Patently false. I’m secure-booting all my Ubuntu installations and (iirc) I could do that too back when I used Fedora.
Why do people keep repeating this FUD? Linux plus UEFI Secure Boot works fine as long as you use the signed version of GRUB. It’s not hard.
Edit: Downvotes? Really? For clearing up a (way too) common misunderstanding about Linux and UEFI, with facts? Jeez guys.
The Amazon customer was evidently confident enough to flip BIOS settings (or attempt to) but may have not known how to get Secure Boot working properly.
The default Ubuntu installation media boots OOB.
It’s really, really not hard.
1. Too guaranteed boot Linux with UEFI Secure Boot OOB without technical fiddling you have to use GRUB signed using keys trusted by Microsoft, like Canonical’s keys. So kinda, yes.
2. Many firmwares allows you to roll your own keys, meaning you don’t have to trust MS or Canonical or anyone else.
So you have the choice between user-friendly (default) or improved security (requires fiddling).
I personally think the default makes sense for most users, and I’m already 200 miles beyond proving that Linux can indeed use UEFI and Secure Boot. That’s an established fact for more than half a decade now.
Not being able to disable those in BIOS won’t prevent you from loading Linux, and it would reflect better on the wider Linux-community if people stopped pushing such FUD.
Canonical has a good write up here, if you want more details: https://wiki.ubuntu.com/UEFI/SecureBoot
I personally haven't seen a computer yet that doesn't allow this. Even if it's not provided the option to disable secure-boot is still available.
Phones are the real problem. As far as I can find only the Pixel phones will allow secure boot with a custom OS. If you own another phone you're already locked in to your manufacturers keys or no keys.
I don't like Ubuntu, in fact I consider it the worse Linux distributions (it was good in the old days, nowadays is full of crap like snap packages and commercial stuff).
Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules. That depending on the situations can be a problem (for example a lot of third party drivers, for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them).
I can’t recall having issues with Fedora, but I’m not 100% on that. I might be wrong.
> Also, secure boot will have implications, for example with secure boot enabled you cannot load unsigned kernel modules.
I mean, that’s kinda the point. You should be able to boot into a kernel you can trust is untampered, and that includes blocking unsigned modules from being loaded.
Let’s face it: allowing that would essentially erase any trust you had built up until that point.
You can always enroll your own keys though?
> for example the NVIDIA one, works by building a kernel module, you cannot install them, the distribution must provide a binary signed module or you won't be able to use them
For Nvidia that’s a bit if a pain, but I’m not a gamer and has always used the open source nouveau drivers instead.
For me secure boot is clearly worth it (much improved security) at near no cost. For you the tally may be different, and I’m ok with that.
I’m just trying to help kill the myth that you can’t UEFI secure boot Linux, because clearly you can. People are doing it every day.
At this point you have to be wilfully ignorant if you still believe you can’t.
But look in this thread: replies upon replies and downvotes en masse on unopinionated, factual posts. Maybe some people really want to remain ignorant? I really can’t tell.
https://docs.fedoraproject.org/en-US/Fedora/18/html-single/U...
With the access to the UEFI, you can add your own trusted key, without needing to rely on Microsoft good will on signing your preloader.
It literally couldn’t be simpler.
Very ridiculous. You have to get someone else to sign it for you, don't you?
I tried with Ubuntu, Pop-OS, Arch, Manjaro... All except Fedora require to disable Secure Boot.