Secure Boot and Haiku

Feedback Hardware
1

I’m not sure if this has been discussed here on the forum before (although it probably has in mailing lists, etc. at some point). But it’s worth pointing out, as I believe a hardware storm is beginning to form, and sadly… I do not think I’m exaggerating.

Booting with authentication is nothing new, and varied form factors from enterprise workstations to mobile devices have implemented forms of it for some time. Chromebook uses Verified Boot, which can be turned off via developer mode. Microsoft introduced Secure Boot in Windows 8, which OEMs adopted in order to meet standards for win32/64 on their hardware. On ARM, it was left up to the hardware provider, and on some, there was no legacy mode – but luckily, on most x86_64 or AMD64 hardware today, Secure Boot (or as the FSF properly refers to it, Shackled Boot) can be turned off or keys can be added to the system.

Now, I was (and am) worried as a Mac user, as well as a Haiku and Gnu/Linux enthusiast as well (I know, glaring contradiction there for sure!) The reason is the T2 chip introduced first in the iMac Pro. And thanks to it, Secure Boot on Mac is now a thing. So far, just like its Windows PC and Chromebook counterparts, secure booting can be controlled, as explained/shown below:

Transcription/text:

Secure Boot

  • Full security: Ensures that only your current OS, or signed operating system software currently trusted by Apple, can run. This mode requires a network connection at software installation time.
  • Medium security: Allows any version of signed operating system software ever trusted by Apple to run.
  • No security: Does not enforce any requirements on the bootable OS.

External Boot

  • Disallow booting from external media: Restricts the ability to boot from any devices such as USB and Thunderbolt drives.
  • Allow booting from external media: Does not restrict the ability to boot from any devices

Image:

macos-high-sierra-startup-security-utility.png746×652 69.5 KB

What makes me post this topic now is that the new MacBook Pro, MacBook Air, and also the Mac mini all have this T2 chip, making nearly the entire Mac lineup (minus the regular iMac and Pro, which have yet to be updated) all Secure Boot machines.

And for the curious, I have not had the opportunity to test this! The latest Mac model I have is currently a 2011 MacBook Pro, so I have not had the luxury to test out Haiku on anything later than that (or to see T2/SB on Apple hardware in action).

But this is a telling sign that the times are indeed changing, and with the iPad Pro (which I do use) being a part of the lockdown reality, I have to wonder how Haiku fits into the next 10 years of computing, including the rumored 2020 removal of Legacy/CSM support. Will Release 1 include Secure Boot support? After seeing Apple roll out Secure Boot in addition to everyone else, I’m beginning to believe that it will need to in order to boot on hardware in the future.

I’m not trying to scare or annoy anyone, stir anything, or be an alarmist. I’m simply stating a concern to raise awareness in the Haiku community of this reality so that Haiku can be ready for the future. I hope this makes sense and that this can be addressed in R1 and beyond.

2 Likes
2

I’m no expert here, but my understanding of “secure boot” is that it just means the .efi loader is signed much the same way Windows or macOS applications are digitally signed. Most EFI BIOSes support adding your own keys to the keyring, which means that one should theoretically already be able to sign the Haiku loader and use it on a “secure-boot-only” machine.

So then for a future release, we would only need to get a valid signing key and use it to sign the EFI loader. That shouldn’t be too hard.

3 Likes
3

In the worst case, one would just load a signed grub and then boot whatever they want from there.

Also, we can run without legacy mode already, as we can boot from EFI. Removal of legacy mode does not mean removal of “non-secure” boot (loading unsigned EFI executables).

Just be careful of this when buying a PC. The ability to run your own code or OS on it seems to be the most basic thing to ask for, and if a manufacturer does not offer that, you should not buy their hardware.

5 Likes
4

On the long-term, it may be wise for Haiku to have its own signed boot loader as “secure boot” is likely to become mandatory rather than optional in the near future…

For now, reading the detailed user’s manual and/or trying booting Haiku from USB are probably the only way to assess if “non-secure-boot” is possible. The later assumes that the store manager is willing to let one booting one of their demo systems from a non-secure USB! I doubt very much this would be allowed in most stores.

5

Most Users are not aware about this issue…

6

It appears that most users typically only wish to buy a “commodity” computer or are at the mercy of their IT department…

Combined, Windows and MacOS users represent around 85% of all users. About half of them are currently using the most recent version of their operating system. The vast majority likely do not venture much beyond what they have/known.

7

I speak for me. I have been using macOS for years and, being given the choice, I would choose it as my main OS, since that’s the (mature) platform I am most comfortable with and for which I have acquired software that I use and depend on. I also like some of the platform design features in terms of software and hardware.

Having said that, I would gladly rather use Haiku if it was able to provide everything I need. Which will probably never happen (for instance I need a way to backup and restore my iPhone occasionally). So, for me it will be always a situation of dual booting, in order to get the best of two platforms. And currently that would mean macOS + Haiku. So, I am also a little bit worried that whenever I decide to purchase my next Mac (this one is 11 years old and asking for retirement) I may loose Haiku compatibility.

1 Like
8

Same here. I use a Mac alongside Haiku and Gnu/Linux as well, because the interface is really beautiful and it works with most applications out there. I think it’s hard for people who don’t understand the paradigm of the Mac (or don’t have a Mac) to get what makes someone who has a Mac fall in love with it — even though it’s the opposite of the free software vibe! :smiley: