4 ms·
Not the OP but just anecdotally, last time I looked into enabling secure boot on my X1 Carbon there was an advisory from Lenovo that enrolling your own keys mad
by ghostpepper 4y ago
Not the OP but just anecdotally, last time I looked into enabling secure boot on my X1 Carbon there was an advisory from Lenovo that enrolling your own keys made it possible to brick the machine
https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(Gen_7) https://wiki.archlinux.org/title/Lenovo_ThinkPad_X1_Carbon_(...
- privacyking 4y agoThat's only if you fail to enroll the Lenovo hardware firmware images
- ghostpepper 4y agoCan you link to a doc explaining how to do that? I'm not even sure what it means to enrol a firmware image. I'd love to finally get this working.
- LoganDark 4y agoI think they're referring to the BIOS itself, since even that needs to be signed and verified.
- mjg59 4y agoIt does, but it's not signed with the UEFI Secure Boot keys (Boot Guard has its own mechanism that's burned into chipset fuses, you can't re-key it)
- privacyking 4y agohttps://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot#Microsoft_Windows https://wiki.archlinux.org/title/Unified_Extensible_Firmware... It's referring to dual booting windows but the same principles apply.
- mjg59 4y agoThat's related to Secure Boot, not the TPM