Murmurings of an accused Lemming

How to Securely use Biometrics

Documenting my process of setting up CachyOS for secure biometric login.

For starters open this page and install sbctl with Shelly. Then follow that guide until you've verified everything fine in the end. For me I had to boot into UEFI few times; first to remove everything from the and then to enable secure boot.

I've created this tool, PAM module and repository here with documentation to set up PAM to use TPM2 so that your keyring opens up even while using fingerprint login. The reason I'm starting this with setting up secure boot is that by default it uses that trust to determine whether it is safe to trust your fingerprint scanner hardware.

It is still a bit rough documentation wise due to me having blindspots, not wanting to make many assumption about what to support and opting to secure vs eaze of use. Also noteworthy is that I still need to set it up better for CachyOS still so that legit operating system updates would not break the trust. If you want a less secure but more robust alternative use --skip-pcr option.

Visual Guide

  1. Shelly window with sbctl selected
  2. Reboot with systemctl reboot --firmware-setup
  3. Enable Erase all Secure Boot Settings Photo of UEFI
  4. sbctl commands and output: sbctl key creation
  5. Signing and verifying keys
 1sudo sbctl verify
 2Verifying file database and EFI images in /boot...
 3✘ /boot/1c4b5246eef05ac3bc87339323cd5101/6.10.0-cn4.0.fc40.x86_64/linux is not signed
 4✘ /boot/EFI/BOOT/BOOTX64.EFI is not signed
 5✘ /boot/EFI/systemd/systemd-bootx64.efi is not signed
 6✘ /boot/1c4b5246eef05ac3bc87339323cd5101/0-rescue/linux is not signed
 7✘ /boot/1c4b5246eef05ac3bc87339323cd5101/6.10.0-cn3.0.fc40.x86_64/linux is not signed
 8
 9sudo sbctl-batch-sign
10
11sudo sbctl verify
12Verifying file database and EFI images in /boot...
13✔ /boot/1c4b5246eef05ac3bc87339323cd5101/6.10.0-cn4.0.fc40.x86_64/linux is signed
14✔ /boot/EFI/BOOT/BOOTX64.EFI is signed
15✔ /boot/EFI/systemd/systemd-bootx64.efi is signed
16✔ /boot/1c4b5246eef05ac3bc87339323cd5101/0-rescue/linux is signed
17✔ /boot/1c4b5246eef05ac3bc87339323cd5101/6.10.0-cn3.0.fc40.x86_64/linux is signed
  1. Sign boot manager: sudo sbctl sign -s -o /usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed /usr/lib/systemd/boot/efi/systemd-bootx64.efi
  2. Enable Secure Boot (see photo from 1)
  3. Verify
 1sudo sbctl status
 2Installed:      ✓ sbctl is installed
 3Owner GUID:     a9fbbdb7-a05f-48d5-b63a-08c5df45ee70
 4Setup Mode:     ✓ Disabled
 5Secure Boot:    ✓ Enabled
 6Vendor Keys:    microsoft
 7
 8bootctl
 9System:
10      Firmware: UEFI 2.80 (INSYDE Corp. 28724.16435)
11 Firmware Arch: x64
12   Secure Boot: enabled (user)
13  TPM2 Support: yes
14  Measured UKI: no
15  Boot into FW: supported

Photos are dated Framework, yours might look slightly different. I recommend looking at the more general information from the sources. And looking up BIOS/UEFI guide for your hardware, here is one for Framework. If I clearly forgot something or you'd like to suggest improvements get in contact.