Add UEFI/SecureBoot docs from Ubuntu wiki #2088
Conversation
| module.ko | ||
|
|
||
|
|
||
| Using :command:`signfootl.exe` from Microsoft |
| There are two options: | ||
|
|
||
| - Using Ubuntu directly with :command:`sbsign` and :command:`kmodsign`. | ||
| - Using the "real" method used by Microsoft to sign binaries with a Windows-only application. |
There was a problem hiding this comment.
I think it's worth mentioning that both methods are just as real.
Microsoft signing is so that off-the-shelf Windows machines will trust your binary, otherwise you have to enroll your public key in the firmware.
Also worth noting that Microsoft signing is only available and should only be used for production code that is expected to be used by regular users on off the shelf hardware.
|
|
||
| .. code:: none | ||
|
|
||
| uvt new --loader=OVMF.fd --with-ovmf-uefi xenial amd64 sb |
|
|
||
| .. code:: none | ||
|
|
||
| virt-install --connect=qemu:///system --name=sb-xenial-amd64 --arch=x86_64 --ram=2048 \ |
There was a problem hiding this comment.
also maybe we should be promoting our own product, LXD, instead of libvirt?
|
|
||
| .. _efi-shell: | ||
|
|
||
| EFI shell |
There was a problem hiding this comment.
EFI shell should be removed from SB article as EFI shell is forbidden from SB signing, and cannot be included in SB firmware images anymore.
| Bootloader signed with Canonical key | ||
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| This emulates a configuration that supports machines with Canonical's key in KEK and DB (user key still in PK and KEK). The key database is configured with (user key in PK and KEK has the same GUID, Canonical key in KEK and db has the same GUID): |
There was a problem hiding this comment.
Canonical's key should be only used via shim, and not via KEK and DB currently, suggesting this is insecure.
|
@rkratky a large part of this content is incredibly out of date, and some parts of it suggest insecure practices, I am honestly not sure if we should be displaying this in this state anywhere. |
This adds content related to UEFI Secure Boot from the Ubuntu Wiki -- as a part of the effort to migrate docs from the wiki.
Notes:
.wokeignorefile has been moved to the root of the repo temporarily because of an upstream bug: Nested .wokeignore doesn't work in a git repo. get-woke/woke#212