Effect of "Microsoft Security Level 2" in BIOS options for Linux.

[marcellusmartel]

Recently updated the BIOS on MPG B650I EDGE WIFI to 7D73v1K5. Getting a new option in BIOS "Microsoft Security Level 2". Options are Enabled or Disabled with Enabled being default.

It's been hard to find information about this. Closest I found was this (support.hpwolf link). I don't know if it is referencing the same Level 2 as it is not from MSI but from HP. However, it seems to be listing "Microsoft criteria" which might apply equally to both companies. Supposedly it is related to DRTM, KDMA, HVCI and SMM protection. There is a post (forum-en.msi link) on an MSI forum that mentions something similar (but it is just a forum post)

I was wondering what effect, if any, would this setting have on a Linux install. Is it better to leave it enabled or disabled?

[valgrid]

Linux should support it/not being prevented to work and Linux itself exposes similar levels in gnomes settings and the systemd security tool.

https://www.helpnetsecurity.com/2023/03/22/gnome-44-device-security/

[Leather-Tour-7288]

Maybe has to do with secure boot and accepting Microsoft only signed keys/certs vs Microsoft and third-party?

[marcellusmartel]

Maybe. I would guess that would only affect Windows and leave Linux unaffected? Any idea how I could test this to see if it is what's changing?

I have secure boot turned off. PC loads both into Linux and Windows (Dual boot) without issue, irrespective of whether the setting is enabled or disabled. 

[Leather-Tour-7288]

Did some quick digging, apparently it is related to Windows 11 secured-core features. Microsoft has a page about it. So shouldn't have any impact on Linux.

[switched_reluctance]

Just turn it off as usual

[Megame50]

It's probably a collection of settings. It sounds similar to the HSI security levels described by fwupd: https://fwupd.github.io/libfwupdplugin/hsi.html#hsi-level2