kdevo / arch-secure-boot

UEFI Secure Boot for Arch Linux + btrfs snapshot recovery. Fork aims to use sbctl.

I am a free-minded and passionate software engineer, tech enthusiast and maker from Aachen.

In my bachelor thesis from 2018, I examined how well Ethereum can be integrated into existing business processes of the FH Aachen. By the start of 2020, I extensively explored the data science field and got fascinated by machine learning projects that improve human interaction. I recently completed my Master of Engineering in Information Systems Engineering where I took a deep dive into the emerging field of Reciprocal Recommender Systems (RRS) from a research and practical point of view. Bringing these views together, you can now fully read my thesis online and experiment with Chaos, a first of its kind framework – with the goal to enrich the RRS landscape with novel approaches for connecting humans.

After graduating, I have worked at gridX, a smart grid company which aims to make sustainable energy more accessible to everyone. Recently, I travelled through South East Asia to experience the various cultures, learn and reflect from a professional and private perspective. I am now offering software engineering services to companies that strive to have a positive impact on our world. Interested? Drop me a message!

In my free time, I am developing open-source software projects, transforming ideas to their physical representation by 3D printing, tinkering with electronic stuff and more! I love the idea behind free software and I use Arch, btw.

arch-secure-boot's Issues

Further automate initial-setup command

Right now the initial-setup command is not really the functional equivalent of the original repository anymore, as there are some manual steps required.

In order to make things less complicated, one could give the user the option to automatically apply changes, though arguably this has a lot of error potential and maybe unwanted side-effects.

Use small EFI binary instead of nsh scripts

Motivation: nsh scripts can't be signed for secure boot, hence they are not tamper-proof.
In order to further minimize the attack surface of running unwanted code, this issue proposes to build a small EFI program that does the simple work of recovery.nsh and nothing more (snapshots.txt file approach can be left as is).

In this small EFI binary, the kernel command line could be "baked in" in order to only make the snapshot selection available to the user via stdin.

Call sbctl sign-all when mkinitcpio is called

Include mkinitcpio hook in order to call sbctl sign-all.
Right now, whenever mkinitcpio is called, it is necessary to sign the EFIs again.

Include mkinitcpio recovery configuration

In

arch-secure-boot/arch-secure-boot

Line 69 in efe11e5

mkinitcpio -p recovery

the preset recovery is mentioned, but there is no documentation or automation available which provides it right now.