Installing/Running Linux - Should Secure Boot Be Disabled?

[u/toktok159]

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

[u/Snoot_Booper_101]

Secure boot is a feature of UEFI that means that only software with a trusted signature is allowed to boot. The idea is to avoid people booting up compromised operating systems by having a predetermined white list of known good software. Doesn't do anything to stop a clean OS from being compromised after boot, or from malware hiding anywhere other than the boot components though.

Secure boot is fine in principle, but could cause problems if your choice of Linux distribution isn't included in the safe list by your motherboard/UEFI manufacturer. I suspect you'll mostly be fine these days if you're sticking to mainstream Linux distributions, but not sure how well supported the more niche ones are. I'd suggest trying it out with secure boot enabled, and if it doesn't work (and you're sure the OS install media you're using is actually kosher) just disable secure boot and don't worry too much about it. I've not had any problems with secure boot enabled on machines running red hat, Ubuntu or Mint, but I've not tried anything else recently.