Secure Boot Kernel Rejection of Self-Signed Modules in Linux on Intel NUC
Secure Boot is a feature of the Unified Extensible Firmware Interface (UEFI) that ensures that a system boots using only software that is trusted by the PC manufacturer. When Secure Boot is enabled, the system firmware checks the signature of each piece of boot software, including firmware drivers (Option ROMs) and the operating system. If the signatures are good, the boot software is allowed to run.
Self-Signed Modules in Linux
In Linux, kernel modules can be built and loaded by users. These modules are not signed by default, and when Secure Boot is enabled, the system firmware will reject them. This can be a problem for users who want to use self-signed modules in their Linux systems.
Balena IoT and Secure Boot
Balena IoT is a special distribution of Linux that is designed for use in IoT devices. It does not use the same keys as other distributions, and it does not use keys enrolled by Microsoft. This means that it can be used on systems with Secure Boot enabled, even if the system firmware does not have the Microsoft keys enrolled.
Testing Secure Boot with Balena IoT on Intel NUC
To test Secure Boot with Balena IoT on an Intel NUC, follow these steps:
- Download the Balena IoT image for Intel NUC from the Balena website.
- Write the image to a USB drive using a tool such as balenaEtcher.
- Insert the USB drive into the Intel NUC and boot the system.
- Press
Ctrl-Dto enter the Balena IoT configuration menu. - Select the
Secure Bootoption and follow the prompts to enable Secure Boot. - Reboot the system.
- Test the system by attempting to load a self-signed kernel module. The module should be rejected by the system firmware.
Secure Boot is an important feature for ensuring the security of a system, but it can be a challenge for users who want to use self-signed kernel modules in their Linux systems. Balena IoT is a special distribution of Linux that can be used on systems with Secure Boot enabled, even if the system firmware does not have the Microsoft keys enrolled. By following the steps outlined above, users can test Secure Boot with Balena IoT on an Intel NUC and see how it works in practice.
References
#!/bin/bash
# Example self-signed kernel module
modname="mysignature"
modfile="/lib/modules/$(uname -r)/kernel/drivers/mysignature.ko"
# Build the module
make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
# Load the module
insmod $modfile