This repository contains tooling for UEFI Secure Boot on NixOS. The goal is to make Secure Boot available from nixpkgs for any platform that supports UEFI.
If you want to try this out, head over here for instructions.
There is still a bunch of work to do before this work can be upstreamed into nixpkgs. Please coordinate in the Matrix room or check the issues, if you want to take something up.
The goal of UEFI Secure Boot is to allow only trusted operating systems to boot on a system. This can be used to defend against certain classes of attacks that compromise the boot flow of a system. For example, an attacker will have difficulty replacing the Linux kernel that boots a system when Secure Boot is active.
UEFI Secure Boot works by digitally signing all drivers, bootloaders, the Linux kernel and its initrd. This establishes a chain of trust where one trusted component only hands off control to the next part of the boot flow when the integrity of the chain is cryptographically validated.
There are some additional steps that are required to make UEFI Secure Boot effective:
- There must be a BIOS password or a similar restriction that prevents unauthorized changes to the Secure Boot policy.
- The booted system must have some form of integrity protection.
- The firmware must be kept up-to-date.
These steps will not be covered here.
At the moment, boot loaders, kernels and initrds on NixOS are signed on the current system. These then need to be prepared as Unified Kernel Images (UKI) and placed on the EFI System Partition (ESP).
lzbt is a Linux command line application that takes care of
this flow. It takes a NixOS
bootspec document, signs the
relevant files, creates a UKI using the stub (see below) and
installs the UKI along with other required files to the
ESP. lzbt is also aware of multiple NixOS generations and will
sign all configurations that should be bootable.
lzbt lives in rust/tool.
When the Linux kernel and initrd are packed into a UKI, they need an
UEFI application stub. This role is typically filled by
systemd-stub.
The downside of systemd-stub is that it requires the kernel and
initrd to be packed into the UKI, which makes it pretty large. As we
need one UKI per NixOS configuration, systems with many configurations
quickly run out of the limited disk space in the ESP.
The Lanzaboote stub is a UEFI stub that solves the same problem as
systemd-stub, but allows kernel and initrd to be stored separately
on the ESP. The chain of trust is maintained by validating the
signature on the Linux kernel and embedding a cryptographic hash of
the initrd into the signed UKI.
The stub is available in a "thin" and a "fat" variant. The "thin" variant is
the one described above and is tailor made for NixOS. The "fat" variant aims to
work exactly like the systemd-stub---in fact, it's supposed to eventually
replace it. The "thin" variant is the default, you can build it from the stub
directory with cargo build. The "fat" variant needs to be enabled at build
time with cargo build --no-default-features --features fat.
The stub lives in rust/stub.
When both Lanzaboote and services.fwupd are enabled, for
fwupd.service a preStart will be added that ensures a signed fwupd
binary is placed in /run that fwupd will use.
SecureBoot is available by adding this project to your configuration.
It relies on bootspec which is enabled by default since NixOS 23.05.
An optimistic plan is to have a "in-tree" feature preview of Lanzaboote as part of NixOS 23.11.
This project was funded through the NGI Assure Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 957073. Applications are still open, you can apply today.
If your organization wants to support the project with extra funding in order to add support for more architectures, PKCS#11 workflows or integration, please contact one of the maintainers.