Yeah, it's a pain when devices are discontinued. I have one with ancient BIOS that has a bunch of BI

Yeah, it's a pain when devices are discontinued. I have one with ancient BIOS that has a bunch of BIOS bugs for sleep/shutdown/reboot. But the good news is that with immutable distros there is less need for secureboot.

LlazyPower This is probably already common knowledge here, but if not: https://github.blog/...

ArcitecOP•5/14/23, 12:38 AM

Yeah, We already use the new techniques mentioned in that article, so we're safe. There won't be any blackout on May 31st.

AArcitec Yeah, it's a pain when devices are discontinued. I have one with ancient BIOS th...

pythoner6•5/14/23, 12:44 AM

Huh? How does an image based model reduce the need for secure boot?

Ppythoner6 Huh? How does an image based model reduce the need for secure boot?

ArcitecOP•5/14/23, 12:54 AM

Secure boot makes the kernel unwilling to load an unsigned (or signed with untrusted certificates) kernel module.

Those modules can end up on your disk in two ways:

Via a root-privilege installer. This won't work on immutable distros, unless they use rpm-ostree to literally layer the kmod package, which will be easily noticeable.
Via someone tampering on the physical disk, mounting it in another computer, and placing files on it. This can be prevented by encrypting the disk (Fedora's installer has a simple checkbox). I am also pretty sure that ostree would not allow this kind of direct tampering with files anyway.

There's also something called Unified Kernel Image that's emerging, where the kernel, initramfs, and all modules are packed into 1 signed binary blob to be even more secure, but we don't use that yet.

pythoner6•5/14/23, 1:01 AM

Yes, I suppose it means malware has to more specifically be designed to work with rpm-ostree etc - but that seems more like a speed bump than anything to me. I'm not sure I would say that makes secure boot less necessary.

ArcitecOP•5/14/23, 1:02 AM

I have yet to come across or hear about any malware that ever installed Linux kernel modules btw.

ArcitecOP•5/14/23, 1:02 AM

Let alone targeting rpm-ostree distros specifically, an even smaller audience.

ArcitecOP•5/14/23, 1:02 AM

So far everything I ever see is user-level malware that exfiltrates user-owned files via scripting or basic stuff like that.

ragectl•5/14/23, 1:10 AM

well there are UEFI targeted malwares floating around

pythoner6•5/14/23, 1:11 AM

I have seen Lennart Poettering's blog posts about secure boot and UKIs and everything, definitely pretty interesting stuff, will be interested to see how silverblue evolves in that direction.

Rragectl Click to see attachment

ragectl•5/14/23, 1:12 AM

OK my solution to this was changing the order of the EFI files in my laptop BIOS, so the MMX file was listed first. This allowed the Mokutil screen to load to enroll the akmod key. I then had to change the order back to get the OS to load normally. This is an issue with my old bios

Rragectl OK my solution to this was changing the order of the EFI files in my laptop BIOS...

ragectl•5/14/23, 1:12 AM

using the mmx64.efi file from the /efi/fedora directory

ragectl•5/14/23, 1:14 AM

I just realised this laptop was manufactured in 2015.... so the EFI setup is ancient compared to modern machines

Rragectl OK my solution to this was changing the order of the EFI files in my laptop BIOS...

ArcitecOP•5/14/23, 1:17 AM

Nice job. Glad your motherboard accepted the key that way. Mine didn't when I switched to that file. I did practically the same thing, but the MokUtil enrollment GUI was basically pretending to enroll the key but didn't write anything to BIOS memory. I just assumed that there was an untrusted code path/write lock involved, and stopped trying. This definitely varies between different BIOSes though.

So your machine is secureboot enrolled now?

ArcitecOP•5/14/23, 1:19 AM

Btw there's a new exploit out that may make your BIOS unable to use secure boot again, if it only trusts the old Microsoft key. I remember hearing that Microsoft will change the signing key used for both Windows and the Linux SB shim because of some huge exploit.

Edit:
https://arstechnica.com/information-technology/2023/05/microsoft-patches-secure-boot-flaw-but-wont-enable-fix-by-default-until-early-2024/

ArcitecOP•5/14/23, 1:24 AM

Okay a comment on the article clarified it better: Microsoft will revoke their old SecureBoot master key to prevent booting from old, vulnerable bootloaders signed with the old key.

ArcitecOP•5/14/23, 1:25 AM

The bug was in their Windows bootloader itself, but to protect people they need to block the old key itself with a BIOS update to revoke the key's trust. Linux will be getting the same patch because the SB shim will be signed with the new key instead. I remember seeing that MS is already in contact with the Fedora team about this.

ArcitecOP•5/14/23, 1:26 AM

Let's hope they use some kind of derived key system so that your current Microsoft root certificate in the BIOS can still authenticate their upcoming, new key

AArcitec Nice job. Glad your motherboard accepted the key that way. Mine didn't when I sw...

ragectl•5/14/23, 1:26 AM

Yeah the secure boot is enabled and nvidia modules are loaded. I can see in rpm-ostree that it's on the ublue silverblue nvidia image

Rragectl Yeah the secure boot is enabled and nvidia modules are loaded. I can see in rpm-...

ArcitecOP•5/14/23, 1:27 AM

That's really nice news. Sounds like you remembered to run the command to set the kernel boot args too?

ragectl•5/14/23, 1:27 AM

One question though, my silverblue-nvidia install hasn't prompted me to run any tools like Yafti and the Firefox isn't via Flatpak. Is that something not included in the ISO?

ArcitecOP•5/14/23, 1:27 AM

Yeah yafti is a tool for your own downstream images created from the template in the repo. It isn't even installed in the main or nvidia images.

Main and Nvidia images are very close to upstream silverblue, with some conveniences like RPM fusion, codecs etc installed.

AArcitec That's really nice news. Sounds like you remembered to run the command to set th...

ragectl•5/14/23, 1:28 AM

I haven't run any specific commands for kernel arguements, no

ArcitecOP•5/14/23, 1:28 AM

Oh okay you need to do that, ostree has a special security model where kernel boot args can only be set by you, the admin. It's listed here: https://ublue.it/images/nvidia/

ragectl•5/14/23, 1:32 AM

Do the installer ISO not do that automatically? https://github.com/ublue-os/main/releases

GitHub

Releases · ublue-os/main

An OCI base image of Fedora with batteries included - ublue-os/main

ragectl•5/14/23, 1:32 AM

I will have a look

ragectl•5/14/23, 1:32 AM

that install ISO is three weeks old, so maybe missing some changes?

ArcitecOP•5/14/23, 1:34 AM

That iso pulls the latest image from the internet during install, so the ISO is meant to only be updated rarely.

And no the iso doesn't seem to set kargs, I cannot find the word

kargs

kargs

anywhere in the source code of those repos.

ragectl•5/14/23, 1:34 AM

Well the kernel args have been set in /etc/default/grub and I didn't add them

ragectl•5/14/23, 1:34 AM

the rpmfusion modules do usually update those

ArcitecOP•5/14/23, 1:35 AM

It won't on silverblue: https://rpmfusion.org/Howto/NVIDIA#OSTree_.28Silverblue.2FKinoite.2Fetc.29

ArcitecOP•5/14/23, 1:35 AM

I don't even think that /etc/default/grub's kernel args are used at all on silverblue
Edit: They're not used.

ragectl•5/14/23, 1:46 AM

and of course the Acer bios updater for this old laptop requires Windows because it's a .exe file

Rragectl and of course the Acer bios updater for this old laptop requires Windows because...

ArcitecOP•5/14/23, 1:49 AM

Hmm try opening it with 7zip and seeing if you can get the files from inside. It's usually some DOS exe and a firmware blob inside "windows BIOS updaters".

AArcitec I don't even think that /etc/default/grub's kernel args are used at all on silve...

ragectl•5/14/23, 1:49 AM

OK well something is doing something because the /boot/grub2/grub.cfg linked to /boot/loader/grub.cfg has the same kernel options added

Rragectl OK well something is doing something because the /boot/grub2/grub.cfg linked to ...

ArcitecOP•5/14/23, 1:50 AM

Run and look for those flags to be sure

AArcitec Hmm try opening it with 7zip and seeing if you can get the files from inside. It...

ragectl•5/14/23, 1:59 AM

there are some other exe files inside the installer, but how would I use those in Linux?

Rragectl there are some other exe files inside the installer, but how would I use those i...

ArcitecOP•5/14/23, 1:59 AM

With a FreeDOS USB boot stick, boot into the DOS environment and run the exe.

AArcitec Run `cat /proc/cmdline` and look for those flags to be sure

ragectl•5/14/23, 2:00 AM

this contains the same args as the /etc/default/grub and /boot/grub2/grub.cfg file

Rragectl this contains the same args as the /etc/default/grub and /boot/grub2/grub.cfg fi...

ArcitecOP•5/14/23, 2:00 AM

That must mean that when the modules are bundled instead of layered, they become part of the actual boot args, unlike when they are manually layered with , where you need to run manually.

ArcitecOP•5/14/23, 2:02 AM

No... that theory makes no sense. Because if you install regular Silverblue and rebase to the image, you likewise have the nvidia modules bundled instead of layered, and you don't get the same luxury there and need to manually run the

kargs

kargs

command...

ArcitecOP•5/14/23, 2:03 AM

It seems like the Nvidia ISO is an exception to this rule.

ragectl•5/14/23, 2:03 AM

Ahh FreeDOS I don't think I've ever used it. Might give it a go later

ArcitecOP•5/14/23, 2:04 AM

It's pretty painless, unless the you found requires some undocumented arguments.

ragectl•5/14/23, 2:05 AM

@Arcitec before I ran the uBlue ISO install the laptop had vanilla Silverblue. I haven't set any manual commands, I just ran the installer. Apart from fixing my ancient bios errors, it's all automated

Rragectl @Arcitec before I ran the uBlue ISO install the laptop had vanilla Silverblue. I...

ArcitecOP•5/14/23, 2:06 AM

Yea it just surprises me greatly because the ublue repos and ublue isogenerator don't contain the words