Plan for Shim integration

shlevy commented

2023-04-28 19:35:29 +00:00

(Migrated from github.com)

Some systems (e.g. as far as I can tell my new HP Spectre 360) do not allow for enrolling new keys, and so need to use something like https://github.com/rhboot/shim which a) has MS-signed binaries available (e.g. from Fedora/Ubuntu) and b) allows for user-controlled keys separate from the core firmware limitations.

From what I've gathered, this will require:

Installing the signed stub as grubx64.efi next to the shim efi (yes, it must literally must have that name and filesystem location)
Adding the signing keys to the shim database
Teaching the stub to use the shim protocol for validating the image (See https://github.com/systemd/systemd/issues/24574 for a somewhat related issue for systemd-boot).

See https://www.rodsbooks.com/efi-bootloaders/secureboot.html#shim for the best source of info I've found about shim.

Some systems (e.g. as far as I can tell my new HP Spectre 360) do not allow for enrolling new keys, and so need to use something like https://github.com/rhboot/shim which a) has MS-signed binaries available (e.g. from Fedora/Ubuntu) and b) allows for user-controlled keys separate from the core firmware limitations. From what I've gathered, this will require: 1. Installing the signed stub as grubx64.efi next to the shim efi (yes, it must literally must have that name and filesystem location) 2. Adding the signing keys to the shim database 3. Teaching the stub to use the shim protocol for validating the image (See https://github.com/systemd/systemd/issues/24574 for a somewhat related issue for systemd-boot). See https://www.rodsbooks.com/efi-bootloaders/secureboot.html#shim for the best source of info I've found about shim.

👍 1

RaitoBezarius commented

2023-04-28 22:11:19 +00:00

(Migrated from github.com)

I do have plans for shim, it is much more ambitious though. (I have a draft somewhere I shared with NixOS infra, security and NixOS SecureBoot community).

It involves having NixOS Foundation custody of a vendor certificate for a shim signed by Microsoft through the shim-review project.

Though, we need much more maturity before reaching this "mainstream SecureBoot", obviously, what you're asking for, is an in-between thing.

We are trying to get our stub feature parity with systemd-stub in https://github.com/nikstur/sd-stub-rs ; our plan is to upstream it and inherit from it for NixOS after that.

In all cases, achieving (1) and (2) is already ~possible, we can already accept a PR for (3) in sd-stub-rs or in lanzaboote (preferably sd-stub-rs).

I do have plans for shim, it is much more ambitious though. (I have a draft somewhere I shared with NixOS infra, security and NixOS SecureBoot community). It involves having NixOS Foundation custody of a vendor certificate for a shim signed by Microsoft through the shim-review project. Though, we need much more maturity before reaching this "mainstream SecureBoot", obviously, what you're asking for, is an in-between thing. We are trying to get our stub feature parity with systemd-stub in https://github.com/nikstur/sd-stub-rs ; our plan is to upstream it and inherit from it for NixOS after that. In all cases, achieving (1) and (2) is already ~possible, we can already accept a PR for (3) in sd-stub-rs or in lanzaboote (preferably sd-stub-rs).

👍 1

nikstur commented

2023-04-29 13:20:56 +00:00

(Migrated from github.com)

Also noteworthy is that we have already coordinated with the systemd maintainers a little bit about sd-stub-rs: https://github.com/systemd/systemd/issues/26640

If I remeber correctly there is some issue/uncertainty if we can even use sd-boot with the shim, right? The systemd guys are already working on that though (at least that's what I heard at FOSDEM).

Also noteworthy is that we have already coordinated with the systemd maintainers a little bit about sd-stub-rs: https://github.com/systemd/systemd/issues/26640 If I remeber correctly there is some issue/uncertainty if we can even use sd-boot with the shim, right? The systemd guys are already working on that though (at least that's what I heard at FOSDEM).

MarkGhanz commented

2023-05-07 23:27:44 +00:00

(Migrated from github.com)

In the meantime, is there a way to sign the BOOTX64.EFI and systemd-boot efi binary with microsoft's keys? My system won't let the signed systemd-boot binary pass even it was signed, although not by Microsoft's keys. The optional roms on my GPU functions normally, but it seems my motherboard's firmware won't let anything not signed by microsoft pass though.

RaitoBezarius commented

2023-05-08 16:29:39 +00:00

(Migrated from github.com)

Unfortunately, I (but probably we) don't have spare cycles to work on this.

It's not possible to sign BOOTX64.EFI and systemd-boot.efi binary with MSFT keys, to the best of my knowledge, no systemd-boot.efi binary is signed publicly at least. So it's not even a NixOS problem, we cannot do anything about it alas.

The only solution is to use a signed GRUB then chainload NixOS.

The security provided by a SecureBoot protected by MSFT keys is really small so it's not high priority on my list.
Add to this that GRUB is a pain…

This is about shim which is another subject which could enable you to do: shim → systemd-boot → NixOS with a MOK key.

Unfortunately, I (but probably we) don't have spare cycles to work on this. It's not possible to sign BOOTX64.EFI and systemd-boot.efi binary with MSFT keys, to the best of my knowledge, no systemd-boot.efi binary is signed publicly at least. So it's not even a NixOS problem, we cannot do anything about it alas. The only solution is to use a signed GRUB then chainload NixOS. The security provided by a SecureBoot protected by MSFT keys is really small so it's not high priority on my list. Add to this that GRUB is a pain… This is about shim which is another subject which could enable you to do: shim → systemd-boot → NixOS with a MOK key.

yshui commented

2024-08-25 17:29:53 +00:00

(Migrated from github.com)

hi, is it possible to have an option to stop lanzaboote from installing systemd-bootx64.efi to /EFI/Boot/bootx64.efi? I have the shim manually setup, doing so will overwrite it.

Would be even better if I can configure where systemd-boot is installed.

hi, is it possible to have an option to stop lanzaboote from installing `systemd-bootx64.efi` to `/EFI/Boot/bootx64.efi`? I have the shim manually setup, doing so will overwrite it. Would be even better if I can configure where systemd-boot is installed.

👍 1

Rows
Columns

Plan for Shim integration #165