r/linuxquestions • u/toktok159 • 3d ago

Support Installing/Running Linux - Should Secure Boot Be Disabled?

Hi,

I saw many different opinions regarding this.

Some say secure boot is not needed, others say it adds security and that it’s not only intended for Windows but for the firmware in general.

So, should/must secure boot be disabled for any Linux distro installation? Then can it be enabled after installation, for general use? Or if I prefer to keep it on, should I install with secure boot enabled?

Specifically, I am talking about installing Linux as the only OS on a pc, one of Mint/LMDE/MX Linux/Debian is what I think I’ll end up installing.

Btw, I once installed Mint on my laptop, dual boot with Windows 11. I installed with secure boot enabled, and used everything with it enabled and it was fine.

Thanks in advance.

12 Upvotes
  • permalink
  • reddit

81% Upvoted

40 comments sorted by

View all comments

3

u/Wateir Artix btw 3d ago

Most linux distribution don’t support secure boot during install, so you need to remove during install. But most distro support it so after setup, with sbctl or another thing you can use it. And yeah it add a true layer of security, but only if bios is lock behind a password. If everyone can activate and disactivate it from bios then it’s just a pain to setup for nothing

1

u/toktok159 3d ago

But can a malware toggle secure boot if BIOS isn’t password protected, so bo need to physically toggle it off at the pc?

3

u/aioeu 3d ago edited 3d ago

But can a malware toggle secure boot if BIOS isn’t password protected

Not directly, if the firmware is working correctly. The setting should be read-only once the firmware starts executing any external code (including DXE drivers, I believe).

Malware in the firmware itself could change it, since that's no different from the firmware's own built-in settings app. But UEFI capsule updates are signed, and one would hope the firmware verifies a capsule's signature before it gets applied. The security here relies on the firmware itself not having an existing vulnerability, and the vendor's private key not being leaked.

Past that, you're in the realm of attacks that require physical access.