Securing an Arch Linux Install

[smn]

@mbernhard Yes, the dracut hook makes sure dracut signs the UEFI bins it generates. However I have not yet gone for this since I’m not sure how to re-enroll the framework KEK and DB to allow for firmware updates later.

Secureboot setup mode

In the UEFI setup page for Security, sub-page Secure Boot, choose “Erase all Secure Boot Settings.” That will put the platform into Setup mode. After you enroll your own keys, if you want to retain the ability to upgrade the firmware and run other boot applications provided by Framework Computer you will need to re-enroll their DB and KEK¹. ¹ I have a thread requesting an official source for those certificates here: Request: Publish the Secure Boot DB and KEK certificates