure Boot issue by upstreaming a solution. So every distro has their own way of doing it and it's not sustainable is basically how I view Debian's decision. https://lists.fedoraproject.org/archives/list/kernel@lists.fedoraproject.org/message/SCET66IBFYIKMONJ2UHKHCPU7VFOJKWS/ https://lists.fedoraproject.org/archives/list/kernel@lists.f...
- deleted 9y ago[deleted]
- tadfisher 9y agoDebian still supports UEFI, just not Secure Boot (which is not very secure these days if you're using a Microsoft-signed key).
- lukaszjb 9y agoWhen Debian 9 (aka Stretch) goes stable then time to install sid:)
- thomastjeffery 9y agoFor those of you who glossed over the title, It's secure boot that is now unsupported, not UEFI. UEFI is still supported.
- hackuser 9y agoAn important detail which doesn't change what you are saying: Secure Boot is from the UEFI specification, but I think SB is optional.
- vbernat 9y agoDirect link to the announce: https://lists.debian.org/debian-devel-announce/2017/04/msg00013.html https://lists.debian.org/debian-devel-announce/2017/04/msg00.... The Phoronix article doesn't bring anything. The reasons of forfeiting secure boot support can be found in the following bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820036 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820036 (look at the list of blocked bugs). The main blocker seems to be this one: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821051 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821051 (and the root cause seems to be the lack of time from the FTP masters).
- loeg 9y agoA decent amount of Phoronix' content is basically blogspam. Can a moderator update the URL as vbernat has suggested?
- buster 9y agoOn the other hand: this post is probably on HN because someone read phoronix. So, why not give it credit for bringing such things to the attention of a wider audience? I'm a Debian user for a long time, but i don't subscribe to debian-devel. How else would i know of this?
- lloeki 9y agoIOW one's blogspam is another's curation.
- infodroid 9y ago> A decent amount of Phoronix' content is basically blogspam. This has not been true for a long time. Phoronix may have started as an amateur site with dubious content but it has now become a serious resource. These days, it does a good job of (1) highlighting important developments around Linux and (2) providing context and fact-checking for new developments beyond what is provided in primary sources. If you still hold a grudge against Phoronix for its reporting style from ten years ago, please reconsider.
- poizan42 9y agoSecure Boot is utterly broken (for general purpose pcs at least) anyways. I can just take an old windows kernel and boot with a configuration that loads a driver with a known vulnerability (a certain gpu manufacturer might be a good place to look) and a script that use it to run kernel mode code that does whatever it wants. Newer Windows kernels generally blacklists drivers with know vulns, but you can just use an older version, and practically speaking old windows kernels can't be blacklisted because then people's install media that they might have paid for would stop working.
- indolering 9y agoYou could also unenroll all vendor supplied signing keys and load it up with one that you keep in a HSM. Yes, you are technically correct that any opportunistic encryption scheme can be bypassed but it adds cost to the attack and (more importantly) it is a step towards a more secure system.
- poizan42 9y agoI feel like that is missing the point. You need social engineering (and probably not an easy case) to get people to change the keys. Using a pre-made image that allows you to bypass secure boot by way of a windows driver with a known vuln is practically free as soon as anyone packages it. I don't know whether that is currently being done, but I suspect it since I have seen people discussing bypassing PatchGuard in Windows 10 where they used a known exploit in a driver from a company that starts with n and ends with vidia.
- my123 9y agoPatchGuard can be disarmed on 8.1 ;-)
- zokier 9y agoI remember hearing that there is some problem unenrolling vendor keys, especially MS ones, because they are also used to sign some of the firmware blobs. I'm not sure if that concern really became realized at any point, do you have any information regarding that?
- mrmondo 9y agoI wonder if it'll actually finally have useful a SELinux implementation and policies like they promised they'd have before releasing Jessie (8), or remotely up to date clustering software such as pacemaker, corosync, ha resource agents and DRBD which is pretty much unusable in any modern in 7, or 8. Jessie (8) was such a flop of a release so many people and business's I know that were loyal to Debian moved to CentOS 7 + EPEL/Elrepo with great success and given how hostile the Debian community (mainly packing community) has become over recent years and how helpful and inclusive Fedora and RHEL's community and bug tracking ecosystem has become I can't see many of us moving back.
- kakarot 9y agoSeconded. Migrated from Debian to Fedora after Jessie. And to CentOS on my servers. Stretch isn't as bad now, but... I don't think I'm switching from RHEL for a long time. So much just works out of the box, including SELinux, and all of the documentation seems to be security-focused.
- zokier 9y agoidk. I have been recently setting up some new RHEL/CentOS systems both at home and work. While the base system and documentation both feel really good, the experience still has been somewhat frustrating to the point that I'm moving to Ubuntu LTS at home. The biggest pain point is the amount of stuff that is missing from the main repos, like: * Python3 * Nginx * ZFS (this I can understand) * LXC RHSCL is supposed to alleviate the pain, but using them also loses one of the big reasons of using RHEL in the first place because RHSCL releases are only supported couple of years. For example for Python3 the RHSCL version is 3.5 and supported until May 2019; even Python.org supports 3.5 series longer than that!
- bubblethink 9y agoYou would be better off with Ubuntu LTS or Fedora at home. For client usage, RHEL will always feel old within a couple of years of its release. That's just how fast things move on the client side. You may find something like OpenSUSE Leap a better fit since it is a hybrid between LTS and rolling releases.
- deleted 9y ago[deleted]
- ChairmanPao 9y agoWindows 10 supports it. One reason why it's the best choice now.
- misterdata 9y agoSo when will Debian 9 be released anyway? I can't seem to find any planning on the Debian website...
- regularfry 9y agoThe usual date for Debian releases is "when it's ready."