17

When booting the OS, when we press F2 on start up, the bios screen comes up. Here, we have the option of enabling secure boot. I am given to understand that now the firmware verifies the signature of the bootloader which in turn verifies the signature of the kernel. In turn, the kernel verifies the signature of some other modules. If the verification fails at any point, the boot process is aborted. Now, with regard to all this, I have a few questions:

1) If the system boots properly when secure boot is enabled, can we assume that kernel is genuine as its signature has been verified?

2) What about other programs or commands which are run from the shell, like 'apt', 'rm', 'shasum', 'sudo', etc. Can we assume that the signatures for these are also verified and hence they are also genuine?

Improve this question
5
  • 9
    This question is not off topic because Secure Boot is supported by Windows 8 and 8.1, Windows Server 2012, and 2012 R2, and Windows 10, VMware vSphere 6.5[58] and a number of Linux distributions including Fedora (since version 18), openSUSE (since version 12.3), RHEL (since version 7), CentOS (since version 7), Debian (since version 10), and Ubuntu (since version 12.04.2). If it's supported by Ubuntu it should be supported by Ask Ubuntu too.
    – karel
    May 4, 2020 at 5:21
  • 2
    Keep in mind that Secure Boot is primarily not about keeping you secure, it's about keeping your computer "secure" from you.
    – chrylis -cautiouslyoptimistic-
    May 4, 2020 at 19:56
  • 5
    @chrylis-onstrike-, that's true only until you install your own key -- which you should, if the rest of the boot chain is adequately secured. Because yes, there are way too many things signed by the Microsoft key to get any value at all from trusting any/all of them; but once you're ensuring that only EFI binaries (say, kernel+initrd pairs) you personally approved are booting, that's actually useful; means nobody's booting, say, a known-vulnerable kernel they can later exploit to get to your disk encryption keys once you've logged in.
    – Charles Duffy
    May 4, 2020 at 20:11
  • 1
    @CharlesDuffy Assuming that you have the opportunity to do so. (And can you in general disable the built-in keys? I haven't seen an option to do that on the couple of machines I've built with UEFI.)
    – chrylis -cautiouslyoptimistic-
    May 4, 2020 at 20:38
  • 2
    @chrylis-onstrike-, ...honestly, I work for a hardware vendor, so when I disable the default key, I really disable the default key (and then need to replace the signatures on all the other UEFI drivers that came with the motherboard). I don't know offhand what it's like for folks coming at it from a consumer perspective.
    – Charles Duffy
    May 4, 2020 at 21:12

1 Answer 1

Reset to default
14

Only the software involved in the boot process is checked by secure boot.

  • The bootloader (Ubuntu uses grub in UEFI mode) and the kernel are checked; they should match a signature. I think also kernel drivers are checked, and unsigned drivers will be blacklisted, which might exclude some proprietary drivers for graphics and wifi.

  • Other software is not checked by the secure boot feature. This includes regular application programs, both command line (text mode) programs and graphics mode (GUI) programs , but also drivers for software, that are not kernel drivers and other help programs that can run in the background.

Secure boot is not enough to keep you safe. You must use other methods to avoid malware. Install programs from the Ubuntu repositories and maybe from well-known PPAs, but avoid programs from any random website (unless you have the source code and understand it). Remember that also websites and document files can be infected by malware.

Improve this answer
2
  • 5
    "unless you have the source code and understand it" --> this means the source code on your computer. Don't trust that the binary that you download corresponds to the source code that you see online (e.g. github), unless you can actually verify the checksum of the binary
    – Ciprian Tomoiagă
    May 4, 2020 at 19:05
  • 1
    @CiprianTomoiagă, Yes, thanks for making this clear.
    – sudodus
    May 4, 2020 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .