UEFI Secure Boot - Revision history

Coolreader18: Add note on osslsigncode

2026-03-30T19:23:06Z

Add note on osslsigncode

← Older revision		Revision as of 19:23, 30 March 2026
Line 84:		Line 84:

	Note: If you needed to use sbctl, you will have to run <code>sbctl sign /boot/efi/Alpine/linux-lts.efi</code> every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.		Note: If you needed to use sbctl, you will have to run <code>sbctl sign /boot/efi/Alpine/linux-lts.efi</code> every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.

			== Troubleshooting ==

			In some cases on some older motherboards, the firmware will reject UEFI executables signed by sbsign. In that case, [https://github.com/mtrojnar/osslsigncode osslsigncode] may work instead.<sup>[https://superuser.com/a/1560609]</sup>

	== See also ==		== See also ==

Prabuanand: rephrased sentence

2025-05-24T13:37:23Z

rephrased sentence

← Older revision		Revision as of 13:37, 24 May 2025
Line 1:		Line 1:
	This page documents the procedure to enable Secure Boot after Alpine Linux is installed. ~~Secure Boot~~ needs to be disabled in [[~~Alpine_and_UEFI\|~~UEFI]] firmware ~~to install Alpine Linux~~.		This page documents the procedure to enable [[UEFI]] Secure Boot after Alpine Linux is installed. To install Alpine Linux, secure boot needs to be disabled in [[UEFI]] firmware.

	== Mounting ESP ==		== Mounting ESP ==

Prabuanand: changed introduction paragraph

2025-05-24T13:10:10Z

changed introduction paragraph

← Older revision		Revision as of 13:10, 24 May 2025
Line 1:		Line 1:
	~~Refer~~ [[Alpine_and_UEFI\|UEFI]] ~~page for info other than Secure boot~~.		This page documents the procedure to enable Secure Boot after Alpine Linux is installed. Secure Boot needs to be disabled in [[Alpine_and_UEFI\|UEFI]] firmware to install Alpine Linux.

	== Mounting ESP ==		== Mounting ESP ==

	Prepare mount point for UEFI partition (ESP) at {{path\|/boot/efi}}:		Prepare mount point for UEFI partition (ESP) at {{path\|/boot/efi}}: {{cmd\|# install -d -m 000 /boot/efi}}

	{{cmd\|# install -d -m 000 /boot/efi}}

	~~Add the following line to {{path\|/etc/fstab}}:~~

	{{Cat\|/etc/fstab\|...		Add the following line to {{path\|/etc/fstab}} as follows: {{Cat\|/etc/fstab\|...
	UUID{{=}}<first-partition-uuid> /boot/efi vfat rw,noatime,fmask{{=}}0022,dmask{{=}}0022,codepage{{=}}437,iocharset{{=}}ascii,shortname{{=}}mixed,utf8,errors{{=}}remount-ro 0 2}}		UUID{{=}}<first-partition-uuid> /boot/efi vfat rw,noatime,fmask{{=}}0022,dmask{{=}}0022,codepage{{=}}437,iocharset{{=}}ascii,shortname{{=}}mixed,utf8,errors{{=}}remount-ro 0 2}}

	Mount it:		Mount it: {{cmd\|# mount /boot/efi}}

	{{cmd\|# mount /boot/efi}}

	== Generating own UEFI keys ==		== Generating own UEFI keys ==

	Install package {{pkg\|efi-mkkeys}}:		Install package {{pkg\|efi-mkkeys}}: {{cmd\|# apk add efi-mkkeys}}

	{{cmd\|# apk add efi-mkkeys}}

	Before creating new keys and modifying EFI variables, it is advisable to backup the current variables, so that they may be restored in case of error:		Before creating new keys and modifying EFI variables, it is advisable to backup the current variables, so that they may be restored in case of error:
Line 27:		Line 20:
	# for i in PK KEK db dbx; do efi-readvar -v $i -o $i.esl; done }}		# for i in PK KEK db dbx; do efi-readvar -v $i -o $i.esl; done }}

	Generate your self-signed PK, KEK and db key, including .esl and .auth files:		Generate your self-signed PK, KEK and db key, including .esl and .auth files: {{cmd\|# efi-mkkeys -s "Your Name" -o /etc/uefi-keys}}

	~~{{cmd\|# efi-mkkeys -s "Your Name" -o /etc/uefi-keys}}~~		Now you can uninstall {{pkg\|efi-mkkeys}} if you want: {{cmd\|# apk del efi-mkkeys}}

	Now you can uninstall {{pkg\|efi-mkkeys}} if you want:

	{{cmd\|# apk del efi-mkkeys}}

	== Generating Unified Kernel Image ==		== Generating Unified Kernel Image ==
Line 41:		Line 30:
	{{cmd\|# apk add secureboot-hook systemd-efistub efibootmgr}}		{{cmd\|# apk add secureboot-hook systemd-efistub efibootmgr}}

	{{~~note~~\|{{pkg\|systemd-efistub}} only provides EFI stub binaries, it doesn’t depend on any systemd components~~. {{pkg\|gummiboot-efistub}} doesn’t work anymore~~.}}		{{Note\|From Alpine Linux v3.22, {{pkg\|gummiboot-efistub}} doesn’t work. {{pkg\|systemd-efistub}} only provides EFI stub binaries, and it doesn’t depend on any systemd components.}}

	Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:		Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:
Line 47:		Line 36:
	<pre>cmdline="root=UUID=<uuid-of-your-root-fs> modules=ext4"</pre>		<pre>cmdline="root=UUID=<uuid-of-your-root-fs> modules=ext4"</pre>

	Run kernel hooks:		Run kernel hooks: {{cmd\|# apk fix kernel-hooks}}

	{{cmd\|# ~~apk fix kernel-hooks~~}}		Disable {{pkg\|mkinitfs}} trigger: {{cmd\|# echo 'disable_trigger{{=}}yes' >> /etc/mkinitfs/mkinitfs.conf}}

	~~Disable {{pkg\|mkinitfs}} trigger:~~		Add boot entry: {{cmd\|# efibootmgr --disk <dev> --part 1 --create --label 'Alpine Linux' --load /Alpine/linux-lts.efi --verbose}}

	~~{{cmd\|# echo 'disable_trigger{{=}}yes' >> /etc/mkinitfs/mkinitfs.conf}}~~

	Add boot entry:

	{{cmd\|# efibootmgr --disk <dev> --part 1 --create --label 'Alpine Linux' --load /Alpine/linux-lts.efi --verbose}}

	Note: This procedure only needs to be done once; after that the Unified Kernel Image will be generated automatically every time the kernel is upgraded.		Note: This procedure only needs to be done once; after that the Unified Kernel Image will be generated automatically every time the kernel is upgraded.
Line 106:		Line 89:
	* [[Initramfs init]]		* [[Initramfs init]]
	* <code>mkinitfs-bootparam(7)</code>		* <code>mkinitfs-bootparam(7)</code>

	~~== Resources ==~~

	* [https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot Sakaki's EFI Install Guide/Configuring Secure Boot - Gentoo Wiki]		* [https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot Sakaki's EFI Install Guide/Configuring Secure Boot - Gentoo Wiki]

Jirutka: Replace gummiboot-efistub with systemd-efistub

2025-05-23T22:15:44Z

Replace gummiboot-efistub with systemd-efistub

← Older revision		Revision as of 22:15, 23 May 2025
Line 37:		Line 37:
	== Generating Unified Kernel Image ==		== Generating Unified Kernel Image ==

	Install package {{pkg\|secureboot-hook}}, {{pkg\|gummiboot-efistub}}, and {{pkg\|efibootmgr}}:		Install package {{pkg\|secureboot-hook}}, {{pkg\|systemd-efistub}} (Alpine v3.22+) or {{pkg\|gummiboot-efistub}} (prior v3.22), and {{pkg\|efibootmgr}}:

	{{cmd\|# apk add secureboot-hook gummiboot-efistub ~~efibootmgr~~}}		{{cmd\|# apk add secureboot-hook systemd-efistub efibootmgr}}

			{{note\|{{pkg\|systemd-efistub}} only provides EFI stub binaries, it doesn’t depend on any systemd components. {{pkg\|gummiboot-efistub}} doesn’t work anymore.}}

	Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:		Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:

WhyNotHugo: Add "See also" section

2024-11-12T05:49:43Z

Add "See also" section

← Older revision		Revision as of 05:49, 12 November 2024
Line 99:		Line 99:

	Note: If you needed to use sbctl, you will have to run <code>sbctl sign /boot/efi/Alpine/linux-lts.efi</code> every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.		Note: If you needed to use sbctl, you will have to run <code>sbctl sign /boot/efi/Alpine/linux-lts.efi</code> every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.

			== See also ==

			* [[Initramfs init]]
			* <code>mkinitfs-bootparam(7)</code>

	== Resources ==		== Resources ==

Prabuanand: added reference to UEFI page

2024-09-08T14:01:45Z

added reference to UEFI page

← Older revision		Revision as of 14:01, 8 September 2024
Line 1:		Line 1:
			Refer [[Alpine_and_UEFI\|UEFI]] page for info other than Secure boot.
	== Mounting ESP ==		== Mounting ESP ==

WhyNotHugo: Add category UEFI

2023-11-07T10:09:37Z

Add category UEFI

← Older revision		Revision as of 10:09, 7 November 2023
Line 105:		Line 105:
	* [https://github.com/jirutka/efi-mkuki efi-mkuki: EFI Unified Kernel Image Maker] (used by the {{pkg\|secureboot-hook}} package)		* [https://github.com/jirutka/efi-mkuki efi-mkuki: EFI Unified Kernel Image Maker] (used by the {{pkg\|secureboot-hook}} package)

	[[Category:Booting]]		[[Category:Booting]] [[Category:UEFI]]

Jirutka: Add gummiboot-efistub to packages needed to install

2023-09-05T23:31:52Z

Add gummiboot-efistub to packages needed to install

← Older revision		Revision as of 23:31, 5 September 2023
Line 36:		Line 36:
	== Generating Unified Kernel Image ==		== Generating Unified Kernel Image ==

	Install package {{pkg\|secureboot-hook}} and {{pkg\|efibootmgr}}:		Install package {{pkg\|secureboot-hook}}, {{pkg\|gummiboot-efistub}}, and {{pkg\|efibootmgr}}:

	{{cmd\|# apk add secureboot-hook efibootmgr}}		{{cmd\|# apk add secureboot-hook gummiboot-efistub efibootmgr}}

	Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:		Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:

Ziproot: /* Enrolling UEFI keys */ Make command in newly created note note one line

2023-05-14T22:01:57Z

Enrolling UEFI keys: Make command in newly created note note one line

← Older revision		Revision as of 22:01, 14 May 2023
Line 97:		Line 97:
	# Press F10 to save settings		# Press F10 to save settings

	Note: If you needed to use sbctl, you will have to run ~~{{cmd\|#~~ sbctl sign /boot/efi/Alpine/linux-lts.efi}} every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.		Note: If you needed to use sbctl, you will have to run <code>sbctl sign /boot/efi/Alpine/linux-lts.efi</code> every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.

	== Resources ==		== Resources ==

Ziproot: /* Enrolling UEFI keys */ Add note about running a command to re-sign the Unified Kernel Image after upgrade if sbctl was used to enroll the keys

2023-05-14T22:00:05Z

Enrolling UEFI keys: Add note about running a command to re-sign the Unified Kernel Image after upgrade if sbctl was used to enroll the keys

← Older revision		Revision as of 22:00, 14 May 2023
Line 96:		Line 96:
	# Change '''Secure Boot''' to '''Enabled'''		# Change '''Secure Boot''' to '''Enabled'''
	# Press F10 to save settings		# Press F10 to save settings

			Note: If you needed to use sbctl, you will have to run {{cmd\|# sbctl sign /boot/efi/Alpine/linux-lts.efi}} every time you upgrade the kernel. You should '''not''' need to disable secure boot, so long as you sign the new Unified Kernel Image before you reboot.

	== Resources ==		== Resources ==

← Older revision		Revision as of 22:15, 23 May 2025
Line 37:		Line 37:
	== Generating Unified Kernel Image ==		== Generating Unified Kernel Image ==

	Install package {{pkg\|secureboot-hook}}, {{pkg\|gummiboot-efistub}}, and {{pkg\|efibootmgr}}:		Install package {{pkg\|secureboot-hook}}, {{pkg\|systemd-efistub}} (Alpine v3.22+) or {{pkg\|gummiboot-efistub}} (prior v3.22), and {{pkg\|efibootmgr}}:

	{{cmd\|# apk add secureboot-hook gummiboot-efistub ~~efibootmgr~~}}		{{cmd\|# apk add secureboot-hook systemd-efistub efibootmgr}}

			{{note\|{{pkg\|systemd-efistub}} only provides EFI stub binaries, it doesn’t depend on any systemd components. {{pkg\|gummiboot-efistub}} doesn’t work anymore.}}

	Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:		Adjust parameter <code>cmdline</code> in {{path\|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>: