3 ms·
Secure Boot should be able to defend against that if you take the time to set it up (you'd need to enroll your own key in the system firmware and then sign your
by Rjevski 9y ago
Secure Boot should be able to defend against that if you take the time to set it up (you'd need to enroll your own key in the system firmware and then sign your kernel with that key).
- djsumdog 9y agoThat is my eventual goal. I want to re-enable Secure Boot, sign my Grub EFI and place my CA (and only my CA; getting rid of the default ones) in the UEFI/BIOS settings. I think you can also embed Grub with a key to verify the kernel. (You can also just compile a kernel with UEFI Stub support, digitally sign it and have that boot directly without Grub, but I'm not sure if you can use luks that way as you still need the initrd to unlock the disk). This would mean that if your laptop gets stolen, and you have a strong password and disable booting from other devices, the thief/fencer would need to find a way to reset the UEFI before they could install Windows on it and resell it. It's probably still possible, but it makes it much more difficult and they may just have to end up parting out the laptop and tossing the motherboard.