Fedora 40 Eyes The Ability To Boot Unified Kernel Images Directly

[phoronix]

Phoronix: Fedora 40 Eyes The Ability To Boot Unified Kernel Images Directly

Fedora 40 is eyeing the next phase of its unified kernel (UKI) support within the distribution that will include the ability to support booting to unified kernel image files directly without having to go through a traditional bootloader like GRUB or SD-Boot...

https://www.phoronix.com/news/Fedora-40-Boot-UKIs-Directly

[billyswong]

So it is a plan for replacing GRUB with a "shim.efi", then fill up the EFI partition with Linux kernel images. The "shim" is so barebone that no UI at boot time is available to edit or select which kernel it is going to boot into. You are expected to instruct the shim what to boot next time only after one boot and login to the Linux.

From "security" standpoint, it might be a valid idea? But things may get ugly if a new updated kernel looks booting well to the computer and got marked as "permanent" choice but in fact a failure for proper user interaction.

[sophisticles]

Someone correct me if i am wrong, but it sounds to me like one will not be able to dual boot Fedora 40 with another OS, especially not Windows. and if it is possible, probably not easily.

I would like to know what "security" concerns this is supposed to address, it almost sounds like someone looking for a boogieman to justify his job.

[Mark Rose]

I've been wondering why this wasn't done a decade ago. Seems like a natural thing to do to speed up boot times. I do wonder if the shim will allow editing command line parameters at boot time.

Edit: did a little reading and the old style booting can be another UEFI option if editing the command line is necessary.

[X_m7]

The plan seems to be to just rely on the UEFI firmware's boot menu instead of rolling their own with GRUB, since as part of the proposal it says "The UEFI boot configuration will get an entry for each kernel installed.". So dual booting with Windows or anything else should still be possible, as is switching kernels if needed, but it'd be more inconvenient for anyone needing to switch frequently unless the firmware has an option to always show the boot menu every time.

[plan-g]

Someone correct me if i am wrong, but it sounds to me like one will not be able to dual boot Fedora 40 with another OS, especially not Windows. and if it is possible, probably not easily.

I would like to know what "security" concerns this is supposed to address, it almost sounds like someone looking for a boogieman to justify his job.

This gives a good overview : http://0pointer.net/blog/authenticat...-on-linux.html

If anything dual boot would be easier because it relies on the boot menu built in to the UEFI firmware and you don't have to do hacks for dual booting in something like Grub.

[atmartens]

Isn't GRUB a lot more trustworthy than UEFI? Do we get to see the UEFI source code for every motherboard out there? It hardly seems worth sacrificing our control over our devices just to save half a second when booting. Booting Windows 98 took minutes. You'd go to the other room and so something else while it finished...

[The the]

Isn't GRUB a lot more trustworthy than UEFI? Do we get to see the UEFI source code for every motherboard out there? It hardly seems worth sacrificing our control over our devices just to save half a second when booting. Booting Windows 98 took minutes. You'd go to the other room and so something else while it finished...

You still you UEFI when booting into GRUB. Just because you add some open source code on top of proprietary code doesn't make it open source.

[FireBurn]

I've been doing this for years, the only downside is not being able to change bootargs on the fly

[kylew77]

I might be missing the point, but why worry about secure boot? All of the *BSDs work just fine with UEFI and secure boot disabled. Why try to ingest the Microsoft proitary BS?