4 ms·

Does that make kernel updates a more manual process? Are you building your own? Are you signing and using secure boot? I'd be interested in giving this a try.

profsnuggles 6y ago
That is what I am doing as well. I'm building my own kernel but not using secure boot. Kernel upgrades are just copying .config from the old kernel to the new kernel. sudo make olddefconfig && sudo make && sudo make modules_install && install_kernel The contents of install_kernel KERNEL=`readlink /usr/src/linux` NUMBER=${KERNEL##linux-} NUMBER=${NUMBER%%-gentoo} sudo cp arch/x86_64/boot/bzImage /boot/EFI/Gentoo/vmlinuz-${NUMBER}-gentoo.efi sudo efi bootmgr -c -L "Gentoo ${NUMBER}" -l "\\EFI\\Gentoo\\vmlinuz-${NUMBER}-gentoo.efi" -d /dev/nvme0n1
- alias_neo 6y ago
  Amazing thanks for the explanation, I'll have to give this a go!
- mshook 6y ago
  Don't compile as root, there's no need for that. You should only elevate your privileges when needed. The only thing you need root for are modules_install and your install_kernel script.
  - londons_explore 6y ago
    People always say this, but if a project is malicious, it can take your SSH keys and get persistence even without root. It can alias sudo in your bashrc to get root if it wants too. Yet if you don't use sudo, some make/compiles fail with random permissions errors. I mean I see the reasoning, but in 2020 I think the Linux desktop security model is sufficiently broken that it doesn't matter.
deleted 6y ago
[deleted]
josteink 6y ago
> Does that make kernel updates a more manual process? Are you building your own? In Debian/Ubuntu it should be on by default, and has been for almost a decade: https://askubuntu.com/questions/510009/does-the-ubuntu-kernel-have-efi-stub-loader-boot-support https://askubuntu.com/questions/510009/does-the-ubuntu-kerne... That means you can run your kernel directly as a UEFI-target and it will support secure-boot.
- alias_neo 6y ago
  Thanks, by "it" I now understand you mean that CONFIG_EFI_STUB=y is on by default. This is the feature required to boot the kernel directly as an UEFI-target, now I need to look into how I make it an UEFI-target, I believe I need to use bootmgr as GP has, but I need to use my kernel image as the EFI image? EDIT: I managed to create the target, with efibootmgr and boot it partly but it panics. I assume that's due to FDE so I'll have to look into how to configure it to support that (if it's possible without a bootloader).
  - tremon 6y ago
    it's possible, but you must include the path to the initramfs as a kernel parameter (using DOS-style paths, not sure if unix-style works too). A linux-aware bootloader will usually load the initramfs itself and pass linux the memory address where it's loaded, in UEFI the kernel gets "executed" like a normal executable, so it has a commandline but not a pre-loaded initramfs. My efibootmgr entry looks like this (root is btrfs on LUKS): HD(disk-id)/File(\vmlinux-5.6.0-2-rt-amd64) initrd=\initrd.img-5.6.0-2-rt-amd64 ro root=/dev/mapper/cryptpv0 The latter part is what you must supply manually if you want to start the kernel from the UEFI command line.
    - alias_neo 6y ago
      Great thanks, I'll give this another go.

profsnuggles 6y ago

That is what I am doing as well. I'm building my own kernel but not using secure boot. Kernel upgrades are just copying .config from the old kernel to the new kernel. sudo make olddefconfig && sudo make && sudo make modules_install && install_kernel The contents of install_kernel KERNEL=`readlink /usr/src/linux` NUMBER=${KERNEL##linux-} NUMBER=${NUMBER%%-gentoo} sudo cp arch/x86_64/boot/bzImage /boot/EFI/Gentoo/vmlinuz-${NUMBER}-gentoo.efi sudo efi bootmgr -c -L "Gentoo ${NUMBER}" -l "\\EFI\\Gentoo\\vmlinuz-${NUMBER}-gentoo.efi" -d /dev/nvme0n1

alias_neo 6y ago
Amazing thanks for the explanation, I'll have to give this a go!
mshook 6y ago
Don't compile as root, there's no need for that. You should only elevate your privileges when needed. The only thing you need root for are modules_install and your install_kernel script.
- londons_explore 6y ago
  People always say this, but if a project is malicious, it can take your SSH keys and get persistence even without root. It can alias sudo in your bashrc to get root if it wants too. Yet if you don't use sudo, some make/compiles fail with random permissions errors. I mean I see the reasoning, but in 2020 I think the Linux desktop security model is sufficiently broken that it doesn't matter.

deleted 6y ago

[deleted]

josteink 6y ago

> Does that make kernel updates a more manual process? Are you building your own? In Debian/Ubuntu it should be on by default, and has been for almost a decade: https://askubuntu.com/questions/510009/does-the-ubuntu-kernel-have-efi-stub-loader-boot-support https://askubuntu.com/questions/510009/does-the-ubuntu-kerne... That means you can run your kernel directly as a UEFI-target and it will support secure-boot.

alias_neo 6y ago
Thanks, by "it" I now understand you mean that CONFIG_EFI_STUB=y is on by default. This is the feature required to boot the kernel directly as an UEFI-target, now I need to look into how I make it an UEFI-target, I believe I need to use bootmgr as GP has, but I need to use my kernel image as the EFI image? EDIT: I managed to create the target, with efibootmgr and boot it partly but it panics. I assume that's due to FDE so I'll have to look into how to configure it to support that (if it's possible without a bootloader).
- tremon 6y ago
  it's possible, but you must include the path to the initramfs as a kernel parameter (using DOS-style paths, not sure if unix-style works too). A linux-aware bootloader will usually load the initramfs itself and pass linux the memory address where it's loaded, in UEFI the kernel gets "executed" like a normal executable, so it has a commandline but not a pre-loaded initramfs. My efibootmgr entry looks like this (root is btrfs on LUKS): HD(disk-id)/File(\vmlinux-5.6.0-2-rt-amd64) initrd=\initrd.img-5.6.0-2-rt-amd64 ro root=/dev/mapper/cryptpv0 The latter part is what you must supply manually if you want to start the kernel from the UEFI command line.
  - alias_neo 6y ago
    Great thanks, I'll give this another go.