Hey everyone! I recently made the switch to Pop OS from Windows 11, and while I'm fairly tech-savvy, Linux is still a bit of a mystery to me. As a gamer, I know that some new games require Secure Boot for kernel-level anti-cheat features. I have an external NVME drive that I could format to NTFS and use to install Windows 11 for those programs that don't run well on Linux. My main question is this: If I install Windows 11 on that external drive and enable Secure Boot in the BIOS, would that work? Specifically, would I just need to disable Secure Boot in the BIOS before booting back into Pop OS? I'm not really concerned about using Secure Boot within Pop OS, but I'm worried about potential issues with bootloaders or shared boot records. Thanks for your help!
3 Answers
You'll have to set up your own Machine Owner Key (MOK) and self-sign every kernel along with any kernel updates you install. Plus, you'll need to sign any loadable modules like Nvidia drivers as well. Honestly, it can be quite a hassle! You could either dual boot with a distro that manages Secure Boot signing for you, like Ubuntu or Fedora, or just disable Secure Boot altogether. It’s tricky because there's no way to say 'enforce Secure Boot except for this one binary.'
Hey, it's not super difficult to generate keys and self-sign if you're up for it. Just create a UKI using the initramfs tool and write a script to sign it. The tricky part is figuring out how to enroll the keys in your UEFI.
If you're not familiar with the signing process and want to avoid complications, consider using a distro with built-in support for Secure Boot like Ubuntu or Fedora instead—it might save you a lot of hassle!
Some EFI systems let you select trusted boot images for Secure Boot. I managed to get Pop OS running under Secure Boot on my Framework 13 laptop, but I'm not sure how common that feature is across different systems.
That's a bummer… but I do have my old gaming laptop with Windows 10 that I can use for games like Battlefield. Sure, it's slower, but it should still work fine for that. Appreciate the quick response!