Enabling lanzaboote on initial installation

[Ten0]

Hello! I've been using this successfully for a few months, and I'd like to generalize its usage.

Readme specifies: https://github.com/nix-community/lanzaboote/blob/f5a3a7dff44d131807fc1a89fbd8576cd870334a/docs/QUICK_START.md?plain=1#L33-L35

I'd like to be able to apply a configuration with lanzaboote enabled as I run nixos-install, and not have to manually temporarily disable it from my config during the installation, then re-enable it after the installation.

Could you please expand on the limitations that prevent from running sbctl create-keys prior to installation, then applying the initial configuration with lanzaboote enabled right away? Thanks!

[arthsmn]

You can create your own ISO with your keys in it and a signed kernel. Then, you would only need to import the keys into the machine and copy the keys from the ISO to the installation.

[Ten0]

Hey, thanks for your answer. I didn't mean that I wanted secure boot to be enabled prior to installation. I meant that the guide seems to express that applying a configuration that has lanzaboote enabled instead of systemd boot during initial nixos-install wouldn't work, and I was wondering why creating keys in /mnt/etc/secureboot prior to installation wouldn't work (or if it would, why the guide seems to suggest otherwise). Thanks!

[arthsmn]

Hey, thanks for your answer. I didn't mean that I wanted secure boot to be enabled prior to installation. I meant that the guide seems to express that applying a configuration that has lanzaboote enabled instead of systemd boot during initial nixos-install wouldn't work, and I was wondering why creating keys in /mnt/etc/secureboot prior to installation wouldn't work (or if it would, why the guide seems to suggest otherwise). Thanks!

I think this is a misunderstanding of the guide, as I'm pretty sure I installed lanzaboote directly. As the module just replaces systemd-boot, in theory if it has everything in place it should work.

[RaitoBezarius]

Hi there, sbctl create-keys is frowned upon in activation because this is a side effect that creates private keys and private key creation in an activation script is a bit icky.

Nonetheless, as long as you copied the keys from another location, you can immediately use lanzaboote on the first nixos-install. Lanzaboote will not enforce Secure Boot if Secure Boot is disabled, as soon as you enroll the keys, Secure Boot will be enabled and your bootables will be signed according to the right keys, so it should work out fine in the end.

The guide is a bit conservative to avoid bad experiences, but it could indeed benefit from some clarification.

[kuflierl]

Hello! I've been using this successfully for a few months, and I'd like to generalize its usage.

Readme specifies:

https://github.com/nix-community/lanzaboote/blob/f5a3a7dff44d131807fc1a89fbd8576cd870334a/docs/QUICK_START.md?plain=1#L33-L35

I'd like to be able to apply a configuration with lanzaboote enabled as I run nixos-install, and not have to manually temporarily disable it from my config during the installation, then re-enable it after the installation.

Could you please expand on the limitations that prevent from running sbctl create-keys prior to installation, then applying the initial configuration with lanzaboote enabled right away? Thanks!

This is the whole point of #384. This subject is kinda controversial with the maintainers/developers of the repository as seen in the comments of the PR.

[Ten0]

This is the whole point of https://github.com/nix-community/lanzaboote/pull/384

As far as I'm concerned I'm fine with needing to run one or two extra commands as part of my install. That is already scripted anyway for all partitioning, encryption, git clone, hardware config generation, etc.

So I don't mind that it doesn't run sbctl create-keys, I can just add that to my script. I'm mostly just scared that it's specified that I should apply a different config with systemd-boot instead before first boot, do the install, and only then apply with lanzaboote enabled, and that seemed annoying because it means I need to apply an intermediate config during install, so I was wondering if perhaps there's something in the nixos install script that applies systemd-uboot-specific configs upon install when enabled, and that wouldn't work with lanzaboote or something along those lines.

At this point I'm rather reassured by https://github.com/nix-community/lanzaboote/issues/397#issuecomment-2423698765 but I haven't tested it yet.

[kuflierl]

This is the whole point of #384

As far as I'm concerned I'm fine with needing to run one or two extra commands as part of my install. That is already scripted anyway for all partitioning, encryption, git clone, hardware config generation, etc.

So I don't mind that it doesn't run sbctl create-keys, I can just add that to my script. I'm mostly just scared that it's specified that I should apply a different config with systemd-boot instead before first boot, do the install, and only then apply with lanzaboote enabled, and that seemed annoying because it means I need to apply an intermediate config during install, so I was wondering if perhaps there's something in the nixos install script that applies systemd-uboot-specific configs upon install when enabled, and that wouldn't work with lanzaboote or something along those lines.

At this point I'm rather reassured by #397 (comment) but I haven't tested it yet.

I can assure you it works. I already did that.

[Ten0]

Thanks! Then this issue only tracks documentation update that this works I guess.

[qm3ster]

I did sudo sbctl create-keys -e /mnt/var/lib/sbctl --disable-landlock but sudo nixos-install -v --flake /mnt/etc/nixos#nook fails with:

evaluating file '<nix/derivation-internal.nix>'
installing the boot loader...
setting up /etc...
Installing Lanzaboote to "/boot"...
Failed to install generation 1: Get stub name: No such file or directory (os error 2)
Failed to install bootloader

which localizes the issue to this call: https://github.com/nix-community/lanzaboote/blob/2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85/rust/tool/systemd/src/install.rs#L267

which sounds like <lanzaboote_binary> install --public_key <something that doesn't exist> was called.

Ok, so it turns out:

1. I still had pkiBundle = "/etc/secureboot"; (should be "/var/lib/sbctl" by new standard)
2. For that you need to call create-keys -e /mnt/var/lib/sbctl/keys (note the /keys on the end) as per https://github.com/nix-community/lanzaboote/blob/2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85/nix/modules/lanzaboote.nix#L44-L56

Hope this helps someone.

Funnily enough after everything worked out I didn't get a boot entry added to the EFI flash so I can't actually try booting yet, but I have to go to bed now.

[andsens]

Hope this helps someone.

It did! Thank you :-)

Funnily enough after everything worked out I didn't get a boot entry added to the EFI flash so I can't actually try booting yet, but I have to go to bed now.

That's because lanzaboote doesn't do that (yet?). It piggybacks on the sd-boot EFI entry that was installed before the user switched (I think). Here's a workaround:

mv /mnt/boot/EFI/BOOT/BOOTX64.EFI /mnt/boot/EFI/BOOT/BOOTX64.EFI.BAK
mv /mnt/boot/EFI/systemd/systemd-bootx64.efi /mnt/boot/EFI/systemd/systemd-bootx64.efi.bak
bootctl --esp-path /mnt/boot install
mv /mnt/boot/EFI/BOOT/BOOTX64.EFI.BAK /mnt/boot/EFI/BOOT/BOOTX64.EFI
mv /mnt/boot/EFI/systemd/systemd-bootx64.efi.bak /mnt/boot/EFI/systemd/systemd-bootx64.efi

bootctl install both sets up the EFI entry, but also copies over the unsigned systemd-boot EFI app. So to get just the EFI entry part we move the signed binaries out of the way, run bootctl, and then move them back into place.