TechSpace Knowledgebase
Search:     Advanced search
Browse by category:
Contact Us

How Secure Boot Works on Windows 8 and 10, and What It Means for Linux

Views: 932
Votes: 1
Posted: 22 Nov, 2016
Updated: 23 Nov, 2016

Modern PCs ship with a feature called “Secure Boot” enabled. This is a platform feature in UEFI, which replaces the traditional PC BIOS. If a PC manufacturer wants to place a “Windows 10” or “Windows 8” logo sticker to their PC, Microsoft requires they enable Secure Boot and follow some guidelines.

Unfortunately, it also prevents you from installing some Linux distributions, which can be quite a hassle.

How Secure Boot Secures Your PC’s Boot Process

Secure Boot isn’t just designed to make running Linux more difficult. There are real security advantages to having Secure Boot enabled, and even Linux users can benefit from them.

A traditional BIOS will boot any software. When you boot your PC, it checks the hardware devices according to the boot order you’ve configured, and attempts to boot from them. Typical PCs will normally find and boot the Windows boot loader, which goes on to boot the full Windows operating system. If you use Linux, the BIOS will find and boot the GRUB boot loader, which most Linux distributions use.

However, it’s possible for malware, such as a rootkit, to replace your boot loader. The rootkit could load your normal operating system with no indication anything was wrong, staying completely invisible and undetectable on your system. The BIOS doesn’t know the difference between malware and a trusted boot loader–it just boots whatever it finds.

Secure Boot is designed to stop this. Windows 8 and 10 PCs ship with Microsoft’s certificate stored in UEFI. UEFI will check the boot loader before launching it and ensure it’s signed by Microsoft. If a rootkit or another piece of malware does replace your boot loader or tamper with it, UEFI won’t allow it to boot. This prevents malware from hijacking your boot process and concealing itself from your operating system.

How Microsoft Allows Linux Distributions to Boot with Secure Boot

This feature is, in theory, just designed to protect against malware. So Microsoft offers a way to help Linux distributions boot anyway. That’s why some modern Linux distributions–like Ubuntu and Fedora–will “just work” on modern PCs, even with Secure Boot enabled. Linux distributions can pay a one-time fee of $99 to access the Microsoft Sysdev portal, where they can apply to have their boot loaders signed.

Linux distributions generally have a “shim” signed. The shim is a small boot loader that simply boots the Linux distributions main GRUB boot loader. The Microsoft-signed shim checks to ensure it’s booting a boot loader signed by the Linux distribution, and then the Linux distribution boots normally.

Ubuntu, Fedora, Red Hat Enterprise Linux, and openSUSE currently support Secure Boot, and will work without any tweaks on modern hardware. There may be others, but these are the ones we’re aware of. Some Linux distributions are philosophically opposed to applying to be signed by Microsoft.

How You Can Disable or Control Secure Boot

If that was all Secure Boot did, you wouldn’t be able to run any non-Microsoft-approved operating system on your PC. But you can likely control Secure Boot from your PC’s UEFI firmware, which is like the BIOS in older PCs.

There are two ways to control Secure Boot. The easiest method is to head to the UEFI firmware and disable it entirely. The UEFI firmware won’t check to ensure you’re running a signed boot loader, and anything will boot. You can boot any Linux distribution or even install Windows 7, which doesn’t support Secure Boot. Windows 8 and 10 will work fine, you’ll just lose the security advantages of having Secure Boot protect your boot process.

You can can also further customize Secure Boot. You can control which signing certificates Secure Boot offers. You’re free to both install new certificates and remove existing certificates. An organization that ran Linux on its PCs, for example, could choose to remove Microsoft’s certificates and install the organization’s own certificate in its place. Those PCs would then only boot boot loaders approved and signed by that specific organization.

An individual could do this, too–you could sign your own Linux boot loader and ensure your PC could only boot boot loaders you personally compiled and signed. That’s the kind of control and power Secure Boot offers.

What Microsoft Requires of PC Manufacturers

Microsoft doesn’t just require PC vendors enable Secure Boot if they want that nice “Windows 10” or “Windows 8” certification sticker on their PCs. Microsoft requires PC manufacturers implement it in a specific way.

For Windows 8 PCs, manufacturers had to give you a way to turn Secure Boot off. Microsoft required PC manufacturers to put a Secure Boot kill switch in users’ hands.

For Windows 10 PCs, this is no longer mandatory. PC manufacturers can choose to enable Secure Boot and not give users a way to turn it off. However, we’re not actually aware of any PC manufacturers that do this.

Similarly, while PC manufacturers have to include Microsoft’s main “Microsoft Windows Production PCA” key so Windows can boot, they don’t have to include the “Microsoft Corporation UEFI CA” key. This second key is only recommended. It’s the second, optional key that Microsoft uses to sign Linux boot loaders. Ubuntu’s documentation explains this.

In other words, not all PCs will necessarily boot signed Linux distributions with Secure Boot turned on. Again, in practice, we haven’t seen any PCs that did this. Perhaps no PC manufacturer wants to make the only line of laptops you can’t install Linux on.

For now, at least, mainstream Windows PCs should allow you to disable Secure Boot if you like, and they should boot Linux distributions that have been signed by Microsoft even if you don’t disable Secure Boot.

Secure Boot Couldn’t Be Disabled on Windows RT, but Windows RT is Dead

All of the above is true for standard Windows 8 and 10 operating systems on the standard Intel x86 hardware. It’s different for ARM.

On Windows RT—the version of Windows 8 for ARM hardware, which shipped on Microsoft’s Surface RT and Surface 2, among other devices—Secure Boot couldn’t be disabled. Today, Secure Boot still can’t be disabled on Windows 10 Mobile hardware–in other words, phones that run Windows 10.

That’s because Microsoft wanted you to think of ARM-based Windows RT systems as “devices,” not PCs. As Microsoft told Mozilla, Windows RT “isn’t Windows anymore.”

However, Windows RT is now dead. There’s no version of the Windows 10 desktop operating system for ARM-hardware, so this isn’t something you have to worry about anymore. But, if Microsoft does bring back Windows RT 10 hardware, you likely won’t be able to disable Secure Boot on it.

Others in this Category
document How to clear your download history
document How to change your screen resolution
document How to ping test in Windows 10
document How to ping test in Windows XP
document How to ping test in Windows 7 and Vista
document How to ping test in Windows 8
document Enable Hyper-V on Windows 8.1
document Enable Built-in Administrator Account in Windows
document Disable Built-in Administrator Account
document Turning Off BitLocker Drive Encryption (Windows 7)
document Uninstalling SP1 using Programs and Features
document Uninstalling SP1 using the Command Prompt
document Installing SP1 using an installation DVD
document Disable Office updates on Windows 8.1 or Windows 7
document Disable Office 2016/2013 updates on Windows 10
document Disable Office 365 updates
document How to fix “The User Profile Service failed the logon. User profile cannot be loaded”
document Connect your computer to a domain on Windows 7
document Getting To Safe Mode From Within Windows 8 or 10
document How to repair Office 2010/2013
document How to printing a Test Page in Windows 7.
document How to disable Windows 8.1 Startup Programs.
document How to remove apps and programs Windows.
document How To Enable Windows Defender On Windows 8/Windows 8.1
document How to export an Outlook 2010 .pst fil
document How to change, add, or remove a drive letter
document Create and format a new partition (volume)
document Reset Windows Activation/Remove license key
document How to restore a Windows 8 laptop or PC to factory default settings
document How to insert a Pivot Table
document How to Change / Set a Password in Windows 10
document Create a local user account in Windows 10
document Change a display language
document Change the keyboard layout or other method you use to type
document Change your display language in Windows 8
document "The command cannot be performed" error message when you double-click to open a document in Word 2007 or in Word 2003
document How to Recover Software Product Keys From Any Computer, Even a Broken One
document How to Customize the Taskbar in Windows 10
document How to Create a Guest Account in Windows 10
document How to Disable Driver Signature Verification on 64-Bit Windows 8 or 10 (So That You Can Install Unsigned Drivers)
document How to Delete a User Account in Windows 7, 8, or 10
document How to Remove Local User Accounts From the Login Screen in Windows
document How to Disable the Lock Workstation Functionality (Window+L) in Windows
document How to Install Windows on a Chromebook
document How to Change the Default Control Panel View in Windows
document How to Change the Default Quiet Hours in Windows 10
document How to Stop Aero Shake from Minimizing Your Windows
document How to Hide Items from the Control Panel in Windows
document How to Clear Your Internet Explorer Browsing History
document How to Enable the Status Bar and Word Wrap at the Same Time in Notepad
document How to Reset Notepad to Its Default Settings on Windows
document How to Use Sticky Notes on Windows 10
document How to Fix Hard Drive Problems with Chkdsk in Windows 7, 8, and 10
document How to Batch Rename Multiple Files in Windows
document How to Disable Access to the Windows Registry
document 15 Things You Can Do With Cortana on Windows 10.
document How to create a Windows 10 installer USB drive from a Mac.
document How to Change Folder Icon Color in Windows.
document How to Recover Administrator Password in Windows 10, Windows 8 and Windows 7.
document How to Bypass Windows 10 / 8 / 7 Local Administrator Password.
document Do you know the use of Function Keys (F1 to F12)?
document How To Block Or Unblock USB Drives In Windows
document How to make a full backup of your Windows 10 PC