this post was submitted on 26 Apr 2025
28 points (91.2% liked)
Linux
53578 readers
1268 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If you're not actually going to be engaging in securing anything with it, just leave it off to avoid issues.
Linux supports secure boot so if a distro supports it it's worth using it.
Linux can use a key signed by Microsoft in a preboot loader and then itself perform its own key authentications for all other processes and software (a shim), forming a secure chain from the BIOS up during boot. You dont have to play with creating your own keys.
So if your OS supports secure boot it is worth using it for added security at boot. Its far from perfect in this set up (as there are plenty of windows OS that also have permission to boot) but it is better than a free for all without it even if the risk is low for most desktop users.
You can go further and generate your own keys and use secure boot and TPM together to lock down the system further but you dont have to to get some benefits from secure boot.
That's not the question though. This is an average user installing Mint. They're probably not enrolling disk encryption with TPM values or SB certs, they're literally asking if it's going to help them by default, and the answer is no. Now, if they were asking how they could increase system security with Secure Boot, I'd answer differently.
Dumb ass advice.
Lol, explain how? Are you using TPM values to actually secure anything? If not, then it's literally doing nothing for you.
Its not doing nothing. Linux uses a Microsoft provided key for initial BIOS authentication and then has its own tree of keys that it uses for security. So it does have the benefits of locking out malicious code/processes even in a default set up.
Using your own secure boot and TPM keys is certainly more secure, but it doesnt follow that secure boot with the default set up is doing nothing to help secure your system at boot.
No idea where you got this understanding from, but it's not accurate. In your example, if a distro has signed binaries, then it will work to verify code loaded during the boot process to help to verify system integrity. As OP asked about Mint, yes it technically does have signed pre boot and boot signed modules.
No, this will not prevent all code/processes that aren't signed from running. That's a ludicrous statement. It will prevent unsigned kernel modules from being loaded (see Nvidia's MOK process), and it will prevent a disk from being hit with sideload attacks perhaps (it should be encrypted anyway), but it absolutely does not prevent a user from running unsigned code, or even using root privs to run harmful code (like running random scripts from GitHub).
So at the end of the day does it help a standard user with security? I would argue no. As I said elsewhere, if this question were about HOW to improve security with SB, I'd have a different answer, but that's not the question OP asked.
You don’t know what you are talking about