Bug 11816

Summary:	secure boot implementation using systemd-boot bootloader
Product:	[Build System, Metadata & Runtime] BSPs	Reporter:	California Sullivan <california.l.sullivan>
Component:	bsps-meta-intel	Assignee:	Unassigned <unassigned>
Status:	NEW ---	QA Contact:
Severity:	enhancement
Priority:	Medium+	CC:	andrew.bradford, anuj.mittal, bluelightning, ccasciato, tim.orling
Version:	unspecified
Target Milestone:	5.99
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description California Sullivan 2017-07-20 18:22:58 UTC

It should be possible to support secure boot with systemd-boot as the bootloader.

Systemd-boot can be signed, and when in secure boot mode will validate that the kernel is also signed. This is a minimal secure boot implementation, with the downside that the chain of trust only extends as far as the kernel. Neither the initrd or kernel command line will be validated, making it fairly easy to defeat.

There also seems to be recent work getting systemd-boot to work with the shim program, which is prevalent in other secure boot implementations on the Linux side: https://github.com/systemd/systemd/pull/5702/commits/40a2f0684749dffcc2ae076137264354683333d8

Comment 1 Robin Jordan 2018-02-26 20:28:08 UTC

Please provide an update on the status of this and let me know if it will be ready for YP 2.5 M3.

Comment 2 California Sullivan 2018-02-26 20:29:23 UTC

Thought Stephano was going bump this to 2.6 for me. Doing it now.

Comment 3 Randy MacLeod 2023-10-24 14:24:50 UTC

Bulk move from 4.99 or 0.00 to 5.99