3 ms·

> Disabling UEFI Secure Boot has been step 1 for installing Linux for as long as UEFI had existed, hasn't it? Many people did a lot of work to ensure that Linu

by mjg59 4y ago

> Disabling UEFI Secure Boot has been step 1 for installing Linux for as long as UEFI had existed, hasn't it? Many people did a lot of work to ensure that Linux could be installed on systems with UEFI Secure Boot enabled.

sam_lowry_ 4y ago
Does it apply to RedHat, Ubuntu, SUSE and the likes only? I wonder if as an Arch Linux user I can boot with Secure Boot enabled.
- pabs3 4y ago
  Looks like you can't: "Note: The official installation image does not support Secure Boot (FS#53864). To successfully boot the installation medium you will need to disable Secure Boot." https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware... https://bugs.archlinux.org/task/53864 https://bugs.archlinux.org/task/53864
  - Arnavion 4y ago
    If you're using Arch you're probably willing to set up SB with your own keys. (Heck, I use my own keys on OpenSUSE even though my distro signs the kernel, because I want to use systemd-boot instead of mokutil since the latter is broken on my motherboard.)
  - Foxboron 4y ago
    There has been some movement to improve on this, but it's a bit of work getting a signing enclave setup so we can sign binaries.
- philliphaydon 4y ago
  I can confirm that on both Lenovo and Dell, you can boot and install Fedora and Ubuntu without issue, but Manjaro (Arch) requires disable secure boot first, and on Dell you need to also disable AHCI (Raid) inside windows first (if you intend to keep your windows partition) or just disable in bios. Otherwise it all works on latest XPS and X1 Extreme.
- mjg59 4y ago
  It applies to any distro willing to jump through the necessary hoops (which are some degree of effort, but they're not on fire)
rob_c 4y ago
Yes but then it's up to the device admin typically to enroll some additional keychain into the enclave. I only know 1 group using the "trust 3rd party" over "trust ours" because they don't want users sticking mint on the company Ubuntu machines.

by mjg59 4y ago

sam_lowry_ 4y ago

Does it apply to RedHat, Ubuntu, SUSE and the likes only? I wonder if as an Arch Linux user I can boot with Secure Boot enabled.

pabs3 4y ago
Looks like you can't: "Note: The official installation image does not support Secure Boot (FS#53864). To successfully boot the installation medium you will need to disable Secure Boot." https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot https://wiki.archlinux.org/title/Unified_Extensible_Firmware... https://bugs.archlinux.org/task/53864 https://bugs.archlinux.org/task/53864
- Arnavion 4y ago
  If you're using Arch you're probably willing to set up SB with your own keys. (Heck, I use my own keys on OpenSUSE even though my distro signs the kernel, because I want to use systemd-boot instead of mokutil since the latter is broken on my motherboard.)
- Foxboron 4y ago
  There has been some movement to improve on this, but it's a bit of work getting a signing enclave setup so we can sign binaries.
philliphaydon 4y ago
I can confirm that on both Lenovo and Dell, you can boot and install Fedora and Ubuntu without issue, but Manjaro (Arch) requires disable secure boot first, and on Dell you need to also disable AHCI (Raid) inside windows first (if you intend to keep your windows partition) or just disable in bios. Otherwise it all works on latest XPS and X1 Extreme.
mjg59 4y ago
It applies to any distro willing to jump through the necessary hoops (which are some degree of effort, but they're not on fire)

rob_c 4y ago

Yes but then it's up to the device admin typically to enroll some additional keychain into the enclave. I only know 1 group using the "trust 3rd party" over "trust ours" because they don't want users sticking mint on the company Ubuntu machines.