search

nix-community / lanzaboote

Secure Boot for NixOS [maintainers=@blitz @raitobezarius @nikstur]
GNU General Public License v3.0
918 stars 44 forks source link

Plan for Shim integration #165

Open shlevy opened 1 year ago

shlevy commented 1 year ago

Some systems (e.g. as far as I can tell my new HP Spectre 360) do not allow for enrolling new keys, and so need to use something like https://github.com/rhboot/shim which a) has MS-signed binaries available (e.g. from Fedora/Ubuntu) and b) allows for user-controlled keys separate from the core firmware limitations.

From what I've gathered, this will require:

  1. Installing the signed stub as grubx64.efi next to the shim efi (yes, it must literally must have that name and filesystem location)
  2. Adding the signing keys to the shim database
  3. Teaching the stub to use the shim protocol for validating the image (See https://github.com/systemd/systemd/issues/24574 for a somewhat related issue for systemd-boot).

See https://www.rodsbooks.com/efi-bootloaders/secureboot.html#shim for the best source of info I've found about shim.

RaitoBezarius commented 1 year ago

I do have plans for shim, it is much more ambitious though. (I have a draft somewhere I shared with NixOS infra, security and NixOS SecureBoot community).

It involves having NixOS Foundation custody of a vendor certificate for a shim signed by Microsoft through the shim-review project.

Though, we need much more maturity before reaching this "mainstream SecureBoot", obviously, what you're asking for, is an in-between thing.

We are trying to get our stub feature parity with systemd-stub in https://github.com/nikstur/sd-stub-rs ; our plan is to upstream it and inherit from it for NixOS after that.

In all cases, achieving (1) and (2) is already ~possible, we can already accept a PR for (3) in sd-stub-rs or in lanzaboote (preferably sd-stub-rs).

nikstur commented 1 year ago

Also noteworthy is that we have already coordinated with the systemd maintainers a little bit about sd-stub-rs: https://github.com/systemd/systemd/issues/26640

If I remeber correctly there is some issue/uncertainty if we can even use sd-boot with the shim, right? The systemd guys are already working on that though (at least that's what I heard at FOSDEM).

MarkGhanz commented 1 year ago

In the meantime, is there a way to sign the BOOTX64.EFI and systemd-boot efi binary with microsoft's keys? My system won't let the signed systemd-boot binary pass even it was signed, although not by Microsoft's keys. The optional roms on my GPU functions normally, but it seems my motherboard's firmware won't let anything not signed by microsoft pass though.

RaitoBezarius commented 1 year ago

Unfortunately, I (but probably we) don't have spare cycles to work on this.

It's not possible to sign BOOTX64.EFI and systemd-boot.efi binary with MSFT keys, to the best of my knowledge, no systemd-boot.efi binary is signed publicly at least. So it's not even a NixOS problem, we cannot do anything about it alas.

The only solution is to use a signed GRUB then chainload NixOS.

The security provided by a SecureBoot protected by MSFT keys is really small so it's not high priority on my list. Add to this that GRUB is a pain…

This is about shim which is another subject which could enable you to do: shim → systemd-boot → NixOS with a MOK key.

yshui commented 2 months ago

hi, is it possible to have an option to stop lanzaboote from installing systemd-bootx64.efi to /EFI/Boot/bootx64.efi? I have the shim manually setup, doing so will overwrite it.

Would be even better if I can configure where systemd-boot is installed.