


























When creating a Unified Kernel Image for use with Secure Boot, you have a choice of including a boot loader/manager like systemd-boot or creating a UKI without a booloader that boots directly from UEFI. However, I can't figure out what exactly the practical differences are that would motivate someone to pick one over the other.
As far as I can tell, the pros of using systemd-boot for this are:
You get a boot manager, which lets you choose whether to boot normally, boot other OSes on the disk, reboot into firmware, and some other options.
... but seeing as Secure Boot prevents kernel parameters from being set at runtime, will all of the options work?
While the pros of booting directly from UEFI are:
Fewer files in the EFI system partition to worry about keeping secure
Less stuff you have to configure
What pros, cons, and other considerations am I missing?
There are more bootloaders that support UKI and grub even supports SB.
Separate UKI and SB , then decide whether you want to use SB or not.
Hints
Unless you remove platform keys it's not you who controls SB
For a system that needs to be locked down (disallow changes) SB is one of the possible measures
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Lone_Wolf wrote:
Separate UKI and SB , then decide whether you want to use SB or not.
But my question is: *How* do I decide whether to use systemd-boot or not? What factors are there that should inform my decision?
I think Lone_Wolf is talking about Secure Boot in his abbreviation.
As for the bootloader, this is mostly preferences and you already listed the relevant differences. Afaik secure boot should not prevent kernel parameters at runtime assuming you are actually using a bootloader, because the bootloader is signed as well and whatever it passes to the kernel is considered "safe".
FWIW e.g. I use GRUB because I want to be able to load kernels from my root partition directly and I don't trust VFAT stability to keep kernel integrity safe (e.g. it's far more likely you have a corrupted kernel if you had a unsafe shutdown after an update involving the kernel on VFAT than on a proper filesystem). Other than that this is really just up to preferences and if you have a big enough VFAT partition and trust it enough there will not be that much inherent difference
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。