← Back to context

Comment by westurner

9 days ago

mokutil and these commands don't work without UEFI:

  mokutil --sb-state
  mokutil --help
  mokutil --import key.der
  mokutil --list-new
  reboot

  efibootmgr
  efivar

  fwupd
  fwupdtool
  fwupdmgr get-updates && \
  fwupdmgr update

  tree /sys/firmware/efi

  systemctl reboot --firmware-setup

4 comments

westurner

Reply
my123  8 days ago

Note that UEFI doesn't mean supporting most of those.

UEFI without runtime UEFI variable writes is a thing, and that configuration is incompatible with mokutil.

  • westurner  8 days ago

    FWIU,

    There is no SecureBoot without UEFI.

    UEFI without SecureBoot does have advantages over legacy BIOS with DOS MBR.

    > UEFI without runtime UEFI variable writes is a thing

    Which vendors already support this?

    Do any BIOS - e.g. coreboot - support disabling online writes to EFI? (with e.g. efibootmgr or efivar or /sys/firmware/efi)

    One of the initial use cases for SecureBoot is preventing MBR malware.

    What there be security value to addding checksums or signatures as args to each boot entry in grub.cfg for each kernel image and initial ramdrive?

    Unless /boot is encrypted, it's possible for malware to overwrite grub.cfg to just omit signatures for example.