[SOLVED] Secure Boot with PVE coming?

[Bugbear]

Hi!
It's the first time, that I tried to install a Proxmox server with UEFI Secure Boot enabled today and realized that it would not work.
Even the PVE8 docs (https://pve.proxmox.com/wiki/Install_Proxmox_VE_on_Debian_12_Bookworm#PVE_Kernel_fails_to_boot) tell that Secure Boot should just be disabled.

This thread from 2019 mentions:

@fabian: We don't offer signed kernel images or Grub (yet), so there is no Secure Boot with PVE.

As Secure Boot is kind of nice I wonder if there are any plans to ship signed PVE kernel images in foreseeable future?

 

[tom]

We are working on this topic since quite some time and I hope we get this later this year.

 

[Bugbear]

Thank you for this update @tom! I really appreciate the efforts in this matter!

 

[ioo]

Hi!

I see this topic is 'solved' but if i may i temporarily would open it again.

I am not very seasoned secure boot user but still from time to time i take interest in sb. Somehow randomly i stumbled to observe phenomena that running blktrace/blkparse is not successful (why i took interest into blktrace is another story on ordinary Ubuntu/Debian like this

# blktrace -a discard -d /dev/vda -o - | blkparse -i -
Thread 3 failed open /sys/kernel/debug/block/vda/trace3: 1/Operation not permitted
...
FAILED to start thread on CPU 0: 1/Operation not permitted
...
root@pbs-adala-3:~dmesg -T | tail -n 8
[Mon Sep 4 01:39:52 2023] Lockdown: blktrace: debugfs access is restricted; see man kernel_lockdown.7
...

Turns out reason for this is computer has secure boot enabled and more or less automatically it triggers among other things kernel lockdown, newer Ubuntu and Debian kernels have ('man 7 kernel_lockdown')

# grep CONFIG_SECURITY_LOCKDOWN_LSM /boot/config-5.10.0-25-amd64
CONFIG_SECURITY_LOCKDOWN_LSM=y
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y

Now i would like to ask if it would be ok to run proxmox backup server v. 2.4/3.0 with vanilla debian v. 11/12 kernel since using it i could have this secure boot and lockdown? I actually run pbs as virtual machine and ext4 filesystems etc so i think i dont loose much not having pve kernel there in this regard; but otherwise i am thinking to myself if having sb enabled on pbs maybe pbs is otherwise tampered.

And i also, since it seems pve kernels do not have lockdown turned on

# grep CONFIG_SECURITY_LOCKDOWN_LSM /boot/config-6.2.16-4-bpo11-pve
# CONFIG_SECURITY_LOCKDOWN_LSM is not set

would like to ask when you do include secure boot officially do you consider also having lockdown feature turned on? (I wonder if it somehow contradicts with pbs or pve setup in general.)


Best regards,

Imre

 

[ioo]

Hi!

Just wanted to say thanks, in PVE v. 8.1 (and in PBS v. 3.1) i see secure boot and kernel lockdown behave to my mind exactly as expected!


Best regards,

Imre

 

[Bugbear]

Hi! +1 from me too. Very happy to see this security feature in Proxmox

 

[promoxer]

Are you guys using ZFS? After adding turning my rpool into a mirror, I realized the 2nd drive can't boot. Issue here https://forum.proxmox.com/threads/making-a-newly-added-drive-on-mirrored-zfs-bootable.138731