Plan for Shim integration

[shlevy]

Some systems (e.g. as far as I can tell my new HP Spectre 360) do not allow for enrolling new keys, and so need to use something like https://github.com/rhboot/shim which a) has MS-signed binaries available (e.g. from Fedora/Ubuntu) and b) allows for user-controlled keys separate from the core firmware limitations.

From what I've gathered, this will require:

1. Installing the signed stub as grubx64.efi next to the shim efi (yes, it must literally must have that name and filesystem location)
2. Adding the signing keys to the shim database
3. Teaching the stub to use the shim protocol for validating the image (See Support shim protocol in EFI unified kernel image stub systemd/systemd#24574 for a somewhat related issue for systemd-boot).

See https://www.rodsbooks.com/efi-bootloaders/secureboot.html#shim for the best source of info I've found about shim.

[RaitoBezarius]

I do have plans for shim, it is much more ambitious though. (I have a draft somewhere I shared with NixOS infra, security and NixOS SecureBoot community).

It involves having NixOS Foundation custody of a vendor certificate for a shim signed by Microsoft through the shim-review project.

Though, we need much more maturity before reaching this "mainstream SecureBoot", obviously, what you're asking for, is an in-between thing.

We are trying to get our stub feature parity with systemd-stub in https://github.com/nikstur/sd-stub-rs ; our plan is to upstream it and inherit from it for NixOS after that.

In all cases, achieving (1) and (2) is already ~possible, we can already accept a PR for (3) in sd-stub-rs or in lanzaboote (preferably sd-stub-rs).

[nikstur]

Also noteworthy is that we have already coordinated with the systemd maintainers a little bit about sd-stub-rs: systemd/systemd#26640

If I remeber correctly there is some issue/uncertainty if we can even use sd-boot with the shim, right? The systemd guys are already working on that though (at least that's what I heard at FOSDEM).

[MarkGhanz]

In the meantime, is there a way to sign the BOOTX64.EFI and systemd-boot efi binary with microsoft's keys? My system won't let the signed systemd-boot binary pass even it was signed, although not by Microsoft's keys. The optional roms on my GPU functions normally, but it seems my motherboard's firmware won't let anything not signed by microsoft pass though.

[RaitoBezarius]

Unfortunately, I (but probably we) don't have spare cycles to work on this.

It's not possible to sign BOOTX64.EFI and systemd-boot.efi binary with MSFT keys, to the best of my knowledge, no systemd-boot.efi binary is signed publicly at least. So it's not even a NixOS problem, we cannot do anything about it alas.

The only solution is to use a signed GRUB then chainload NixOS.

The security provided by a SecureBoot protected by MSFT keys is really small so it's not high priority on my list.
Add to this that GRUB is a pain…

This is about shim which is another subject which could enable you to do: shim → systemd-boot → NixOS with a MOK key.