4 ms·

> Mozilla requires LUKS full-disk encryption, and having it setup conflicted with NVidia’s proprietary driver I’ve seen this warning in the Ubuntu docs. Can so

by orf 5y ago

> Mozilla requires LUKS full-disk encryption, and having it setup conflicted with NVidia’s proprietary driver I’ve seen this warning in the Ubuntu docs. Can someone explain exactly why a GPU driver would cause issues with disk encryption and UEFI boot?

remexre 5y ago
I conjecture the securely booted kernel won't load unsigned modules, and out-of-tree drivers don't get signed when the kernel and its modules do.
- heavyset_go 5y ago
  You can work around this[1]. [1] https://askubuntu.com/questions/1023036/how-to-install-nvidia-driver-with-secure-boot-enabled/1049479#1049479 https://askubuntu.com/questions/1023036/how-to-install-nvidi...
- josephcsible 5y ago
  I wish people understood the Secure Boot spec better. This problem is totally unnecessary. The spec says no unsigned code can run until ExitBootServices is called, but people treat it as if it said that no unsigned kernel code can ever run.
LeoPanthera 5y ago
It works fine if /boot is unencrypted. You can encrypt the rest of / and it's fine.
- jeppesen-io 5y ago
  Ditto running encrypted root without any issue
- xvector 5y ago
  Doesn't running /boot without encryption open up a class of attacks?
  - LeoPanthera 5y ago
    I suppose it's possible to imagine replacing grub with something that captures your password. It depends what your threat model is. I think you'd need physical access, at least.
  - jeppesen-io 5y ago
    Certainly. Security is always a balancing act. My primary concern is laptop being taken when traveling by Air or stolen. Encrypted root covers that, even with boot un-encrypted Unencrypted boot leaves me vulnerable to a malicious actor taking my laptop, modifing grub and/or linux kernel to send and/or store my password to unlock the boot volume and then handing my laptop back and me typing in my un-lock password Possible, but I view that threat as low
    - est31 5y ago
      Yeah, when someone has temporary physical access to your hardware you have lost anyways. They could perform hardware alterations and e.g. install hardware keyloggers into the device, etc.
    - kevinmgranger 5y ago
      Isn't UEFI, if configured correctly, supposed to protect against this?
      - jeppesen-io 5y ago
        Can you explain? How should UEFI be configured to do this, from a Linux perspective? I'd love to improve my security
        LeoPanthera 5y ago
        In theory, secure boot checksums the bootloader and fails to boot if it has been modified. Using it with Linux can be a bit tricky. openSUSE has a tool to help sign your kernel, I don't know how other distributions do it. https://en.opensuse.org/openSUSE:UEFI#Secure_Boot https://en.opensuse.org/openSUSE:UEFI#Secure_Boot
mixmastamyk 5y ago
And what does Mozilla have to do with it?
- teraflop 5y ago
  Mozilla the organization, not Mozilla the browser. It's common for companies to require their employees to use full-disk encryption on all devices that store company data.
jeroenhd 5y ago
n=1, but I've run fully-encrypted and /boot-encrypted Linux installs with the proprietary Nvidia-drivers without any issues. Of course the low-quality binary blobs Nvidia ships can always contain some annoying bugs, so maybe this was fixed already and the author is just cautious or maybe I will run into those problems eventually. I don't think it's a problem with the current iterations of Nvidia/Linux, though. As for what can cause the problem, I have several ideas: - Secure boot and code verification breaking driver loading - The Nvidia driver, loaded during early startup, freaking out about config files not existing - Some kind of handover problem between the fallback VGA driver and the proprietary blob that wouldn't exist if the boot files would be available from the bootloader directly - Nvidia is known to track boot state in their GPU firmware (one way they used to prevent virtualizing consumer GPUs) so it could be related to a second attempt to initialize the GPU
- ltbarcly3 5y ago
  I've used both for years without any issues, so I'm also confused on this one.

by orf 5y ago

remexre 5y ago

I conjecture the securely booted kernel won't load unsigned modules, and out-of-tree drivers don't get signed when the kernel and its modules do.

heavyset_go 5y ago
You can work around this[1]. [1] https://askubuntu.com/questions/1023036/how-to-install-nvidia-driver-with-secure-boot-enabled/1049479#1049479 https://askubuntu.com/questions/1023036/how-to-install-nvidi...
josephcsible 5y ago
I wish people understood the Secure Boot spec better. This problem is totally unnecessary. The spec says no unsigned code can run until ExitBootServices is called, but people treat it as if it said that no unsigned kernel code can ever run.

LeoPanthera 5y ago

It works fine if /boot is unencrypted. You can encrypt the rest of / and it's fine.

jeppesen-io 5y ago
Ditto running encrypted root without any issue
xvector 5y ago
Doesn't running /boot without encryption open up a class of attacks?
- LeoPanthera 5y ago
  I suppose it's possible to imagine replacing grub with something that captures your password. It depends what your threat model is. I think you'd need physical access, at least.
- jeppesen-io 5y ago
  Certainly. Security is always a balancing act. My primary concern is laptop being taken when traveling by Air or stolen. Encrypted root covers that, even with boot un-encrypted Unencrypted boot leaves me vulnerable to a malicious actor taking my laptop, modifing grub and/or linux kernel to send and/or store my password to unlock the boot volume and then handing my laptop back and me typing in my un-lock password Possible, but I view that threat as low
  - est31 5y ago
    Yeah, when someone has temporary physical access to your hardware you have lost anyways. They could perform hardware alterations and e.g. install hardware keyloggers into the device, etc.
  - kevinmgranger 5y ago
    Isn't UEFI, if configured correctly, supposed to protect against this?
    - jeppesen-io 5y ago
      Can you explain? How should UEFI be configured to do this, from a Linux perspective? I'd love to improve my security
      - LeoPanthera 5y ago
        In theory, secure boot checksums the bootloader and fails to boot if it has been modified. Using it with Linux can be a bit tricky. openSUSE has a tool to help sign your kernel, I don't know how other distributions do it. https://en.opensuse.org/openSUSE:UEFI#Secure_Boot https://en.opensuse.org/openSUSE:UEFI#Secure_Boot

mixmastamyk 5y ago

And what does Mozilla have to do with it?

teraflop 5y ago
Mozilla the organization, not Mozilla the browser. It's common for companies to require their employees to use full-disk encryption on all devices that store company data.

jeroenhd 5y ago

n=1, but I've run fully-encrypted and /boot-encrypted Linux installs with the proprietary Nvidia-drivers without any issues. Of course the low-quality binary blobs Nvidia ships can always contain some annoying bugs, so maybe this was fixed already and the author is just cautious or maybe I will run into those problems eventually. I don't think it's a problem with the current iterations of Nvidia/Linux, though. As for what can cause the problem, I have several ideas: - Secure boot and code verification breaking driver loading - The Nvidia driver, loaded during early startup, freaking out about config files not existing - Some kind of handover problem between the fallback VGA driver and the proprietary blob that wouldn't exist if the boot files would be available from the bootloader directly - Nvidia is known to track boot state in their GPU firmware (one way they used to prevent virtualizing consumer GPUs) so it could be related to a second attempt to initialize the GPU

ltbarcly3 5y ago
I've used both for years without any issues, so I'm also confused on this one.