flatcar
[RFE] Support Secure Boot
Current situation
Flatcar currently does not support Secure Boot. We use a really old fork of shim and grub, and our artifacts are not signed in a way that works on machines with official UEFI CA keys.
Impact
Users can't run UEFI with Secure Boot enabled. This doesn't only affect bare metal installs but also some VMs (e.g. Azure Trusted Launch https://azure.microsoft.com/en-us/blog/announcing-preview-of-azure-trusted-launch-for-virtual-machines/).
Ideal future situation
Flatcar images contain EFI boot firmware signed with official UEFI CA keys, which make them compatible with Secure Boot on default provisioned UEFI firmware.
Implementation options
We still have https://github.com/kinvolk/flatcar-scripts/blob/main/image_inject_bootchain around. Our grub and kernel binaries are signed for secure boot but only with a dev key. We'll need to:
- upgrade grub (with our patches - I believe most are obsolete)
- upgrade shim
- set up signing infrastructure with an offline CA key, and an online signing key
- follow https://github.com/rhboot/shim-review to get a shim binary with our CA certificate signed
- set up a pipeline to sign grub and kernel and inject them into release artifacts
Additional information
[ Please Add any information that does not fit into any of the above sections here ]
I think we also need to change the way we use the grub.cfg config file on the OEM partition to read in variables. Maybe we can reduce this to a OEM file that we parse for some OEM ID and inside the trusted GRUB configuration then check against this value to set the desired variables.
Hello! I am trying to install flatcar linux on my home PC. I am getting a "Secure Boot Violation: Invalid signature detected. Check Secure Boot Policy in Setup", after using the flatcar-install to install on the hard disk. Is this because I flatcar does not support secure boot?
@saulshanabrook Correct, secure Boot is not supported (our EFI binaries are not signed).
I am correct in assuming that this PR along with some CA/signing infra changes you pointed out would resolve this issue?
Yes. The real work will be the CA/signing infra to get our shim trusted by the official UEFI CA.
Will secure boot support come after Flatcar finishes its ideal implementation of systemd-boot? I only just got a grasp on how secure boot works today (PK, KEK, db, dbx) and a small glimpse of what seems like a stringent process of approval. I would think at least the bootloader situation (shim -> systemd-boot) should be pretty well cemented before working through the mainstream UEFI signature approval process.
Resources:
https://techcommunity.microsoft.com/blog/hardwaredevcenter/updated-uefi-signing-requirements/1062916
https://github.com/rhboot/shim/wiki/reviewer-guidelines
There is no rush. I’m just trying to get a gauge of how prioritized this is. I’m hoping Flatcar becomes what I use for a lot, but without secure boot I’m leaning towards using other operating systems on bare metal and Flatcar in VMs which is okay, just I would love to manage an immutable fleet of Flatcar machines running Kubernetes clusters and minimizing downtime with Nebraska. Some people say I don’t have to worry about secure boot and that it’s not actually that secure, but I would like to see it because I think it carries some enterprise legitimacy with its signature approval process.
Thank you for all you have contributed so far, and congratulations on being accepted as a CNCF incubating project!
Work for secure boot support is in the end phases, we're going to be submitting the shim (together with our signing process and boot chain) for review in the coming weeks. This is not coupled to switching to systemd-boot, it will be based on the existing grub based boot process.
Here are some PRs if you're interested:
- https://github.com/flatcar/shim-review/pull/1
- https://github.com/flatcar/scripts/pull/2292 (this one is being split up into individual PRs that are getting merged).
@jepio Any updates to this? I see that one of those PRs was closed and another is stuck in draft state.
@jepio Any updates to this? I see that one of those PRs was closed and another is stuck in draft state.
We are working on the shim-review questionare and getting answers for some of the questions is taking time. Once we have all the answers we will update the draft PR and also submit for shim-review.
Hi, I’m trying to decide if I can use flatcar for edge servers… SecureBoot is a must for my use case, but I need to use it by implementing it using my own keys instead… is there a guide for something like this? I’m fairly new to SecureBoot so maybe I’m understanding wrong what has been discussed above, but I think my inquiry is a little bit different.
Thanks!
Hi, I’m trying to decide if I can use flatcar for edge servers… SecureBoot is a must for my use case, but I need to use it by implementing it using my own keys instead… is there a guide for something like this? I’m fairly new to SecureBoot so maybe I’m understanding wrong what has been discussed above, but I think my inquiry is a little bit different.
Thanks!
I believe images in the alpha channel have secure boot signatures but with a shim that is not signed by the official 3rdparty UEFI CA (our shim-review submission is blocked on a legal/procedural issue).
You can use what is in the alpha channel with your own keys right now - you'd need to follow one of the online guides on enrolling your own secure boot keys (eg. https://wiki.gentoo.org/wiki/Secure_Boot) in your firmware, and then sign our shim (/boot/EFI/boot/bootx64.efi) with your DB key in the images that you installed. The preparation of your firmware (generating and enrolling keys) does not need to happen from Flatcar.
Or they could just add our DB certificate in the short term, if that's acceptable.
