2.7 KiB
secureboot - linux style
general description
Usually UEFI secureboot relies on SHA256 and RSA-2048. The public keys are commonly stored as X.509 certificate.
Secure Boot typically implements the following keys and lists:
- PK - Platform Key - Composed of two parts, PKpub (the public key) and PKpriv (the private key), used to sign the KEK.
- KEK - Key Exchange Key - The key used to sign the Signatures and Forbidden Signatures database, there can be more than one.
- db - Signature Database - Contains lists of public keys, signatures, and hashes which are allowed as part of the boot chain.
- dbx - Forbidden Signature Database - The opposite of the signature database, public keys, signatures, and hashes which should never be allowed to boot.
Only one Platform Key can be used on a system, each other type is actually a list or "database". It is common to include the device Manufacturer's Key Exchange Key, and sometimes Microsoft's. On some devices, removing either of these keys could disable all video output.
Several key formats and extensions are used with Secure Boot:
- .key - PEM - Used for private keys.
- .crt - PEM - Used for public keys.
- .cer - DER - Used for public keys.
- .esl - EFI Signature List - Used by EFI, a collection of public keys and hashes.
- .auth - Signed EFI Signature List - Used by EFI, signed form of an esl.
.esl EFI signature lists are based on UUIDs, which are needed to organize the whole thing. Therefore a UUID is needed, not neccessarly a common one but it helps within an organization.
tools
for shim (https://github.com/rhboot/shim) (debian, ubuntu, fedora, ...) there is the tool mokutil. The idea behind is to define a Machine-Owner-Key. This is system administrator for this specific device and get 'shimed' in between the secureboot and the linux kernel. The shim is signed by microsoft and allows to load signed efi binaries. Usually it is bundled with grub2. This multistaged trust chain has advantages, but however it is much more easy and resiliant to switch completely to the systemd-boot/uniky universe and skip the shim/grub/initramfs/kernel thing. Nevertheless, shim gets better und implements bugfixes, features and enhancements. But a major problem is the missing PCR for the kernel cmdline.
otherwise the sbctl is useful, but it can be done more or less manually.
the kernel deploys the efi vars as sysfs entries. To manipulate those, the sbsigntools can be used. The key handling or anything else is up to the user. https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/about/
systemd
omv
install needed software:
apt install sbsigntool efibootmgr efitools uuid-runtime