User talk:Sakaki/Sakaki's EFI Install Guide/Configuring Secure Boot

From Gentoo Wiki
Jump to:navigation Jump to:search
Before creating a discussion or leaving a comment, please read about using talk pages. In particular, sign comments using ~~~~ and add new discussions at the bottom of the page. New discussions should be made visible with {{Talk|date = 2024-05-18}}.
== Discussion title ==

{{Talk|date = 2024-05-13}}

A comment [[User:Larry|Larry]] 13:52, 13 May 2024 (UTC)
: A reply [[User:Sally|Sally]] 11:29, 14 May 2024 (UTC)
:: Another reply [[User:Larry|Larry]] 11:30, 18 May 2024 (UTC)
:: Your reply ~~~~

Navigate to first:


Microsoft keys

Talk status
This discussion is still ongoing.

The note about retaining the Microsoft keys could be amended such way that re-signing the Microsoft bootloader with the newly created keys is an alternative to retaining the Microsoft keys (KEK and db). I've tried this and it works very well for my system.

This might require a bit of "feeling lucky" during the testing stage after new keys have been installed in the system's UEFI, because if the keys do not work, even Windows will not boot any longer. Yet, instead of trusting every Microsoft-signed bootloader there is out there, re-signing only the bootloader for one's own system will keep the system's ability to dual-secure-boot Linux and Windows while locking out all other bootloaders, including Windows2Go and other Live-Systems without a locally signed loader.

EFI bootloaders are capable to carry more than one signature, thus, restoring the factory installed keys will keep Windows working while a locally signed Linux will be unable to boot anymore.

That being said I do not know what happens if a Windows update rewrites the Windows bootloader to the EFI partition. Chances are, Windows will no longer boot until the new loader has again been signed with local keys. — The preceding unsigned comment was added by Ftiede (talkcontribs)

Yes, unfortunately the MS bootloader is updated from time to time, so I'd be reluctant to advance this approach as the default. But it would certainly be worth putting in a note about it, as an alternative. I'll look to do that in my next edit pass. Thanks for the suggestion! --Sakaki (talk) 14:51, 23 November 2018 (UTC)
Yes, but so are Gentoo Kernels and GrUB. And since I'm running a Secure Boot configuration where GrUB actually checks signatures, re-signing Kernels and GrUB binaries, or sys-apps/fwupd for that matter, is a common task. Whereas I do admit that the latter ones are obvious to require a re-signing of EFI binaries while Windows will just silently overwrite the bootloader and then refuse to boot afterwards without much more than a Secure Boot error message. So, yeah, removing the Microsoft keys yields another set of problems. --Ftiede (talk) 15:22, 23 November 2018 (UTC)