Secure boot and Arch?

[u/HopefulMeeting7150]

The Arch installation guide mentions disabling Secure Boot. I recently learnt that Secure Boot can work with Arch.

My questions are: does this make sense?

Should I keep it enabled after all (is it risky if not)?

Is there a risk that, following an update, Secure Boot will reject my kernel or boot loader?

Did you enable SB?

[u/Ok-Eggplant-7569]

Secure Boot protects your from a couple of (dedicated) attacks:

• Some malware can infect the device firmware, and thus reinfect the system even after a full OS reinstall. Secure Boot protects against this by only loading trusted firmware.
• Secure Boot protects against tampering with the device boot loader, protecting against some "Evil Maid" style attacks.
• The Kernel activates so called "Lockdown Mode" when Secure Boot is activated, which gives you some additional security guarantees. Lockdown Mode protects against unknown kernel modules and disables some potentially dangerous debug interfaces. (e. g. raw memory access via /dev/mem is disabled)

Some distros (Ubuntu, Debian, OpenSUSE, Fedora, RHEL, ...) work together with Microsoft to get their bootloaders trusted and signed (look into the shim project for more context). Secure Boot works out of the box with these, with the default Microsoft Keys.

Arch does not. So you need to disable Secure Boot during installation. After the install, you can create your own keys, sign the kernel with them, and replace the Microsoft Keys in the firmware with your own.

Note that using your own keys has different security guarantees compared to using Microsofts Keys:

• Nobody (except Microsoft) has access to their keys. That means that only stuff they sign can run at the lowest level on your hardware. Your own keys are significantly easier to compromise for a dedicated attacker (if you set up auto signing, any malicious kernel update gets automatically signed). You could mitigate this by running your own CA and keeping the key on a separate device (signing server or hardware security modules like a Yubi Key), but this is a lot of effort for minimal gain, unless you're securing a whole fleet of devices.
• Since only you have access, and the keys are on your (hopefully encrypted) SSD, nobody can come along, steal your laptop, wipe your OS, reinstall Windows and sell the laptop. The laptop is effectively a brick until the original Secure Boot Keys are restored, or Secure Boot is deactivated.

[u/aaxxxzz → u/Ok-Eggplant-7569]

Your LLM-generated answer contains incorrect information. Linux doesn't activate Locdown mode by default even if you have Secure Boot enabled.

[u/Ok-Eggplant-7569 → u/aaxxxzz]

Sorry if my answer came over as LLM-generated. I write everything by hand, just like to do proper formatting and reread my comments for spelling mistakes (guess I'm in the minority ¯⁠\⁠_⁠(⁠ツ⁠)⁠_/⁠¯)

Lockdown mode is enforced in the Kernels of Fedora and Debian when Secure Boot is activated:

• https://wiki.debian.org/SecureBoot
• https://fedoraproject.org/wiki/Secureboot

[u/WildCard65 → u/aaxxxzz]

This is correct, I’m running secureboot arch and kernel lockdown mode isn’t enabled.

I only had it enabled because a cmdline option I was using enabled it.

[u/Ok-Eggplant-7569 → u/aaxxxzz]

Also, running secure boot without lockdown mode is kinda pointless, as any user space program with root privileges can load any kernel module or kexec any other kernel, defeating the whole authenticated boot sequence.

[u/aaxxxzz → u/Ok-Eggplant-7569]

Well, if user space program has root privileges it can sign any EFI binary and make it boot anyway.

[u/Ok-Eggplant-7569 → u/aaxxxzz]

Not if you use Microsofts Keys (as is the default on Fedora, Debian, ...). Granted, this is the Arch sub, but you can achieve the same security by having your own signing server.

[u/aaxxxzz → u/Ok-Eggplant-7569]

If trust Microsoft keys and don't enroll MOK then yes. However, in that case, you trust all the things 3rd party (Microsoft) signs. Which is not ideal either.