Arch Linux

GeorgeJP

Member

From: Czech Republic

Registered: 2020-01-28

Posts: 190

[SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

I am experimenting with SecureBoot on systemd-boot.
Random seed file (/boot/loader/random-seed ) is not used during boot and passed to OS.
All is OK, when SecureBoot disabled.
Is it bug or should I do some extra config?

# sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     a00c363b-0019-4e20-8cf9-c9f8fc7dd3ac
Setup Mode:     ✓ Disabled
Secure Boot:    ✓ Enabled
Vendor Keys:    microsoft

# sbctl verify
Verifying file database and EFI images in /boot...
✓ /boot/EFI/boot/bootx64.efi is signed
✓ /boot/EFI/memtest92/BOOTX64.efi is signed
✓ /boot/EFI/shell2/Shell.efi is signed
✓ /boot/EFI/systemd/systemd-bootx64.efi is signed
✓ /boot/vmlinuz-linux is signed
✓ /boot/EFI/Linux/archlinux.efi is signed

(/boot/EFI/Linux/archlinux.efi is Unified kernel image)

# bootctl status
System:
     Firmware: UEFI 2.31 (Phoenix Technologies Ltd. 4660.22136)
  Secure Boot: enabled (user)
 TPM2 Support: no
 Boot into FW: supported
...
Random Seed:
 Passed to OS: no
 System Token: set
       Exists: yes

# journalctl -b | grep seed
led 23 20:03:52 lnb systemd-random-seed[254]: Kernel entropy pool is not initialized yet, waiting until it is.
led 23 20:03:54 lnb audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-random-seed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
led 23 20:03:54 lnb bootctl[468]: Random seed file /boot/loader/random-seed successfully written (512 bytes).

Last edited by GeorgeJP (2022-01-23 20:18:08)

loqs

Member

Registered: 2014-03-06

Posts: 18,968

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

https://github.com/systemd/systemd/blob … eed.c#L240

GeorgeJP

Member

From: Czech Republic

Registered: 2020-01-28

Posts: 190

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

Thanks, will wait to be solved upstream by systemd.

jal

Member

Registered: 2015-04-23

Posts: 37

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

Hi,

I have the same issue, except

✗ /boot/EFI/BOOT/BOOTX64.EFI is not signed
✗ /boot/EFI/arch/fwupdx64.efi is not signed
✗ /boot/EFI/systemd/systemd-bootx64.efi is not signed
✗ /boot/vmlinuz-linux is not signed
✗ /boot/vmlinuz-linux-lts is not signed

Looks like this doesn't matter and also full disk encryption wasn't the issue. Is there anyway to be notified when systemd-boot allows secure boot?

Cheers.

GeorgeJP

Member

From: Czech Republic

Registered: 2020-01-28

Posts: 190

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

You can use systemd-boot with SecureBoot.
I am using Unified kernel image (created by mkinitcpio) and sbctl for signing files.
Only problem - RandomSeed is currently not taken into account during boot.

jal

Member

Registered: 2015-04-23

Posts: 37

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

Thanks for the reply, George!

I signed that unsigned, retried sb - it works.

$ sbctl status
Installed:	✓ sbctl is installed
Owner GUID:	---
Setup Mode:	✓ Disabled
Secure Boot:	✓ Enabled

GeorgeJP

Member

From: Czech Republic

Registered: 2020-01-28

Posts: 190

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

Just hint - if you sign files with

sudo sbctl sign -s file

they will be added to list automatically signed with mkinitcpio hook after update.
You can verify signing by

sudo sbctl list-files

jal

Member

Registered: 2015-04-23

Posts: 37

Re: [SOLVED] SecureBoot and RandomSeed [Not yet implemented in systemd]

Thanks George, the -s flag will be handy (I had written a bash script to sign each after updating, seemed a bit amateurish)