Does FreeBSD support SecureBoot? reddit / freebsd ---------------------------------------------------------------------- turtle1470 · 2023-12-20 22:31 Please, correct me if i'm wrong: according to [this](https://wiki.freebsd.org/SecureBoot) wiki page, FreeBSD doesn't support booting with SecureBoot enabled... yet. Among other things, "Acquire FreeBSD signing key " step is marked as "Not started". There is no problem with disabling SecureBoot from bios, but you can really have hard times trying to use a dual boot system with Windows 11 and FreeBSD. ---------------------------------------------------------------------- i_lost_my_bagel · 2023-12-20 23:20 Doesn't look like it and also I've dual booted with windows 11 and freebsd with secure boot turned off so it shouldn't cause any problems. ---------------------------------------------------------------------- _Lee_B_ · 2023-12-21 01:25 No, but note that secure boot is basically hogwash. Protecting physical devicesi is where physical security, like locked rooms and security cameras and armed guards comes in. If someone has control of the physical device that your software runs on, then you have NO guarantees that the hardware is secure. The "CPU" could tell the software anything, while being entirely emulated. "You want a TPM? Sure, here's a 'TPM' for you. You want to check a key's valid? Sure bud, it's valid." Enterprises have those locked rooms and physical guards and things protecting their systems, so SecureBoot is not about protecting their enterprise property that's in the enterprise: it's about stopping the people who own their own hardware, at home, after buying it, from being able to use and modify that hardware too easily. ---------------------------------------------------------------------- BadSlime · 2023-12-21 02:10 SecureBoot is useless, supporting it in FreeBSD does not make sense. The lack of support from FreeBSD should not interfere with a Windows 11 dual boot if it is disabled in BIOS. I'm not sure what happens if you turn on SecureBoot in the BIOS and try to boot FreeBSD because I have never enabled it on a personal computer. ---------------------------------------------------------------------- PkHolm · 2023-12-21 04:13 SecureBoot is not designed to protect from attacks on hardware. It protects you from modification of system software you considered trusted. Resent LogoFAIL attack shows it not everything as secure as it seems but still it is better than unprotected boot chain. ---------------------------------------------------------------------- usernamefindingsucks · 2023-12-21 06:15 In my understanding, the signing key is the least of the issues. Until the other stuff is done and the key becomes necessary, just making the signing increases the risk of it's inadvertent disclosure. The people working on it can use their own keys for development, so no need to make one. You could make your own too, sounds like the tools to sign the kernel/boot loaders is done. ---------------------------------------------------------------------- turtle1470 · 2023-12-21 09:16 Windows 11 wants SecureBoot enabled and won't even install if you don't perform some black magic tricks so i keep it enabled. I've recovered my old ssd from previous pc and i want to try something new so the idea was to install and lean FreeBSD if i can. Beign able to boot and install with SecureBoot enabled would be greatly appreciated... ---------------------------------------------------------------------- _Lee_B_ · 2023-12-21 11:22 Hmm. You're right. It's more applicable to early boot attacks than to hardware/DRM, when you put it like that. ---------------------------------------------------------------------- usernamefindingsucks · 2023-12-21 17:10 It only prevents a whole host of vulnerabilities where an attacker modifies boot/kernel binaries. ---------------------------------------------------------------------- nawcom · 2023-12-22 05:10 Windows 11 only wants a "SecureBoot capable" PC. It does not require for it to be enabled. It does not test to see if SecureBoot is enabled when it does its PC Health check pre-install. This seems to be a common misconception going around. Now, a SecureBoot-compatible requirement is to be able to do UEFI booting, and what causes the issue with people reporting that Windows 11 setup claiming that their computer doesn't support SecureBoot is because their existing version of Windows 10 is installed on a drive with a standard MBR partition table and not a GUID partition table. Windows needs GUID for UEFI booting, and SecureBoot compatibility only works with UEFI. I do not and never have enabled SecureBoot on my current systems multibooting with Windows 11 being one of the OSes. I did not use any tweak to get around checks for installing fresh or upgrading from Windows 10. The only requirement was having a new enough CPU and have onboard TPM 2.0 enabled in BIOS/UEFI settings, which typically came disabled by default. ---------------------------------------------------------------------- No-Lunch-1005 · 2023-12-24 12:58 I found this post which might be helpful: https://freebsdfoundation.org/freebsd-uefi-secure-boot/ ---------------------------------------------------------------------- grahamperrin · 2023-12-26 19:42 Thanks! It's unfortunate that Foundation pages such as this are not dated. From [Check out the article on UEFI / Secure Boot work being done by two of our staff members. – FreeBSD Foundation](https://freebsdfoundation.org/news-and-events/latest- news/check-out-the-article-on-uefi-secure-boot-work-being-done-by-two- of-our-staff-members/), we might assume that the page is around ten years old. seeks a definite answer. ---------------------------------------------------------------------- No-Lunch-1005 · 2023-12-26 19:47 you're right that dating pages would help.I will suggest ---------------------------------------------------------------------- grahamperrin · 2023-12-26 20:53 > this wiki page, NB (foot of the page, easily overlooked), [CategoryStale](https://wiki.freebsd.org/CategoryStale) ---------------------------------------------------------------------- grahamperrin · 2023-12-27 13:33 > Windows 11 only wants a "SecureBoot capable" PC. It does not require for it to be enabled. +1 Users may be misled by articles such as [How to enable Secure Boot to install Windows 11 | Trend Micro Help Center](https://helpcenter.trendmicro.com/en-us/article/tmka-10662) (I guess, many other articles parrot the same type of thing). This Microsoft page is probably definitive: - [Windows 11 and Secure Boot - Microsoft Support](https://support.microsoft.com/en-us/windows/windows-11-and- secure-boot-a8ff1202-c0d9-42f5-940f-843abef64fad) /u/turtle1470 if you like, mark your post: [answered](https://i.imgur.com/pTA9UeG.png) ---------------------------------------------------------------------- grahamperrin · 2023-12-27 13:34 > if you turn on SecureBoot in the BIOS and try to boot FreeBSD A normal installation will not boot.