sbctl

sbctl - Secure Boot Manager

sbctl intends to be a user-friendly secure boot key manager capable of setting up secure boot, offer key management capabilities, and keep track of files that needs to be signed in the boot chain.

It is written top-to-bottom in Golang using go-uefi for the API layer and doesn't rely on existing secure boot tooling. It also tries to sport some integration testing towards tianocore utilizing vmtest.

Features

• User-friendly
• Manages secure boot keys
• Live enrollment of keys
• Signing database to help keep track of files to sign
• Verify ESP of files missing signatures
• EFI stub generation
• JSON output

Roadmap to 1.0

• Key rotation
• TPM support
• Hardware token support
• Configuration Files
• Automatic boot chain signing using the Boot Loader Interface

Dependencies

• util-linux (using lsblk)
• binutils (using objcopy)
• Go >= 1.20
• asciidoc (only for building)

Installation

To fetch, build and install sbctl from the Github source:

$ go install github.com/foxboron/sbctl/cmd/sbctl@latest
$ $(go env GOPATH)/bin/sbctl

To install through git:

$ git clone https://github.com/foxboron/sbctl.git
$ cd sbctl
$ make
$ ./sbctl

Available packages

For Arch Linux:

# pacman -S sbctl

For Alpine Linux:

# apk add sbctl

For Gentoo Linux:

# emerge --ask app-crypt/sbctl

For openSUSE:

# zypper install sbctl

For Fedora Linux (unofficial package):

# dnf copr enable chenxiaolong/sbctl
# dnf install sbctl

You can find a updated list of sbctl packages on Repology.

In addition, sbctl is also available for Ubuntu (unofficial). Follow the Expert Download links to find installation instructions according to your operating system.

Support and development channel

Development discussions and support happens in #sbctl on the libera.chat IRC network.

Usage

…

Key creation and enrollment

See example enrollment for a workflow with screenshots of real firmware setup menus.

…

Signatures

…

Generate Unified Kernel Images (UKI)

Note: It is generally recommended to use the initramfs generator for this. mkinitcpio and dracut support this through their respective --uki and --uefi flags, or the ukify tool from systemd.

This feature is considered a second class citizen in sbctl.

…

Yubikey Support

To create a signing key with a yubikey, use the --keytype yubikey flag with the create-key command. For example:

…

The command will create a RSA4096 key in the Yubikey's PIV Signature Slot. sbctl will then use the key for signing the UKI. To specify the PIN for the Yubikey, use the SBCTL_YUBIKEY_PIN environment variable:

$ SBCTL_YUBIKEY_PIN=123123 sbctl create-keys --keytype yubikey

Remember to specify the SBCTL_YUBIKEY_PIN when signing the UKI or performing operations that will trigger the sbctl hooks (like mkinitcpio).