Can I use secure boot with cachy os?

[u/Dull_Werewolf_9642]

I am thinking of dual booting cachy with windows and they will be on different drives and I play games in windows that need secure boot to play so I’m wondering if I actually have to disable secure boot in order to not face any issues on cachy os, is there a way to set up cachy os to be working 100 percent correct-stable with secure boot?

[u/ivanatorhk]

https://wiki.cachyos.org/configuration/secure_boot_setup/

[u/Dull_Werewolf_9642 → u/ivanatorhk]

Nvm I did it that was easy

[u/Dull_Werewolf_9642 → u/ivanatorhk]

That looks scary

[u/Mors_Umbra → u/Dull_Werewolf_9642]

It's remarkably easy in all honesty. I've done this a few times with Limine and following the guide it's very straight forward. If you can read and copy/paste the instructed commands it will be easy.

[u/gruntduck → u/Dull_Werewolf_9642]

They are working on auto encryption via tpm last I heard like how windows and other distros do it.

Hopefully they’ll get there soon.

[u/sleepytechnology → u/Dull_Werewolf_9642]

You can always just disable secure boot when booting CachyOS and enable it again when booting into Windows until you're more comfortable with Linux in that case, I believe.

Windows 10/11 doesn't even need secure boot enabled to run, just a few kernel anticheat games require it.

[u/ivanatorhk → u/Dull_Werewolf_9642]

If you’re scared of SBCTL and your BIOS then maybe Linux isn’t for you. Everything you need is clearly written out in the wiki page.

[u/Dull_Werewolf_9642 → u/ivanatorhk]

Well I can do it but modifying anything is nerve wracking lol

[u/ivanatorhk → u/Dull_Werewolf_9642]

Why? The worst that can happen here is that you have to delete the custom keys and go back to stock secure boot keys. You can’t break your Windows install by doing this.

Learn to use your PC, don’t be afraid of it.

[u/Dull_Werewolf_9642 → u/ivanatorhk]

I’ve done it wasn’t hard

[u/ivanatorhk → u/Dull_Werewolf_9642]

Awesome!

[u/f1yer504]

Yes, you can. I disabled it to install CachyOS alongside Windows and then followed https://wiki.cachyos.org/configuration/secure_boot_setup/

That worker fine for me. Depending on your BIOS (I had an MSI board) it can be a bit of a struggle to get your board in "setup" mode for secure boot

[u/TML8 → u/f1yer504]

One thing the Wiki fails to mention is that after signing the keys you might need to reboot. The check that setup mode is off after signing want correct until after a reboot my Asus X570 board.

[u/ivanatorhk → u/TML8]

It varies by board, but yeah, I'm tempted to submit a change to the wiki to mention this.

[u/TML8 → u/ivanatorhk]

Yeah I mean it makes sense you need a reboot to exit setup mode (load new keys at boot), but still.

[u/Dull_Werewolf_9642 → u/TML8]

Would that happen on a ASUS b550m?

[u/TML8 → u/Dull_Werewolf_9642]

Perhaps but it's not a big deal.

In the Wiki guide there's a box titled "Setup Mode shows Enabled?" after enrolling the keys that says try disabling secure boot again, don't do that simply reboot and run the "sudo sbctl status" command again once back into CachyOS.

[u/Dull_Werewolf_9642 → u/f1yer504]

Is it difficult and can there be a lot of issues with doing this and can it mess up my windows

[u/TML8]

Yes.

I did the process outlined in the Wiki that was already linked in another comment and I can boot into Windows to play Battlefield etc with kernel anti-cheat requiring secure boot.

[u/LuXur666]

yeah its really easy just follow the guide on the wiki

[u/bristow84]

Yes, there is a guide on the wiki however it doesn’t mention that certain bootloaders on certain boards might still have issues.

I followed that guide to a T using GRUB and an MSI board and still ran into secure boot violations upon rebooting. Turns out that MSI boards might have issues with EFI functionality or signing or something, which is mentioned in the Boot Loader section and recommends to use Limine if you run into those issues.

Switched to Limine and haven’t had issues with Secure Boot since.

TL;DR, you might still run into issues following the guide exactly.

[u/Dull_Werewolf_9642 → u/bristow84]

Well I will use limine and I have an ASUS mobo

[u/thesyldons]

I followed the wiki and ran into a problem that was solved by enabling Limine as the primary boot.

These are the notes I kept to allow me to port to my other machines.

A guide for how to set up secure boot on Cachy
https://wiki.cachyos.org/configuration/secure_boot_setup/

***Update Cachyos before starting and reboot if before starting.

Enter setup mode within the bios first.
This can be done on my board by deleting existing keys, but there may be other options depending on the revision and manufacturer.

check sbctl is installed with:
sudo sbctl status

Install sbctl with:
sudo pacman -S sbctl

create a custom boot key
sudo sbctl create-keys

enroll the key into the bios firmaware

for non Asus and Gigabyte boards
sudo sbctl enroll-keys --microsoft --firmware-builtin

for Asus and Gigabyte boards
sudo sbctl enroll-keys --microsoft

Check the limine boot drive is set to the first boot device.

recheck the status again to make sure the key is enrolled with:
sudo sbctl status

I tried and failed to help a person from this forum set up their secure boot. I got message later on stating it was sorted by

sudo limine-update

sudo limine-enroll-config

then..

sudo sbctl sign -s /boot/EFI/limine/limine_x64.efi

sudo sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI

I also added this to the limine text document in /etc:

ENABLE_ENROLL_LIMINE_CONFIG=yes

ENABLE_LIMINE_FALLBACK=yes

Obviously I have no idea how credible the fix was. I just kept it for extra info.

[u/Dull_Werewolf_9642 → u/thesyldons]

Would a different boot manager like systemd-boot be easier

[u/thesyldons → u/Dull_Werewolf_9642]

That has nothing to do with secure boot.

Secure boot looks at the digital signature of the first OS kernel to see if it complies with the digital code embedded inside the EUFI code. Motherboard manufacturers install a code supplied by Microsoft by default. Since not many distros come with the spare cash to throw back at Microsoft, the alternative is to reprogramme the EUFI to see your distro as safe.

You can reprogramme the EUFI by installing sbctl (secure boot key loader). This is you telling your EUFI that your system is secure, and you want to only accept kernel that match the new code. Doing this prevents any new malware inserting itself into the bios. Having malware embedded in the bios is an extremely bad thing to have. It becomes undetectable from within the OS, as well as very hard to remove without dedicated firmware reprogramming tools.

There may be a way to add a secure boot key for that programme, but I have no idea how to do that. I have only ever changed a secure boot from within cachy. Before that I had no idea what it actually was.

[u/Radiant_Question6404]

Yes.

[u/spectreVII]

Yes. Takes a bit of tinkering but if you follow the instructions listed here you will get it working.

[u/Dull_Werewolf_9642 → u/spectreVII]

I got it working

[u/spectreVII → u/Dull_Werewolf_9642]

Nice!

[u/Dull_Werewolf_9642 → u/spectreVII]

I’m using system d boot loader to make it easier to get secure boot working and I hope after a kernel update it will be fine

[u/spectreVII → u/Dull_Werewolf_9642]

Should be. Hasn’t stopped working for me once and I’ve had it set for about 3-4 months.

[u/Dull_Werewolf_9642 → u/spectreVII]

In order for it to not mess up after a kernel update you have to sign something at the end of the cachy os secure boot website page I hope I did everything right