Skip to content
CachyOS

Secure Boot Setup

Pre-setup

Section titled “Pre-setup”

GRUB Boot Manager

Section titled “GRUB Boot Manager”

If you are using GRUB, run the following command to enable secure boot support on GRUB using CA Keys.

Terminal window
sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=cachyos --modules="tpm" --disable-shim-lock

Enabling Setup Mode in UEFI

Section titled “Enabling Setup Mode in UEFI”

Firstly, we need to go to firmware settings and set secure boot mode to “Setup Mode”. You can reboot from an already running system to firmware settings with following command.

Terminal window
systemctl reboot --firmware-setup

This is how the BIOS looks like on a Lenovo Ideapad 5 Pro. Reset to setup mode or restore factory keys and reboot back to the system.

However, some MSI motherboards don’t have a Setup Mode. To achieve the same effect, set the Secure Boot Mode to “custom” and select the “maximum security” compatibility option (this is important: with the default mode, you might not be able to boot from your bootloader into CachyOS!). Then, go into “key management” and follow the two steps illustrated in the image below:


Some Asus motherboards have a similar behavior to the above mentioned MSI motherboards, as they do not have a dedicated setup mode.

Navigate to Boot → Secure Boot, set Secure Boot Mode to Custom, then open Key Management and select “Delete all Secure Boot Variables”.

Installing sbctl and Enrolling Keys

Section titled “Installing sbctl and Enrolling Keys”

Before proceeding, make sure to check if sbctl is installed.

sbctl is a user-friendly secure boot key manager capable of setting up secure boot, offering key management capabilities, and keeping track of files that need to be signed in the boot chain.

How to install sbctl
Open a terminal and run the following command
sudo pacman -S sbctl

Now that sbctl is installed, you have to setup sbctl and enroll your keys to the firmware. This process is pretty straightforward, just follow the steps below.

  1. Check if Setup Mode is enabled:

    Terminal window
    sudo sbctl status
    Expected Output
    Terminal window
    Installed:      ✘ sbctl is not installed
    Setup Mode:     ✘ Enabled
    Secure Boot     ✘ Disabled

  2. Create your custom Secure Boot keys:

    Terminal window
    sudo sbctl create-keys
    Example of a successful key creation
    Terminal window
    Created Owner UUID a9fbbdb7-a05f-48d5-b63a-08c5df45ee70
    Creating secure boot keys...✔
    Secure boot keys created!

  3. Enroll your keys with Microsoft’s and the OEM firmware’s built-in keys:

    Terminal window
    sudo sbctl enroll-keys --microsoft --firmware-builtin
    Expected output
    Terminal window
    Enrolling keys to EFI variables...✔
    Enrolled keys to the EFI variables!

  4. Check the status of sbctl again to make sure that the keys are enrolled and setup mode is disabled:

    Terminal window
    sudo sbctl status
    Expected Output
    Terminal window
    Installed:      ✔ sbctl is installed
    Owner GUID:     a9fbbdb7-a05f-48d5-b63a-08c5df45ee70
    Setup Mode:     ✔ Disabled
    Secure Boot     ✘ Disabled
    Vendor Keys:    microsoft

Signing the Kernel Image and Boot Manager

Section titled “Signing the Kernel Image and Boot Manager”

Limine is a special boot manager that allows checking the hash of kernel images and other files that Limine uses during boot. If this is enabled, any sort of manual configuration done by the user, e.g. signing the image via sbctl-batch-sign, will modify the hash of the corresponding files and fail Limine’s checksum verification.

However, signing these files isn’t necessary on Limine because it has a special boot process that bypasses EFI chainloading and signature checks. The only EFI binaries that need to be signed are Limine itself.

To enable automatic config checksum enrollment, set the following in /etc/default/limine:

Terminal window
ENABLE_ENROLL_LIMINE_CONFIG=yes

Proceed to generate a hash for Limine’s splash image:

  1. Check the current name and path of the splash image in the config file:
    Open a terminal and run the following command:
    sudo cat /boot/limine.conf
    You should be able to spot a line like this:
    Terminal window
    wallpaper: boot():/limine-splash.png
  2. Generate a BLAKE2B hash for the splash image and append it to the path in the config file:
    Run the following command, replacing the path with the one you found in the previous step:
    sudo b2sum /boot/limine-splash.png
    This will output a hash like this example:
    Terminal window
    75205d08fa9c61599897857e861d6b2f6da25465183fc4cc9efecffb22ee630efb510f2ef1b17677db94c28d5c69ad2ceb4d3892f5bec9cfa65c97b5ba16f52f
  3. Afer copying the newly generated hash from the previous step. Open the config file with a text editor and append the hash to the path of the splash image, like this:
    Terminal window
    wallpaper: boot():/limine-splash.png#75205d08fa9c61599897857e861d6b2f6da25465183fc4cc9efecffb22ee630efb510f2ef1b17677db94c28d5c69ad2ceb4d3892f5bec9cfa65c97b5ba16f52f
    As you can see, the hash is appended to the path with a # symbol. Save the file after making the change.

After enabling config checksum enrollment and generating the hash for the splash image, run the following commands to enroll the config checksum and sign Limine’s EFI binary:

Terminal window
# Use limine-enroll-config to enroll the config checksum and sign Limine's EFI binary
# This uses sbctl under the hood
sudo limine-enroll-config
sudo limine-update

Secure Boot Status Check

Section titled “Secure Boot Status Check”

To check that secure boot is indeed enabled. You can run one of the following commands

Terminal window
sudo sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     a9fbbdb7-a05f-48d5-b63a-08c5df45ee70
Setup Mode:     ✓ Disabled
Secure Boot:    ✓ Enabled
Vendor Keys:    microsoft


bootctl
System:
      Firmware: UEFI 2.80 (INSYDE Corp. 28724.16435)
 Firmware Arch: x64
   Secure Boot: enabled (user)
  TPM2 Support: yes
  Measured UKI: no
  Boot into FW: supported
Section titled “Links and Credits”
  • The Arch Wiki laid the groundwork for this guide. Most of the stuff here was taken from there.
  • sbctl - This easy guide to enable secure boot support wouldn’t have been possible if it weren’t for the amazing work done to create this piece of software.
  • Improving the Secure Boot Experience by Morten linderud - Blog post by Morten “Foxboron” Linderud on how the secure boot experience was complicated before sbctl.