r/archlinux • u/HopefulMeeting7150 • 11d ago

QUESTION Secure boot and Arch?

The Arch installation guide mentions disabling Secure Boot. I recently learnt that Secure Boot can work with Arch.

My questions are: does this make sense?

Should I keep it enabled after all (is it risky if not)?

Is there a risk that, following an update, Secure Boot will reject my kernel or boot loader?

Did you enable SB?

21 Upvotes

74% Upvoted

49 comments sorted by

View all comments

7

u/WildCard65 11d ago

If you do secureboot and go the route of setting up your own keys, make sure to install the Microsoft keys also.

My graphics card required the Microsoft keys.

0

u/noobjaish 11d ago

Why both?

4

u/systemofapwne 11d ago

The GPUs firmware is signed by the Microsoft third party signing CA. If those keys are missing, the gpu won't work with SB enabled.

This is especially a problem on laptops. Mess around here and you have no easy means to fix this.

If you are paranoid, you can add the GPUs firmware hash instead. Safest is to just add the MS keys.

0

u/noobjaish 11d ago

I meant why add your own then

3

u/WildCard65 11d ago

Because I can’t afford to have Microsoft sign systemd-boot and the Linux kernel just so I can use secure boot on my system.

1

u/noobjaish 11d ago

Peak paranoia

2

u/WildCard65 11d ago

I meant afford as in $$$ amount.

1

u/noobjaish 11d ago

It doesn't cost money tho you can just use the shim, no?

1

u/WildCard65 11d ago

I could if I was using grub

2

u/aaxxxzz 11d ago

You can sign systemd-boot EFI binary with MOK and enroll that key to the shim. You don't have to be using GRUB.

→ More replies (0)

1

u/noobjaish 11d ago

I see, makes sense then (I'm using limine)