r/archlinux • u/Curious-Listener-YB • 1d ago

QUESTION Is there a good way to combine bootable snapshots, UKIs and and secure boot?

/r/linuxquestions/comments/1x3ccek/is_there_a_good_way_to_combine_bootable_snapshots/
2 Upvotes

56% Upvoted

25 comments sorted by

3

u/Excellent-Love-6943 1d ago

Grub has a btrfs snapshot plugin and can use shim.

Why do you want a UKI if you're using a bootloader though?

-1

u/Curious-Listener-YB 1d ago

That's the point, I don't want to use a bootloader (though I believe UKIs are more secure even with one).

2

u/SmuJamesB 1d ago

I'm pretty sure you need a bootloader for this. choosing what to boot into is what the bootloader is for, no? how else are you gonna boot into an older snapshot?

0

u/Curious-Listener-YB 1d ago

Enter UEFI menu -> choose older snapshot -> boot

Where is the problem?

2

u/Toaster_Strudel_517 1d ago

I think one way you can achieve this is to enable the fallback uki and assign fallback cmdline with the snapshot.

Will be a pain to set up though.

1

u/SmuJamesB 1d ago

the only way to do this would require having an entire duplicate of the kernel per snapshot, and I'm still not sure all UEFI implementations would let you do this straightforwardly (on mine choosing which .efi to boot from a single partition is a setting 3 menus deep and hardcoded; if you have multiple it'll keep booting the same one until you change it)

this seems like a lot of effort to avoid using a bootloader when bootloaders can load UKIs too

1

u/Curious-Listener-YB 1d ago

Having an entire duplicate  of the kernel per snapshot

  1. I know, that's inherent to UKIs
  2. The kernel would get upgraded regularly anyway

I'm still not sure all UEFI implementations would let you do this straightforwardly

Me neither, I just know mine does.

this seems like a lot of effort to avoid using a bootloader when bootloaders can load UKIs too

OK, so let's say I use a bootloader. How would handle the UKIs then?

2

u/SmuJamesB 1d ago

systemd-boot supports UKI profiles, allowing you to boot multiple kernel command line arg sets from a single UKI. I believe you could use that to point to snapshots?

1

u/Curious-Listener-YB 1d ago

Interesting. But I would still have to add the new profile to the UKI, no? So I'm not sure how easier it would make the problem.

1

u/SmuJamesB 1d ago

yeah, fair

if there's an easier way to do this I'm not aware of it

2

u/Excellent-Love-6943 1d ago

UKIs aren't more secure, and you need a bootloader to facilitate switching to a snapshot.

2

u/friendlyreminder_ 1d ago

UKIs are more secure. They simplify the cryptographic signing chain to fully rely on only the bios and shim in one go instead of having yet another chain where you also have the bootloader which has to boot itself and also has to do a secondary crypto check itself on the kernel and initramfs

But Arch doesn't ship any of these anyway so it's a moot point. You'd have to get fedora or opensuse kernels and shims manually, otherwise you're relegated to self signing which has its own security problems.

You also need a bootloader for snapshots.

1

u/Curious-Listener-YB 1d ago

UKIs aren't more secure

They let you sign the whole kernel + initrd + command line, how is this not more secure?

And you need a bootloader to facilitate switching to a snapshot

  1. Not true, you can do the same with the UEFI boot menu itself
  2. Even with a bootloader my question about creating the UKI remains

2

u/Excellent-Love-6943 1d ago

OK then why are you asking us? Go implement it.

2

u/Illustrious-Gur8335 1d ago

Snapshots will be an absolute nightmare without a bootloader to present them, unless you want to make friends with your EFI firmware boot menu.

1

u/Curious-Listener-YB 1d ago

Don't know about yours, my EFI boot menu is quite a nice guy. And anyway, my question about the UKI remains even with a bootloader.

2

u/friendlyreminder_ 1d ago

You can't have snapshots without a bootloader currently. No tool exists to manage that.

It may also never exist because there's all sorts of issues involved with the reliance on bioses working properly, which as you may know is not a given.

2

u/noobjaish 1d ago

Nope you can have bootable snapshots and secureboot but not UKIs

2

u/ot1891 1d ago

I'm using systemd-boot and snapper and my solution was to create a snapshot upon a successful boot and I created pacman hook to create UKI kernels that boot into that snapshot.

Unfamiliar with Zapier but I'd image you can achieve the same.

2

u/Curious-Listener-YB 1d ago

At last, some actual answer!

Could you please share your scripts?

2

u/ot1891 1d ago

Sure,

Here's the script and the hook.

1

u/MMyRRedditAAccount 1d ago

might be relevant?

https://gitlab.com/Zesko/limine-entry-tool/-/work_items/7

limine also refuses to boot if you mess with its config file so embedding the cmdline might not be necessary

1

u/bkmo98 6h ago

I created this project to do just that for my setup. https://github.com/bkmo/sdboot-snaps