Debian 9.0 "Stretch" Might Not Have UEFI Secure Boot Support

[phoronix]

Phoronix: Debian 9.0 "Stretch" Might Not Have UEFI Secure Boot Support

Debian 9.0 "Stretch" has seen UEFI Secure Boot support no longer being considered a release blocker but is now just a stretch goal for this upcoming release...

http://www.phoronix.com/scan.php?page=news_item&px=Debian-9-Secure-Boot-Maybe-Not

[Kohrias]

No loss at all. "Secure" boot is an anti-feature anyway.

[edoantonioco]

I dont have the option to turn it off. But its not like if I were going to install debian on my laptop

[stikonas]

No loss at all. "Secure" boot is an anti-feature anyway.

On the contrary, it is quite useful. On my laptop I have full disk encryption, so /root and /boot are in one big LUKS volume. only 1 MiB partition in front is unencrypted and it contains a single file, grubx64.efi signed by my own secure boot key which is the only thing that Secure Boot allows to boot here. So evil made attack becomes impractical. You can't replace my signed bootloader with something else.

[Kohrias]

On the contrary, it is quite useful. On my laptop I have full disk encryption, so /root and /boot are in one big LUKS volume. only 1 MiB partition in front is unencrypted and it contains a single file, grubx64.efi signed by my own secure boot key which is the only thing that Secure Boot allows to boot here. So evil made attack becomes impractical. You can't replace my signed bootloader with something else.

Since when are you allowed to sign yourself? Don't you need a third party to that (i.e. Microsoft)?

[starshipeleven]

Since when are you allowed to sign yourself? Don't you need a third party to that (i.e. Microsoft)?

You need to be able to import your own key in the UEFI firmware, which is a feature that exists in a relatively large amount of UEFI firmwares nowadays. If there isn't, try checking for BIOS updates because on average the feature was added in a later version (as the ability to turn of Secure Boot for many systems).

For example I could do that too on my ASUS x102ba that is from 2013.

You can also delete keys.

[stikonas]

You need to be able to import your own key in the UEFI firmware, which is a feature that exists in a relatively large amount of UEFI firmwares nowadays. If there isn't, try checking for BIOS updates because on average the feature was added in a later version (as the ability to turn of Secure Boot for many systems).

For example I could do that too on my ASUS x102ba that is from 2013.

You can also delete keys.

Yeah. There are even some programs (efitools) to do it from the OS although on my laptop it didn't work. But doing it from BIOS worked. Including removal of microsoft key.

[hax0r]

I'm largely UEFI Pro,
It is nice to have a firmware that can understand FAT32 natively,
No need for OS-like bootloaders anymore you can boot kernel directly via EFI stub,
You can also sign your kernel modules, I imported my own pubkey into the UEFI from usb and compile signed kernel
There exist free shims that have been signed with Microsoft key, distros like Ubuntu and Fedora include it and make installations painless on Secure Boot enabled systems

[Veerappan]

Last I checked, turning off secure boot on my work laptop would break the full disk encryption for the windows partition... While I wouldn't mind, our IT overlords wouldn't like that showing up in the audits...

So yeah, not supporting secure boot is a bit of a deal breaker for me

[starshipeleven]

There exist free shims that have been signed with Microsoft key, distros like Ubuntu and Fedora include it and make installations painless on Secure Boot enabled systems

shims set to boot only Grubs signed with Ubuntu/Fedora keys that are also configured to boot only signed Ubuntu/Fedora kernels (and Windows). Same for OpenSUSE. And since all this stuff is signed, you can't tamper with it to have it boot something else.

MS didn't sign their shims for lulz, there is a commercial agreement.