From c643bcf0e9e241677c4cc93c4dadccc4445ce6a9 Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Tue, 4 Mar 2025 04:58:37 +0000 Subject: [PATCH] (post-update): UKI + Secure Boot with sbctl on ArchLinux: systemd-boot walkthrough Add loader.conf --- ...ecure-boot-on-archlinux-systemd-boot-walkthrough.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/_posts/2025-03-04-uki-secure-boot-on-archlinux-systemd-boot-walkthrough.md b/_posts/2025-03-04-uki-secure-boot-on-archlinux-systemd-boot-walkthrough.md index 1f69e6f..7d88501 100644 --- a/_posts/2025-03-04-uki-secure-boot-on-archlinux-systemd-boot-walkthrough.md +++ b/_posts/2025-03-04-uki-secure-boot-on-archlinux-systemd-boot-walkthrough.md @@ -203,10 +203,18 @@ System: Boot into FW: supported ``` -## Especial considerations +## Special considerations This setup should continue to work even if you update the BIOS, as long as you don't clear the keys/certs, but you never know what OEMs can do. If you have any issues, you can always clear the keys/certs and re-enroll the keys. +You may also want to tweak `/boot/loader/loader.conf` a bit to disable editing, setting the resolution, etc. Here's an example: + +```sh +timeout 3 +console-mode max +editor false +``` + # Conclusion That's it! You have successfully set up UKI with Secure Boot on ArchLinux using systemd-boot. It may sound intimidating, but it's not that hard once you get the hang of it, and having a extra layer of security is always a good thing.