ItsDrike/nixdots
1
0
Fork 0
mirror of https://github.com/ItsDrike/nixdots synced 2024-12-25 17:54:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update secure boot docs

Browse source
This commit is contained in:
ItsDrike 2024-06-23 17:04:29 +02:00
parent 4f5aa6c33d
commit eefda2047d
Signed by: ItsDrike
GPG key ID: FA2745890B7048C0
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
docs/03_SECURE_BOOT.md
View file

@ -61,8 +61,8 @@ permissions of the secret key so that only root can read it.
## lanzaboote ## lanzaboote
`lanzaboote` is a tool to help you set up secure boot in NixOS. To install it, you can add `lanzaboote` is a tool to help you set up secure boot in NixOS. To install it, you can add it as an input for your
it as an input for your flake: flake:
```nix ```nix
lanzaboote = { lanzaboote = {
@ -111,7 +111,8 @@ Note that you shouldn't really need to use this.
## Enabling secure boot ## Enabling secure boot
Now that NixOS is ready for secure-boot, we will set up firmware. At the end of this section, Secure Boot will be enabled on your system and your firmware will only boot binaries that are signed with your keys. Now that NixOS is ready for secure-boot, we will set up firmware. At the end of this section, Secure Boot will be
enabled on your system and your firmware will only boot binaries that are signed with your keys.
### Enter Setup mode ### Enter Setup mode
@ -138,11 +139,18 @@ You will now have to enroll your new keys to activate Secure Boot.
sudo sbctl enroll-keys -m sudo sbctl enroll-keys -m
``` ```
> [!NOTE] > [!WARNING]
> The `-m` option (also known as `--microsoft`) will make sure to also include the Microsoft > The `-m` option (also known as `--microsoft`) will make sure to also include the Microsoft
> signing keys. This is required by most motherboards, not using it could brick your device. > signing keys. This is required by most motherboards, not using it could brick your device.
This should automatically enable secure boot in user mode for you. You can now reboot the system. > [!NOTE]
> If you encounter "File is immutable" warnings after running sbctl, it should be safe to simply add the `-i` (or
> `--ignore-immutable`) flag, which will run `chattr` and remove the immutable flags from these files for you.
>
> If you still encounter errors even with this flag, it means you have probably done something wrong when entering the
> setup mode. Try looking for a option like "Reset keys" in your UEFI, then try this again.
This should automatically enable secure boot in user mode for you. You can now **reboot the system**.
### Make sure it worked ### Make sure it worked