GNOME To Warn Users If Secure Boot Disabled, Preparing Other Firmware Security Help

guest · Jul 30, 2022

July 29, 2022

GNOME and Red Hat developers are working on integrating firmware security tips and recommendations into the desktop for warning users about platform/firmware security issues like if UEFI Secure Boot is disabled and other possible avenues their system could be exploited.

Within the GNOME Control Center there is a firmware security area being worked on to show whether UEFI Secure Boot is active, various security protection details like the TPM status, whether Intel BootGuard is present and enabled, IOMMU protection state, and more. Ultimately those involved hope to allow triggering actions in some areas for fixing these issues when found to be in a less than ideal state.
Click to expand...

Similarly within the GDM display manager is this MR that is open for adding a Secure Boot check and warning notification so the user is alerted at log-in time whether their system could be vulnerable.

The Plymouth boot splash screen is also preparing a warning image that would be displayed if Secure Boot is not enabled.
Click to expand...

EASTER · Jul 30, 2022

One small step for users, one giant step for further improvement.

guest · Sep 3, 2022

Ubuntu Isn't Yet Onboard With GNOME's "Device Security" Screen
by Michael Larabel @michaellarabel - August 28, 2022

Coming with GNOME 43 is a "Device Security" panel within the GNOME Control Center. While intended to help ensure their system is protected, Ubuntu isn't onboard with this Device Security functionality yet and has stripped it out from their GNOME build for Ubuntu 22.10.

The GNOME Device Security area warns users if Secure Boot is disabled and other platform-related security settings that are less than ideal. This GNOME integration has been worked on by Red Hat engineers along with the lower-level platform checks tied into Fwupd and the like. Eventually the hope is this Device Security area could assist users in improving their security settings beyond just warning them over the current system state.
Click to expand...

This week Ubuntu 22.10's GNOME Control Center package (gnome-control-center) package patched out the Device Security panel entirely.

This was done per this bug report on the basis of the Device Security feature being "confusing and unhelpful currently."
Click to expand...

For those desiring a security dump of their system firmware state, from the command-line fwupdmgr security does provide some information in the absence of the GNOME Control Center's Device Security area in Ubuntu 22.10.
Click to expand...

Log in or Sign up

GNOME To Warn Users If Secure Boot Disabled, Preparing Other Firmware Security Help

guest Guest

EASTER Registered Member

guest Guest

Log in or Sign up

GNOME To Warn Users If Secure Boot Disabled, Preparing Other Firmware Security Help

guest Guest

EASTER Registered Member

guest Guest

Useful Searches