No Secure Boot Support?

QUBES.QA · March 7, 2025, 8:24pm

I don’t really know anything about this stuff but I did notice if secure boot is on, qubes os won’t boot… so I turned off secure boot in order to run qubes os.

Did some searches and asked AI but I still don’t have the background knowledge to determine if the info I got are valid or up to date.

In short, is it normal and secure as of today 03/2025 for secure boot to be turned off to in order to boot qubes os? If not, where should I look up for directions to make secure boot work for qubes os?

adw · March 8, 2025, 1:25am

Qubes OS does not yet support secure boot:

github.com/QubesOS/qubes-issues

Secure boot support

opened 12:57PM - 04 Oct 18 UTC

jasperweiss

security P: default C: boot meta-issue

According the secure boot specification, users can enroll their own keys for sec…ure boot. If the QOS bootloader were signed, users could manually enroll the signing key within the UEFI. That would be a better anti evil maid system since it doesn't require the use of potentially untrusted USB keys. Since dom0 doesn't contain any 3rd party applications, we can enforce code signing on anything that runs within it. [This](https://blog.invisiblethings.org/2011/09/07/anti-evil-maid.html) blog post mentions secure boot being problematic due to running CA's etc but providing the user with a public key they can enroll manually would be doable. Edit: I'm aware the developers are generally not very fond of secure boot. Could anyone explain why? Alternatively a TPM could be used to unseal the drive encryption key. > Pre-OS firmware components are hashed (measured) Measurements are initiated by startup firmware (Static CRTM) Measurements are stored in a secure location (TPM PCRs) Secrets (encryption keys) are encrypted by the TPM and bounded to PCR measurements (sealed) Can only be decrypted (unsealed) with same PCR measurements stored in the TPM This chain guarantees that firmware hasn’t been tampered with

github.com/QubesOS/qubes-issues

Document the need to disable Secure Boot prior to attempting Qubes installation

opened 02:39AM - 14 Feb 24 UTC

rjrizzuto

C: doc P: default

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) #…## Qubes OS release (if applicable) 4.2, possibly earlier ### Brief summary I am NOT maintaining documentation, but am glad to point out errors and omissions. I can find nowhere in the installation guide where it says to turn off secure boot. That is certainly not obvious to someone coming from Windows, or even Linux Mint, which do not have that requirement.

QUBES.QA · March 8, 2025, 2:07am

Ah ok. So this is similar info to what I found on random searches. I’m going to assume Qubes OS is still reasonably secure without the secure boot if the devs built it this way.