secure boot

sixpiece

sixpiece

Hello I tried to follow the instructions for secure boot here:

FreeBSD UEFI Secure Boot | FreeBSD Foundation

1. Introduction Secure boot provides a way to ensure that only authorized EFI binaries are loaded by a computer's firmware. This ensures that no malicious code can run before the operating system is loaded. This document describes one method of securing FreeBSD's boot process. FreeBSD's regular...
freebsdfoundation.org freebsdfoundation.org

but many of the steps did not work so could not do it:


$ cp /boot/loader.help .


and from

2.2. Build the Loader With Extra Space​

 
You can UEFI boot without secure boot enabled. Unfortunately not every system is going to allow you to disable secure boot though.
 
sixpiece said:
but many of the steps did not work so could not do it
Click to expand...
Any updates on this? I'm going to try since I have a corporate laptop with secure boot enabled and cannot disable it.
I think, it can be solved the same way how nowadays Linux signs third-party kernel modules and then you just enroll the corresponding keys into UEFI manually.
 
According to FreeBSD wiki shim loader is already ported to FreeBSD. However, in my case a shim loader from Debian is already installed. I signed loader.efi and tried booting with chailnloader from GRUB after enrolling the corresponding key using mokutil in Debian. This doesn't work: I get invalid signature error in GRUB.
What can be wrong here?
 
Basically I followed Ubuntu/Debian instructions to sign loader.efi.
I know that mokutil works correctly since I also used it to enroll Nvidia driver's key in Debian.
In Debian I see my key for loader.efi when run mokutil --list-enrolled, but for some reason it doesn't like it.
 
You must log in or register to reply here.
Back
Top