sbctl - Secure Boot Manager
sbctl is a tool that allows one to create keys for secure boot, securely enroll them and keep track of files to sign.
Note that some devices have hardware firmware that is signed and validated when Secure Boot is enabled. Failing to validate this firmware could brick devices. It's recommended to enroll your own keys with Microsoft certificates.
This feature is experimental.
-o PATH, --output PATH
bundle [FLAGS] <'NAME'>
-a PATH, --amducode PATH
-c PATH, --cmdline PATH
-e PATH, --efi-stub PATH
-p PATH, --esp PATH
-f PATH, --initramfs PATH
-i PATH, --intelucode PATH
-k PATH, --kernel-img PATH
-o PATH, --os-release PATH
-l PATH, --splash-img PATH
Normally, only the kernel is signed with your secure boot keys. This means the kernel command line and initramfs can be changed without possibility of verification.
Bundles are EFI executables which pack all three (initramfs, kernel and cmdline) into a single file which is easy to sign. Avoiding any unsigned files during boot makes the whole process more tamper-proof.
When a bundle is generated, its configuration is stored into the bundle database (see FILES). Subsequent executions of sbctl generate-bundles will rebuild these bundles, so you don’t need to re-specify all parameters after each system update.
Tip: systemd-boot will automatically show entries for any bundles found in esp/EFI/Linux/*.efi.
Note: To use Secure Boot it’s important to reboot the machine, navigate through the BIOS menu into the Secure Boot options and enable "User Mode". Please also ensure you have reset the current platform keys. If this step is not completed the following step might not work depending on the firmware.
Next is creating the keys for secure boot. create-keys creates the key hierarchy needed for secure boot into "/usr/share/secureboot".
$ sbctl create-keys Created Owner UUID a9fbbdb7-a05f-48d5-b63a-08c5df45ee70 Creating secure boot keys...✔ Secure boot keys created!
Next up is enrolling the keys into the efi firmware. sbctl supports doing this on a live system instead of having to boot or run a key management tool from the UEFI shell.
Note: This can fail because of firmware issues and unique options in the machine BIOS menu.
$ sbctl enroll-keys Enrolling keys to EFI variables...✔ Enrolled keys to the EFI variables!
After we have successfully enrolled the keys we need to sign our current boot chain. Traditionally on UEFI systems one can have an EFI System Partition (ESP) on /efi, /boot or /boot/efi. One can usually find the correct one by looking at mount points or finding the 'EFI" directory on the ESP.
The most important file to sign is the kernel. This location differs between distributions but can usually be found on the ESP or /boot. We use --save to store the file path so we don’t need to manually sign it later.
Note that sbctl can only keep track of file paths. On versioned kernels this might prove tricky.
$ sbctl sign --save /efi/vmlinuz-linux ✔ Signed /efi/vmlinuz-linux
Next is to sign the bootloader. This can usually be found on the standard path below, but might differ between installations.
$ sbctl sign --save /efi/EFI/BOOT/BOOTX64.EFI ✔ Signed /efi/EFI/BOOT/BOOTX64.EFI
sbctl is able to find and verify the ESP, along with any saved files to verify we have signed the files we need.
$ sbctl verify Verifying file database and EFI images in /efi... ✔ /efi/EFI/BOOT/BOOTX64.EFI is signed ✔ /efi/vmlinuz-linux is signed
Once we have confirmed everything works, we can reboot. Remember to re enable Secure Boot in the BIOS menu. Once we have logged back inn we can very the state of the system.
$ sbctl status Installed: ✓ sbctl is installed Owner GUID: a7b893cc-949d-408c-b5cc-6e7d0370fdb6 Setup Mode: ✓ Disabled Secure Boot: ✓ Enabled
When we do system updated we can run sign-all to resign all the saved files from earlier.
$ sbctl sign-all File have already been signed /boot/vmlinuz-linux ✓ Signed /efi/EFI/BOOT/BOOTX64.EFI
sbctl supports creating unified kernel images. These UEFI executables bundles the initramfs, kernel and cmdline into one executable which can be signed for secure boot. This allows you to authenticate larger parts of the bootchain instead of only signing the kernel.
$ sbctl bundle -i /boot/intel-ucode.img
Note that dracut(8) and mkinitcpio(8) supports unified kernel features, and they should be preferred over the sbctl implementation. It is mostly provided in the cases where this feature is not supported by the initramfs generator of the distribution.
All commands that take path arguments convert them into absolute paths when saving them to the database.
On success, 0 is returned, a non-zero failure code otherwise.