4 ms·

> but because Linux requires you to disable Secure Boot Patently false. I’m secure-booting all my Ubuntu installations and (iirc) I could do that too back when

> but because Linux requires you to disable Secure Boot Patently false. I’m secure-booting all my Ubuntu installations and (iirc) I could do that too back when I used Fedora. Why do people keep repeating this FUD? Linux plus UEFI Secure Boot works fine as long as you use the signed version of GRUB. It’s not hard. Edit: Downvotes? Really? For clearing up a (way too) common misunderstanding about Linux and UEFI, with facts? Jeez guys.

LucidLynx 5y ago
I am sorry but, except maybe the latest versions of Fedora, you have to disable secure boot to boot on Linux the first time... I tried with Ubuntu, Pop-OS, Arch, Manjaro... All except Fedora require to disable Secure Boot.
- als0 5y ago
  Just want to say that my Ubuntu 18.04 works with secure boot enabled (and so do newer versions).
fiddlerwoaroof 5y ago
So, the ability to boot Linux with Secure Boot is entirely dependent on some third party being willing to sign the bootloader? No thanks
- josteink 5y ago
  I see I’ve landed so deep in the sea of FUD, beyond my ability to keep my feet dry, but I’ll make one last attempt at spreading actual knowledge. 1. Too guaranteed boot Linux with UEFI Secure Boot OOB without technical fiddling you have to use GRUB signed using keys trusted by Microsoft, like Canonical’s keys. So kinda, yes. 2. Many firmwares allows you to roll your own keys, meaning you don’t have to trust MS or Canonical or anyone else. So you have the choice between user-friendly (default) or improved security (requires fiddling). I personally think the default makes sense for most users, and I’m already 200 miles beyond proving that Linux can indeed use UEFI and Secure Boot. That’s an established fact for more than half a decade now. Not being able to disable those in BIOS won’t prevent you from loading Linux, and it would reflect better on the wider Linux-community if people stopped pushing such FUD. Canonical has a good write up here, if you want more details: https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot
  - fiddlerwoaroof 5y ago
    If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. So, option (2) would be ok, but having to rely on _Microsoft_ to run Linux on my laptop is exactly the sort of scenario everyone was afraid of 20 years ago.
    - kenmacd 5y ago
      > If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. I personally haven't seen a computer yet that doesn't allow this. Even if it's not provided the option to disable secure-boot is still available. Phones are the real problem. As far as I can find only the Pixel phones will allow secure boot with a custom OS. If you own another phone you're already locked in to your manufacturers keys or no keys.
branon 5y ago
It's a random Amazon customer. This is HN. You and I know that GNU/Linux distros can pass Secure Boot just fine, but someone else may not know, or it may simply be more convenient for them to disable Secure Boot prior to installation. The Amazon customer was evidently confident enough to flip BIOS settings (or attempt to) but may have not known how to get Secure Boot working properly.
- josteink 5y ago
  > It's a random Amazon customer. This is HN. You and I know that GNU/Linux distros can pass Secure Boot just fine The default Ubuntu installation media boots OOB. It’s really, really not hard.
Black101 5y ago
> Why do people keep repeating this FUD? Linux plus UEFI Secure Boot works fine as long as you use the signed version of GRUB. It’s not hard. Very ridiculous. You have to get someone else to sign it for you, don't you?
- als0 5y ago
  Microsoft signed an open source bootloader called Shim, which can run out of the box on any PC. You can use Shim to load your own GRUB2 and set your own keys. Shim is used by Fedora, Ubuntu, and Debian so far. A good writeup is available here https://wiki.debian.org/SecureBoot https://wiki.debian.org/SecureBoot
  - Black101 5y ago
    Shim is on top of grub? not good ... They are trying to turn PCs into phones where you can't do what you want.
swiley 5y ago
Don't conlfate UEFI and Secure Boot.
- josteink 5y ago
  I’m not. The default Ubuntu installation media boots with UEFI and secure boot OOB with no action required by the end-user. It literally couldn’t be simpler.
  - madars 5y ago
    Yep, it works great. The only caveat is that to load non-mainline drivers (e.g. VirtualBox or Nvidia) you need to enroll a Machine Owner Key (MOK) and then use it to sign the driver. In Ubuntu/Debian the mokutil process is streamlined and "apt install" will automatically prompt you to do it.
Vogtinator 5y ago
It works only because Linux distributions boot through a MS signed binary called "shim" which allows to import the distro key to allow booting. That's still a much worse experience than with the "root of trust" MS key.
pjerem 5y ago
Yes you can boot Linux with secure boot on UEFI as long you use a preloader like shim, graciously signed by Microsoft. That’s what most distribution are doing. With the access to the UEFI, you can add your own trusted key, without needing to rely on Microsoft good will on signing your preloader.
alerighi 5y ago
Ubuntu is not Linux. On other distributions secure boot doesn't work out of the box and requires some manual tweaking, like generating a CA, signing kernel and stuff, installing the CA key in the firmware, etc. I don't like Ubuntu, in fact I consider it the worse Linux distributions (it was good in the old days, nowadays is full of crap like snap packages and commercial stuff). Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules. That depending on the situations can be a problem (for example a lot of third party drivers, for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them).
- josteink 5y ago
  > On other distributions secure boot doesn't work out of the box and requires some manual tweaking I can’t recall having issues with Fedora, but I’m not 100% on that. I might be wrong. > Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules. I mean, that’s kinda the point. You should be able to boot into a kernel you can trust is untampered, and that includes blocking unsigned modules from being loaded. Let’s face it: allowing that would essentially erase any trust you had built up until that point. You can always enroll your own keys though? > for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them For Nvidia that’s a bit if a pain, but I’m not a gamer and has always used the open source nouveau drivers instead. For me secure boot is clearly worth it (much improved security) at near no cost. For you the tally may be different, and I’m ok with that. I’m just trying to help kill the myth that you can’t UEFI secure boot Linux, because clearly you can. People are doing it every day. At this point you have to be wilfully ignorant if you still believe you can’t. But look in this thread: replies upon replies and downvotes en masse on unopinionated, factual posts. Maybe some people really want to remain ignorant? I really can’t tell.
  - easton 5y ago
    I can confirm Fedora working fine with secure boot. https://docs.fedoraproject.org/en-US/Fedora/18/html-single/UEFI_Secure_Boot_Guide/index.html#sect-UEFI_Secure_Boot_Guide-Implementation_of_UEFI_Secure_Boot-Shim https://docs.fedoraproject.org/en-US/Fedora/18/html-single/U...

LucidLynx 5y ago

I am sorry but, except maybe the latest versions of Fedora, you have to disable secure boot to boot on Linux the first time... I tried with Ubuntu, Pop-OS, Arch, Manjaro... All except Fedora require to disable Secure Boot.

als0 5y ago
Just want to say that my Ubuntu 18.04 works with secure boot enabled (and so do newer versions).

fiddlerwoaroof 5y ago

So, the ability to boot Linux with Secure Boot is entirely dependent on some third party being willing to sign the bootloader? No thanks

josteink 5y ago
I see I’ve landed so deep in the sea of FUD, beyond my ability to keep my feet dry, but I’ll make one last attempt at spreading actual knowledge. 1. Too guaranteed boot Linux with UEFI Secure Boot OOB without technical fiddling you have to use GRUB signed using keys trusted by Microsoft, like Canonical’s keys. So kinda, yes. 2. Many firmwares allows you to roll your own keys, meaning you don’t have to trust MS or Canonical or anyone else. So you have the choice between user-friendly (default) or improved security (requires fiddling). I personally think the default makes sense for most users, and I’m already 200 miles beyond proving that Linux can indeed use UEFI and Secure Boot. That’s an established fact for more than half a decade now. Not being able to disable those in BIOS won’t prevent you from loading Linux, and it would reflect better on the wider Linux-community if people stopped pushing such FUD. Canonical has a good write up here, if you want more details: https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot
- fiddlerwoaroof 5y ago
  If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. So, option (2) would be ok, but having to rely on _Microsoft_ to run Linux on my laptop is exactly the sort of scenario everyone was afraid of 20 years ago.
  - kenmacd 5y ago
    > If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. I personally haven't seen a computer yet that doesn't allow this. Even if it's not provided the option to disable secure-boot is still available. Phones are the real problem. As far as I can find only the Pixel phones will allow secure boot with a custom OS. If you own another phone you're already locked in to your manufacturers keys or no keys.

branon 5y ago

It's a random Amazon customer. This is HN. You and I know that GNU/Linux distros can pass Secure Boot just fine, but someone else may not know, or it may simply be more convenient for them to disable Secure Boot prior to installation. The Amazon customer was evidently confident enough to flip BIOS settings (or attempt to) but may have not known how to get Secure Boot working properly.

josteink 5y ago
> It's a random Amazon customer. This is HN. You and I know that GNU/Linux distros can pass Secure Boot just fine The default Ubuntu installation media boots OOB. It’s really, really not hard.

Black101 5y ago

> Why do people keep repeating this FUD? Linux plus UEFI Secure Boot works fine as long as you use the signed version of GRUB. It’s not hard. Very ridiculous. You have to get someone else to sign it for you, don't you?

als0 5y ago
Microsoft signed an open source bootloader called Shim, which can run out of the box on any PC. You can use Shim to load your own GRUB2 and set your own keys. Shim is used by Fedora, Ubuntu, and Debian so far. A good writeup is available here https://wiki.debian.org/SecureBoot https://wiki.debian.org/SecureBoot
- Black101 5y ago
  Shim is on top of grub? not good ... They are trying to turn PCs into phones where you can't do what you want.

swiley 5y ago

Don't conlfate UEFI and Secure Boot.

josteink 5y ago
I’m not. The default Ubuntu installation media boots with UEFI and secure boot OOB with no action required by the end-user. It literally couldn’t be simpler.
- madars 5y ago
  Yep, it works great. The only caveat is that to load non-mainline drivers (e.g. VirtualBox or Nvidia) you need to enroll a Machine Owner Key (MOK) and then use it to sign the driver. In Ubuntu/Debian the mokutil process is streamlined and "apt install" will automatically prompt you to do it.

Vogtinator 5y ago

It works only because Linux distributions boot through a MS signed binary called "shim" which allows to import the distro key to allow booting. That's still a much worse experience than with the "root of trust" MS key.

pjerem 5y ago

Yes you can boot Linux with secure boot on UEFI as long you use a preloader like shim, graciously signed by Microsoft. That’s what most distribution are doing. With the access to the UEFI, you can add your own trusted key, without needing to rely on Microsoft good will on signing your preloader.

alerighi 5y ago

Ubuntu is not Linux. On other distributions secure boot doesn't work out of the box and requires some manual tweaking, like generating a CA, signing kernel and stuff, installing the CA key in the firmware, etc. I don't like Ubuntu, in fact I consider it the worse Linux distributions (it was good in the old days, nowadays is full of crap like snap packages and commercial stuff). Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules. That depending on the situations can be a problem (for example a lot of third party drivers, for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them).

josteink 5y ago
> On other distributions secure boot doesn't work out of the box and requires some manual tweaking I can’t recall having issues with Fedora, but I’m not 100% on that. I might be wrong. > Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules. I mean, that’s kinda the point. You should be able to boot into a kernel you can trust is untampered, and that includes blocking unsigned modules from being loaded. Let’s face it: allowing that would essentially erase any trust you had built up until that point. You can always enroll your own keys though? > for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them For Nvidia that’s a bit if a pain, but I’m not a gamer and has always used the open source nouveau drivers instead. For me secure boot is clearly worth it (much improved security) at near no cost. For you the tally may be different, and I’m ok with that. I’m just trying to help kill the myth that you can’t UEFI secure boot Linux, because clearly you can. People are doing it every day. At this point you have to be wilfully ignorant if you still believe you can’t. But look in this thread: replies upon replies and downvotes en masse on unopinionated, factual posts. Maybe some people really want to remain ignorant? I really can’t tell.
- easton 5y ago
  I can confirm Fedora working fine with secure boot. https://docs.fedoraproject.org/en-US/Fedora/18/html-single/UEFI_Secure_Boot_Guide/index.html#sect-UEFI_Secure_Boot_Guide-Implementation_of_UEFI_Secure_Boot-Shim https://docs.fedoraproject.org/en-US/Fedora/18/html-single/U...