Why though? [LWN.net]

Why though?

Posted Jul 9, 2024 10:06 UTC (Tue) by mezcalero (subscriber, #45103)
In reply to: Why though? by kazer
Parent article: Giving bootloaders the boot with nmbl

In a VM, just boot directly into your final UKI. Do not insert any further step in between. No shim, no sd-boot, and certainly no nmbl.

to post comments

Why though?

Posted Jul 9, 2024 11:11 UTC (Tue) by kraxel (subscriber, #49444) [Link] (4 responses)

And here is the cloud image doing exactly that (UEFI firmware -> shim.efi -> UKI):
https://download.fedoraproject.org/pub/fedora/linux/relea...

Dropping shim.efi is not that easy because fallback.efi (part of shim) is needed on first boot. Also doing secure boot without shim.efi requires some extra non-standard steps such as enrolling the distro secure boot certificates in the firmware. Sure possible, even easier for VMs than for physical hardware, but still an extra hurdle ...

Why though?

Posted Jul 9, 2024 11:26 UTC (Tue) by mezcalero (subscriber, #45103) [Link] (3 responses)

Why do you need fallback.efi though? First of all, I don't see why you need it at all, booting via bootx64.efi should always be good enough. But even if you want to set the efi vars, I think they better should be set from userspace, no need to do such things in uefi space, you win nothing by that.

sd-boot does support auto-enroll btw, if you want.

Why though?

Posted Jul 9, 2024 12:02 UTC (Tue) by kraxel (subscriber, #49444) [Link] (1 responses)

Well, you don't want bootx64.efi being the UKI because you don't have a fallback then in case a kernel update goes wrong, so it must be something else ...

Using shim.efi -> fallback.efi and having fallback.efi create BootNNNN entries pointing to the kernels in EFI\Linux\... is one option, and the one used by the cloud images linked in the previous comment.

Using sd-boot is an option too, but right now in fedora only without secure boot. Once https://pagure.io/releng/issue/10765 is solved (which I hope will not take another two years) I'll have a look at this + auto-enroll.

Why though?

Posted Jul 9, 2024 12:16 UTC (Tue) by bluca (subscriber, #118303) [Link]

> Using sd-boot is an option too, but right now in fedora only without secure boot. Once https://pagure.io/releng/issue/10765 is solved (which I hope will not take another two years) I'll have a look at this + auto-enroll.

I wonder if I'll manage to beat Fedora by shipping a shim-trusted sd-boot in Debian first :-P Currently waiting on the Debian CA owners to create a new set of intermediate certificates, everything else is ready and waiting...

Why though?

Posted Jul 9, 2024 12:05 UTC (Tue) by kraxel (subscriber, #49444) [Link]

Oh, and fallback.efi comes into play only on first boot, updating after kernel updates is handled by linux userspace.