3 ms·

> The bios allowed me set up my own keys which I use to sign the kernel Not all manufacturers allow this, and even then, it adds considerable user complexity t

> The bios allowed me set up my own keys which I use to sign the kernel Not all manufacturers allow this, and even then, it adds considerable user complexity to have to do this to install Linux, as opposed to a normal liveUSB GUI flow, not to mention that it screws up dual-boot, as you said. So, it is practically a requirement, even if it is technically possible to work around it with good technical skills on specialized hardware.

vladvasiliu 6y ago
The HP has a box to tick in the UEFI where it loads the MS keys. I never tried it, so I don't know if that is in addition to whatever keys are configured or if it replaces the custom keys. As there's a different option to clear all keys, I would hope it's the former. I think in this case there are two problems, more related to the hardware and SecureBoot implementation rather than secureboot itself. 1. Shoddy hardware that doesn't allow the user to control it. 2. A process that is relatively involved, although I'm not sure how you could go about providing an "easy way" for people without technical skills. One way or another, the keys have to get in the UEFI. It's technically possible to configure them from inside Linux (while it's running) – this worked on an HP EliteDesk – but the UEFI SecureBoot has to be disabled. I suppose that's relatively simple to do, certainly simple enough for someone interested in trying linux (as opposed to people who don't care what os they use as long as they can accomplish what they want with their computers). I guess a nice way would be for the UEFI to expose some sort of interface where the OS can change the keys and then, on reboot, asks the user if they really wanted to the change. But this would still be a problem for the initial setup, because, if booting linux (instead of the usual windows) you are actually booting a different OS than what the UEFI expects.

vladvasiliu 6y ago

The HP has a box to tick in the UEFI where it loads the MS keys. I never tried it, so I don't know if that is in addition to whatever keys are configured or if it replaces the custom keys. As there's a different option to clear all keys, I would hope it's the former. I think in this case there are two problems, more related to the hardware and SecureBoot implementation rather than secureboot itself. 1. Shoddy hardware that doesn't allow the user to control it. 2. A process that is relatively involved, although I'm not sure how you could go about providing an "easy way" for people without technical skills. One way or another, the keys have to get in the UEFI. It's technically possible to configure them from inside Linux (while it's running) – this worked on an HP EliteDesk – but the UEFI SecureBoot has to be disabled. I suppose that's relatively simple to do, certainly simple enough for someone interested in trying linux (as opposed to people who don't care what os they use as long as they can accomplish what they want with their computers). I guess a nice way would be for the UEFI to expose some sort of interface where the OS can change the keys and then, on reboot, asks the user if they really wanted to the change. But this would still be a problem for the initial setup, because, if booting linux (instead of the usual windows) you are actually booting a different OS than what the UEFI expects.