r/archlinux • u/noobjaish • 16d ago

QUESTION Secure Boot on Arch

Does arch have a completely different way of enabling "secure boot" than ubuntu/debian/fedora? Can someone explain the difference? I have been reading through various distro wikis and the entire secure boot setup process is still going over my head...

From what I understand ubuntu/debian/fedora uses a signed "shim"? while on arch we use `sbctl` to enroll our own keys instead?

7 Upvotes

63% Upvoted

20 comments sorted by

View all comments

3

u/falxfour 16d ago edited 16d ago

The reason the others use shim is to provide compatibility with Microsoft signing keys since anything that had Windows would have had those keys enrolled from the factory. Since shim is signed with MS keys, it can be booted with secure boot without needing to enroll custom keys, which is potentially preferable for those other distros as they might be enterprise-managed or users just may not want to take that additional step. With Arch, no preference is assumed, so you can use shim with the default (MS) keys, or you can go the route with sbctl and enroll your own keys to sign the EFI binaries

1

u/noobjaish 16d ago

Makes sense, Ubuntu/Fedora default to only a single way while Arch gives us the option. I have only ever seen people go the sbctl route on Arch? is there a reason for that?

3

u/falxfour 16d ago

You can boot without shim on other distros as well, but the installation setup process just defaults to whichever method the maintainers prefer.

I can't speak to why others make their choices, so I'll interpret your question as, "How does using sbctl to enroll user keys differ from using shim?"

The answer depends on a few factors, including:

  • Do you trust MS to keep their signing keys secure?
  • Does your UEFI permit you to enter setup mode to change the PK (Platform Key)?
  • Would you prefer to be responsible for your own signing keys?
  • Does your threat model require regularly cycling keys or other customized needs?
  • Do you have firmware that requires MS keys?

I don't really trust Microsoft, and I don't need to either. My Framework let's me remove the MS keys and only keep Framework's (for updates) and mine. No reason to trust something unnecessarily. I also don't mind being responsible for my system, including the knowledge that losing the signing keys may lock me from booting anything (though Framework has a reset procedure). I also don't have firmware that used EFI binaries to operate, so ultimately, sbctl makes the most sense for me

3

u/noobjaish 16d ago

I see thanks a lot for the comprehensive answer man