secure boot

[sixpiece]

Hello I tried to follow the instructions for secure boot here:

FreeBSD UEFI Secure Boot – FreeBSD Foundation

freebsdfoundation.org

but many of the steps did not work so could not do it:


$ cp /boot/loader.help .


and from

2.2. Build the Loader With Extra Space​

 

[Alain De Vos]

This is not an answer to your question, but legacy-boot is easy to set-up.

 

[SirDice]

You can UEFI boot without secure boot enabled. Unfortunately not every system is going to allow you to disable secure boot though.

 

[aragats]

but many of the steps did not work so could not do it

Any updates on this? I'm going to try since I have a corporate laptop with secure boot enabled and cannot disable it.
I think, it can be solved the same way how nowadays Linux signs third-party kernel modules and then you just enroll the corresponding keys into UEFI manually.

 

[aragats]

According to FreeBSD wiki shim loader is already ported to FreeBSD. However, in my case a shim loader from Debian is already installed. I signed loader.efi and tried booting with chailnloader from GRUB after enrolling the corresponding key using mokutil in Debian. This doesn't work: I get invalid signature error in GRUB.
What can be wrong here?

 

[sixpiece]

how is ubuntu able to do it?
does this give a hint is freebsd allowed to take from this solution and is there something here of value? https://wiki.ubuntu.com/UEFI/SecureBoot

 

[aragats]

By my understanding Debian's shim loader is signed my Microsoft.

 

[aragats]

Basically I followed Ubuntu/Debian instructions to sign loader.efi.
I know that mokutil works correctly since I also used it to enroll Nvidia driver's key in Debian.
In Debian I see my key for loader.efi when run mokutil --list-enrolled, but for some reason it doesn't like it.