Bug 11816 - secure boot implementation using systemd-boot bootloader
Summary: secure boot implementation using systemd-boot bootloader
Status: NEW
Alias: None
Product: BSPs
Classification: Build System, Metadata & Runtime
Component: bsps-meta-intel (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium+ enhancement
Target Milestone: 5.99
Assignee: Unassigned
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2017-07-20 18:22 UTC by California Sullivan
Modified: 2025-10-06 17:08 UTC (History)
5 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description California Sullivan 2017-07-20 18:22:58 UTC 
It should be possible to support secure boot with systemd-boot as the bootloader.

Systemd-boot can be signed, and when in secure boot mode will validate that the kernel is also signed. This is a minimal secure boot implementation, with the downside that the chain of trust only extends as far as the kernel. Neither the initrd or kernel command line will be validated, making it fairly easy to defeat.

There also seems to be recent work getting systemd-boot to work with the shim program, which is prevalent in other secure boot implementations on the Linux side: https://github.com/systemd/systemd/pull/5702/commits/40a2f0684749dffcc2ae076137264354683333d8
Comment 1 Robin Jordan 2018-02-26 20:28:08 UTC 
Please provide an update on the status of this and let me know if it will be ready for YP 2.5 M3.
Comment 2 California Sullivan 2018-02-26 20:29:23 UTC 
Thought Stephano was going bump this to 2.6 for me. Doing it now.
Comment 3 Randy MacLeod 2023-10-24 14:24:50 UTC 
Bulk move from 4.99 or 0.00 to 5.99