I have installed Arch Linux ISO on USB. And In BIOS I did not disable security boot, because I thought it is not good idea. I have started to find decisions to my problem, and most popular answer was disable security boot. If I disable my security boot, it will be safe for my PC? Maybe do you have any other decisions? And why my PC require it for Arch Linux but for Debian not?
Hello, I will keep this brief because I am on my phone, and its awkward to write emails. Secure boot is a little bit of a intimidation as you think it keeps your system "secure" but in reality secure boot simply checks if the kernel you are booting is signed, therefore legitimate. Most Linux distros I have seen have secure boot support as experimental, but in general disabling secure boot for Linux is completely safe, however it does mean you got to be careful and trust the media you are booting. Secure boot is considered by some as a Microsoft lockin, because Microsoft pushes for Secure boot on all systems to "keep them secure", so its personal opinion. TL;DR you most likely will see no security difference having secure boot disabled apart from it allowing anything to be booted, including malicious software. See the archwiki for details on secure boot: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secur... Personally I think its a trivial step, because Arch Linux signs their kernels and the initramfs is generated by mkinitcpio on kernel install and upgrade, therefore chances of tampering with the kernel is very unlikely. Its a bit like viruses, check before you click and you will be fine. Have a good day, -- Polarian GPG signature: 0770E5312238C760 Website: https://polarian.dev JID/XMPP: polarian@polarian.dev
I have installed Arch Linux ISO on USB. And In BIOS I did not disable security boot, because I thought it is not good idea. I have started to find decisions to my problem, and most popular answer was disable security boot. If I disable my security boot, it will be safe for my PC? Maybe do you have any other decisions? And why my PC require it for Arch Linux but for Debian not?
Personally, I find Arch Wiki a fantastic resource for answering majority of my questions regarding Arch setup and operations. Usually information is well condensed there, and links and references are provided for further research. Specifically for the secure boot, one can read here https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secur... . I hope you can find it useful too. Please note that Arch Wiki articles are translated in many languages! If that doesn't work, my next step is to search Arch forums. This page covers Secure Boot: https://bbs.archlinux.org/viewtopic.php?id=202714 If that doesn’t help either, then stack exchange comes to the rescue: https://unix.stackexchange.com/questions/320078/how-to-boot-arch-linux-insta... After all these resources, I very rarely (never) have any questions remaining for the community.
On Thu, 2023-07-13 at 12:08 +0100, Polarian and on Thu, 2023-07-13 at 07:21 -0400, Dmitry Yershov wrote:
https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secur...
Hi, especially care for the cons link, provided by the Arch Wiki and note that it just mentions pros, but doesn't link to anything related to those pros. "[...] This also makes patching the fault impossible, since any patch can be replaced (downgraded) by the (signed) exploitable binary. Microsoft [...] has released two patches; however, the patches do not (and cannot) remove the vulnerability, which would require key replacements in end user firmware to fix. [...]" - https://en.wikipedia.org/wiki/UEFI#Secure_Boot_2 The problem isn't that there is a vulnerability, it's even not a problem that it cannot be fixed. Shit happens! Fortunately not all machines are affected by this vulnerability. The problem is the Microsoft mindset, providing a weak mitigation and then pretending they solved something with it. IMO this is the greatest security risk imaginable. IMO it's way more secure to disable it and instead to rely on signed checksums and to assume that there is no African prince who wants to give you $5 billion. Regards, Ralf
participants (4)
-
Dmitry Yershov
-
Polarian
-
Ralf Mardorf
-
Source Code