Post #2668326

2026-05-04 01:07 UTC

Once you’re booted secure boot is inactive. If there was a security benefit to only loading signed modules, then distros would have that enabled by default regardless of the secure boot status. Iirc, requiring modules be signed is a requirement Microsoft put on the shim bootloader rather than Lunux’s choice. I could be mistaken here, I’m not too sure on the specifics. Regardless, if someone has the ability to load or modify modules on an encrypted Linux install, they can just steal Firefox’s cookie jar and cut out the intermediate step.

Replies (1)

@Auth@lemmy.world 2026-05-06 04:52

I might be wrong on some of this so take it with a grain of salt but heres my view. Its not only loading signed modules it enables kernel lockdown mode which prevents even the root user from accessing certain kernel functions. This prevents them from installing persistent malware and a host of other attacks. Fedora and other distros that ship secure boot do enable this. Yes microsoft signs the shim but I believe other authorities are being worked on. If someone gets root on your system they can do a lot of damage but you can still prevent it and limit it. Stealing my firefox cookies is much better than installing persistent malware. If my cookies are stolen I can clear the malware and reset my passwords, same cannot be said for loading something into the kernel.

Open ##2668327