1
Ubuntu drops Btrfs, XFS & ZFS boot support with Secure Boot (www.omgubuntu.co.uk)
submitted 1 month ago by to c/LinuxNews@lemmy.world
comment fedilink hide all child comments
 

Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.

Ubuntu 26.10’s signed build of GRUB, which is only used on systems if Secure Boot is turned on, no longer supports /boot on Btrfs, XFS, ZFS, LVM, LUKS encryption or software RAID (other than RAID1).

HFS+, Apple partition table support and JPEG and PNG image loading is also removed.

Since GRUB needs to read the /boot directory to load the kernel and boot Ubuntu, if those files are on one of the affected filesystems, it can’t access them and the system won’t boot.

Ubuntu 26.10 still supports /boot on ext4, FAT and ISO9660 (used for booting from CD/DVDs), as well as, naturally, squashfs for snaps with Secure Boot enabled

If Secure Boot is disabled, GRUB’s full feature set is loaded, meaning exotic /boot setups and any GRUB customisation tweaks, like image backgrounds work as normal.

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
4 comments in c/news@lemmy.linuxuserspace.show view that post
[–] 8 points 1 month ago (2 children)

I don't understand what kind of problem/threat secure boot solves. Is that something useful to end users, or more of a corporative measure to protect their hardware running in untrusted environments?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 9 points 1 month ago* (1 child)

    As I understand it, it's Microsofts attempt to only allow booting kernels signed by them or their partners. In theory this stops malicious attacks from changing the kernel and have it booted. But Secure Boot is just something you can turn off.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 month ago

    Not only that, earlier this year, it was discovered that there was a flaw in Secure Boot that meant it never even did the one thing it was supposed to do. This update is designed to make it functional for the first time.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 1 month ago

    As far as I can understand, only /boot has to be on a fat/ext4/iso9660 partition (apart from efi which has to be on a fat by itself). As efi is mounted on /boot/efi, I figure we'll need 2 separate partitions besides / (and whatever other partitions we might want to separate / into).

    I start to worry that more and more of the system has to be uncovered to an attacker: if you keep the distro's kernel, it'll be easy to figure out the system installed on / so 90% of the data on disk will be known. No need for luks except for /home.

    Is there a way to have whole disk encryption on linux and secure boot at the same time? efi already has to be unencrypted right? Now /boot...

    Can systemd-boot save the day?

  • permalink
  • fedilink
  • source
    •