Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux and Secure Boot certificate expiration

lwn.net

Post reply on HN
Print view View original

201–210 of 272 posts

Re: Linux and Secure Boot certificate expiration

#201

Post by londons_explore »

Tuna-Fish wrote: post #193
AnotherGoodName wrote: post #179

Earlier quoted context omitted.

Expired certificates should also at worst be a skippable warning. No one’s relying on certificates expiring for security. If you did you might have to wait many years for the expiration of a stolen certificate - lol! It’s absolutely a minor “hey btw the certificate expired, check for an update” yet various systems treat certificate expiration as an end of the world lock it down scenario.

Oh it's skippable all right. Just pull the cmos battery and wait a few seconds before putting it back in.

There's gonna be a bunch of linux users who write a shutdown script to set the date back to 2015 then poweroff... And at startup, reset the date back to today using the internet.

Sounds like a cleaner solution than any of the ones in the article too!

Re: Linux and Secure Boot certificate expiration

#202

Post by jeroenhd »

lillecarl wrote: post #191
craftkiller wrote: post #189

Earlier quoted context omitted.

You're conflating secure boot with measured/verified boot.

They don't work in tandem? I enable secureboot with sbctl(securebootctl) and enroll keys in a TPM using the same tool as far as I can remember. Or is this just some technical detail that in practice is under the same tools and settings?

By default, the secure boot status is part of the TPM registers that are used to unseal the encryption key for your drive. That's because if you disable secure boot, or reconfigure it with different keys, any bootloader could just replay measurements from a normal Linux system to the TPM and unlock your drive.

If you want, you can pick a different set of registers to use. The Arch wiki has a bunch of them: https://wiki.archlinux.org/title/Trusted_Platform_Module#Acc...

Calling systemd-cryptenroll with --tpm2-pcrs would allow you to manually pick a set of options. I believe Bitlocker uses 0, 2, 7, and 11 (11 being an OS specific register rather than a spec-defined one), which is why firmware updates often make you re-enter your Bitlocker key. Some people choose to only record the secure boot state, relying on the firmware to validate its own updates and config, which means you don't need your recovery key after firmware updates as long as the secure boot state remains the same.

Not taking secure boot state into account makes the entire setup rather easy to bypass, but you could do it to make your setup harder to break while still protecting against the "thief steals my SSD but not my laptop" scenario.

Re: Linux and Secure Boot certificate expiration

#203

Post by Sophia95 »

TLDR Linux systems using Secure Boot rely on a Microsoft certificate (from 2011) that will expire on September 11, 2024. After that, new Linux installs using Secure Boot may fail to boot unless the system firmware includes Microsoft’s newer 2023 key and updating the key often requires a firmware update from hardware vendors which doesn’t always happen. It’s crazy that many users are relying on an outdated Microsoft key unknowingly (I will be checking if I’m among them smh) Also great that people are bringing awareness to this

Re: Linux and Secure Boot certificate expiration

#204

Post by salawat »

bayindirh wrote: post #198
willa_bombadier wrote: post #174

Earlier quoted context omitted.

There should be some “Sane Usage” certification that a device doesn’t do secure boot, provides fully open and self-maintainable hardware, is independent of all external entities for ongoing use, provides hardware switches to turn off built-ins like ports, mics, and cameras, for power-savings and security.

To be able to get Windows licenses and preload Windows on your system, put that little Windows sticker and sell your machine to the masses, you need a Windows Compatibility certificate, and that certificate needs you to have Secure Boot and enabled by default.

Sounds anti-competitive as fuck to me. Maybe we should, I don't know; do something about companies using contractual requirements to lock key industrial into one way of doing things in order to shut down such efforts?

Re: Linux and Secure Boot certificate expiration

#205

Post by bayindirh »

msgodel wrote: post #195
pydry wrote: post #186

Earlier quoted context omitted.

"Will this piss off or delight Microsoft?" is probably a thought that goes through the heads of many OEMs when they decide how to design their machines.

Weirdly Microsoft has been one of the companies ensuring Linux remains bootable on PCs.

Bill Gates famously asked: "Can we create a standard or expand something like ACPI, so Linux becomes unbootable on PCs?"

So, believing this is very, very hard.

Re: Linux and Secure Boot certificate expiration

#206

Post by Tuna-Fish »

londons_explore wrote: post #201
Tuna-Fish wrote: post #193

Earlier quoted context omitted.

Oh it's skippable all right. Just pull the cmos battery and wait a few seconds before putting it back in.

There's gonna be a bunch of linux users who write a shutdown script to set the date back to 2015 then poweroff... And at startup, reset the date back to today using the internet. Sounds like a cleaner solution than any of the ones in the article too!

That's risky, an unclean shutdown would require resetting the clock which is a bother.

It's much more likely that someone will write a driver that adds an offset to the clock, keeping the hw date in a safe range.

Re: Linux and Secure Boot certificate expiration

#208

Post by pydry »

msgodel wrote: post #195
pydry wrote: post #186

Earlier quoted context omitted.

"Will this piss off or delight Microsoft?" is probably a thought that goes through the heads of many OEMs when they decide how to design their machines.

Weirdly Microsoft has been one of the companies ensuring Linux remains bootable on PCs.

Microsoft has been trying to tread a fine line between exerting subtle pressure on OEMs to make Linux annoying to boot so it doesnt become more popular and not violating the terms of its antitrust agreement.

Re: Linux and Secure Boot certificate expiration

#209

Post by sgjohnson »

ahoka wrote: post #181
vbezhenar wrote: post #175

Earlier quoted context omitted.

There's some link between secure boot and encryption. If you don't do secure boot, you need to secure your boot chain in other ways, to prevent attacker from modifying your software to log entered passphrase. Secure boot allows to build a verifiable chain of software (UEFI -> Bootloader -> Kernel -> Initrd) which will protect against any modification, so you can be sure that your key presses are not being logged by t…

I think it’s primarily to avoid someone just putting your SSD into any other computer and access all files. Anything more is probably not a realistic threat to most people.

Secure Boot does nothing whatsoever to prevent that. Disk Encryption has got nothing to do with Secure Boot.

Re: Linux and Secure Boot certificate expiration

#210

Post by Maxious »

LocalH wrote: post #200

It irks me that Microsoft managed to shim their way into the Linux boot process like this. No key signed by Microsoft should ever come into play when booting Linux, on a moral basis.

you dont have to use the shim, just follow this https://www.rodsbooks.com/efi-bootloaders/controlling-sb.htm...
Post reply on HN