Dev1 Galaxy Forum / Using secure boot

Re: Using secure boot

dummy@example.com (siva) — Wed, 06 Jan 2021 04:47:32 +0000

Head_on_a_Stick wrote:

Secure boot should work out of the box for Devuan beowulf with no special configuration needed. Just boot the machine in UEFI mode with Secure Boot enabled and make sure that the target drive has either a GUID partition table (GPT)...

These are the answers I live for. Thanks to both of you for the advice. Looks like everything is up and running now.

Re: Using secure boot

dummy@example.com (Head_on_a_Stick) — Tue, 05 Jan 2021 23:22:30 +0000

Or just rename the directory and create a new boot entry for it:

# efibootmgr --create --label "Devaun Secure Boot' --disk /dev/sdX --part Y --loader \EFI\debian\shimx64.efi

Replace X & Y with the drive letter & partition number assigned to the EFI system partition. The command assumes this to be /dev/sda1 so those options can be omitted if that is the case.

Re: Using secure boot

dummy@example.com (fsmithred) — Tue, 05 Jan 2021 22:25:09 +0000

If it doesn't work out of the box, check that the bootloader directory in /boot/efi/EFI/ is named debian. If not, you might need to change ID=devuan to ID=debian in /etc/os-release and then reinstall the bootloader.

Re: Using secure boot

dummy@example.com (Head_on_a_Stick) — Tue, 05 Jan 2021 21:40:02 +0000

Secure boot should work out of the box for Devuan beowulf with no special configuration needed. Just boot the machine in UEFI mode with Secure Boot enabled and make sure that the target drive has either a GUID partition table (GPT) or no partition table at all.

https://www.debian.org/releases/stable/ … ecure-boot

If you want to pre-partition before installation then use a GPT disk and make sure it has an EFI system partition. I prefer to create the partition table using gdisk, which uses the EF00 code for the ESP. For {g,}parted the "boot,esp" flags should be applied. The FAT filesystem should be used for the ESP but the installer will do that for you and mount it under /boot/efi.

Using secure boot

dummy@example.com (siva) — Tue, 05 Jan 2021 20:45:09 +0000

I'm looking to install a Devuan build on a new laptop. I'd like to use secure boot, but have never actually used it before. The official Debian wiki has a lengthy article on it, but I'm having trouble anticipating if I'm following it correctly.

Before going too far (or leaving myself with a broken operating system), I wanted to get some clarification on how to set up secure boot in Devuan. My understanding on how to do so is fragmented. Right now it seems like it'd be similar to:

1. Install Devuan with grub-efi.
2. Boot to the new system.
3. Install shim.
4. Follow the MOK setup procedures.
5. Check with dmesg | grep -i Secure or efibootmgr -v.

Please feel free to correct me if I'm wrong. Wold much rather know now. By the end of this, I'll probably write a DIY article.

Also, if anyone has successfully pulled off secure boot in virtualbox, I'm interested to know how you configured that to work.

Thanks. Happy 2021.

Sources

https://wiki.debian.org/SecureBoot
https://medium.com/@kyleomalley/debian- … 6f3b24218b