Secure Boot

Secure Boot ensures the integrity of each component during system boot-up and prevents components that have no valid signatures from being loaded. It protects the system and user data from security threats as well as bootkit and rootkit attacks. HCE OS 2.0 supports Secure Boot.

Verifying that Secure Boot has been enabled
After the OS is booted, run the following command to check whether Secure Boot is enabled:
```
mokutil --sb-state
SecureBoot enabled #Secure Boot has been enabled.
```

Enabling kernel .ko signature verification

Secure Boot is implemented by signature verification. By default, the kernel of HCE OS 2.0 is not compiled with forcibly enabled signature verification. You need to enable signature verification using parameter module.sig_enforce of the kernel.

To enable .ko signature verification, add module.sig_enforce=1 to the /boot/efi/EFI/hce/grub.cfg file.

Kernel parameter	Value	Description
module.sig_enforce	0	Disables the kernel's signature verification on the .ko module. The setting takes effect after the system is rebooted.
1	Enables the kernel's signature verification on the .ko module. The setting takes effect after the system is rebooted.

Kernel parameter

Value

Description

module.sig_enforce

Disables the kernel's signature verification on the .ko module. The setting takes effect after the system is rebooted.

Enables the kernel's signature verification on the .ko module. The setting takes effect after the system is rebooted.

Viewing the public key certificate for signature in HCE OS 2.0
For details about the HCE OS 2.0 KEK certificate and UEFI signature certificate, see hce-sign-certificate-1.0-1.hce2.x86_64.rpm in https://repo.huaweicloud.com/hce/2.0/updates/x86_64/Packages/.