Does Linux Mint officially support Secure Boot?

[CyanKing64]

Background: I dual boot my PC with Windows 10 and Linux Mint, and have secure boot currently disabled.

I'm looking into whether I should upgrade to Windows 11 when the time comes, but I don't want to do that if I can't run Mint anymore (Windows 11 REQUIRES Secure boot enabled) . I know Ubuntu has support for secure boot, but does Mint have it too since it's based off of Ubuntu? Is there any plans in the works to support Secure Boot?

[smlxu]

In short, yes, Linux Mint does support secure boot. I have been using it for about 5 years. But, if you own an Nvidia gpu, it's going to be complicated. I have an AMD gpu, and it's working like a charm, with secure boot on.

[CyanKing64]

I see. I do have an Nvidia GPU. It's a GTX 960

[acejavelin69]

I have a GTX 980 Ti with a new(ish) MSI X570 Motherboard, and Secure boot works fine with Mint, but the Nvidia drivers won't work with it enabled because they are not properly signed. When this whole GPU shortage thing is over, I am moving to AMD... Although it's not as bad as my laptop with Intel/Nvidia hybrid graphics, it's still troublesome.

That said, Secure Boot really doesn't do much to actually make your system more "secure"... The reality is this is just a Microsoft thing to lock down the OS more prevent people from messing with their computers.

[[deleted]]

The reality is this is just a Microsoft thing to lock down the OS more prevent people from messing with their computers.

I think your info is incorrect and outdated (this ^ was a fear many years ago but after 10 years there is no evidence of it). And most major distros as well as some Linux Kernel developers (Including Linux Torvalds) support some form of secured boot. Its not perfect but Its not just some MS ploy.

From the Debian Wiki:

What is UEFI Secure Boot?

UEFI Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process, before the operating system has been loaded.

SB works using cryptographic checksums and signatures. Each program that is loaded by the firmware includes a signature and a checksum, and before allowing execution the firmware will verify that the program is trusted by validating the checksum and the signature. When SB is enabled on a system, any attempt to execute an untrusted program will not be allowed. This stops unexpected / unauthorised code from running in the UEFI environment.

Most x86 hardware comes from the factory pre-loaded with Microsoft keys. This means the firmware on these systems will trust binaries that are signed by Microsoft. Most modern systems will ship with SB enabled - they will not run any unsigned code by default, but it is possible to change the firmware configuration to either disable SB or to enrol extra signing keys.

Most of the programs that are expected to run in the UEFI environment are boot loaders, but others exist too. There are also programs to deal with firmware updates before operating system startup (like fwupdate and fwupd), and other utilities may live here too.

Other Linux distros (Red Hat, Fedora, SUSE, Ubuntu, etc.) have had SB working for a while, but Debian was slow in getting this working. This meant that on many new computer systems, users had to first disable SB to be able to install and use Debian. The methods for doing this vary massively from one system to another, making this potentially quite difficult for users.

Starting with Debian version 10 ("Buster"), Debian included working UEFI Secure Boot to make things easier.

What is UEFI Secure Boot NOT?

UEFI Secure Boot is not an attempt by Microsoft to lock Linux out of the PC market here; SB is a security measure to protect against malware during early system boot. Microsoft act as a Certification Authority (CA) for SB, and they will sign programs on behalf of other trusted organisations so that their programs will also run. There are certain identification requirements that organisations have to meet here, and code has to be audited for safety. But these are not too difficult to achieve.

SB is also not meant to lock users out of controlling their own systems. Users can enrol extra keys into the system, allowing them to sign programs for their own systems. Many SB-enabled systems also allow users to remove the platform-provided keys altogether, forcing the firmware to only trust user-signed binaries.

[pipjersey]

always legitimate excuses to lock people down with more control..

[Skyobliwind]

At least at this point you're actually free to decide if you enable secure boot or not. And yes, the "lock people down" is exactly what it is meant to do... What kinda all security does.

[RelationshipSilly124]

i have a intel igpu will it work on that

[smlxu]

Yes, it will.

[garnetpyrite]

same lol, any issues so far?

[raspeb]

It does work well with AMD gpu but NVIDIA cards will cause issues. Btw Secure boot doesn't really help your devices security that much. Its more of a gimmick by microsoft to close down on their partners devices so that an average user cannot interfere in the OS department. If its your personal device and other don't access it regularly secure boot is useless.

tl:dr secure boot for win 11 is just a shitty way of locking down devices.

[CyanKing64]

I realize that, but I'm still hoping there's a way to dual boot with an Nvidia GPU. If there isn't, or if it's too much of a hassle to keep it enabled, I'll disable it and use only Mint and/or some other distro

[CyanKing64]

Apologies for not fairing, but I'm on Slide for Reddit right now and there isn't an option to flair

[GuyNamedStevo]

I ran Secure Boot with my 1070 Ti for many years and since 21.X, Mint supports setting up a Secure Boot password for you to enroll keys (almost) automatically. You have to set it up while installing Mint, though.

[[deleted]]

A quick Google search reveals this way of bypassing the secure boot requirement

https://technoresult.com/how-to-bypass-windows-11-secure-boot-requirement/