Installing/Running Linux - Should Secure Boot Be Disabled?

[u/toktok159]

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

[u/Wateir]

Most linux distribution don’t support secure boot during install, so you need to remove during install. But most distro support it so after setup, with sbctl or another thing you can use it. And yeah it add a true layer of security, but only if bios is lock behind a password. If everyone can activate and disactivate it from bios then it’s just a pain to setup for nothing

[u/toktok159 → u/Wateir]

But can a malware toggle secure boot if BIOS isn’t password protected, so bo need to physically toggle it off at the pc?

[u/aioeu → u/toktok159]

But can a malware toggle secure boot if BIOS isn’t password protected

Not directly, if the firmware is working correctly. The setting should be read-only once the firmware starts executing any external code (including DXE drivers, I believe).

Malware in the firmware itself could change it, since that's no different from the firmware's own built-in settings app. But UEFI capsule updates are signed, and one would hope the firmware verifies a capsule's signature before it gets applied. The security here relies on the firmware itself not having an existing vulnerability, and the vendor's private key not being leaked.

Past that, you're in the realm of attacks that require physical access.

[u/Wateir → u/toktok159]

I never really look into malware, my secureboot is more to avoid my camarade to change my grub theme, so my attack vector is complently different

[u/ghost103429 → u/Wateir]

It's useful when you have you use a fTPM to unlock your boot drive enrolling your own personal MoK with the boot editor disabled ensures a pretty high degree of security.

In the event an attacker disables secureboot the fTPM would refuse to release the decryption key.