BIOS vs EFI vs coreboot vs libreboot

[Patrick]

Enabling SecureBoot breaks tirdad.

This is because tirdad isn’t signed by Debian but with the local DKMS yes. That key however isn’t enrolled by default into the system’s keyring (MOK).

If there’s a solution and if enabling SecureBoot (or even EFI) in VMs makes sense yet is yet to be determined.

related:

enforce kernel module software signature verification [module signing] / disallow kernel module loading by default

We can restrict kernel modules to only be loaded if they’re signed by a valid key. This increases security by making it harder to load a malicious module. We can do this by adding module.sig_enforce=1 as a kernel parameter. https://www.kernel.org/doc/html/v4.19/admin-guide/module-signing.html We can also prevent kernel modules from being loaded or unloaded after boot by setting kernel.modules_disabled=1 with sysctl. I don’t really see a point in this though as module loading requires root and …

allow only loading signed kernel modules / module.sig_enforce=1