Secure Boot auto enrollment
summary
Systemd adds an auto-enroll PK/KEK/DB via ESP feature that writes UEFI secure-boot variables on first boot and flips firmware from setup to secure mode, available in systemd v252. Implementation signs PK→KEK→DB, requires signing kernels and modules or risk lockout, and already merges as a working PR; testing uses the kernel EFI stub. Next steps include using UEFI audit mode with TPM logs to verify no unsigned components and optional DBX (revocation) support.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:43Motivation for Secure Boot
- 5:02Secure Boot Keys Overview
- 8:39Systemd Bootloader Changes
- 10:46Automatic Enrollment Process
- 12:32Risks of Secure Boot Enrollment
- 15:02Audit Mode as Solution
- 16:29Acknowledgments and Thanks
- 17:10Q&A and Feedback Session
- 26:28Closing Remarks
related talks
30mEnabling UEFI Secure Boot Across Modern Build Systems
22mBoot Requirements and Strategies for the Edge
38mUEFI Secure Boot in U-Boot
45mUsing Secure Boot for the powers of good
47msystemd and TPM2
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
45mDynamic Key Managed PowerPC Guest Secure Boot
01h 18mSystemd & TPMs