Create a Secure Boot Linux virtual machine

To improve the security of your virtualization host, you can create Linux virtual machines (VMs) that use the Secure Boot feature. Secure Boot ensures that the VM is running a cryptographically signed operating system (OS).

Before you begin

  • Your host system uses the AMD64, Intel 64, or 64-bit ARM architecture. Important

    On 64-bit ARM systems, Red Hat provides Secure Boot VMs only as a Technology Preview, and highly discourages their use in production environments.

  • The EDK2 package is installed on your host:
    • If your host uses the AMD64 or Intel 64 architecture, the edk2-ovmf package must be installed: 
      # dnf install edk2-ovmf
    • If your host uses 64-bit ARM, edk2-aarch64 is required instead. 
      # dnf install edk2-aarch64
  • The VM uses the correct machine type:
    • On AMD64 and Intel 64 hosts, the VM must use the Q35 machine type.
    • On 64-bit ARM hosts, the VM must use the virt machine type.
  • An installation source for the guest operating system is available locally or on a network. This can be one of the following formats:
    • An ISO image of an installation medium
    • A disk image of an existing VM Warning

      Installing from a host CD-ROM or DVD-ROM device is not possible in RHEL 10. If you select a CD-ROM or DVD-ROM as the installation source when using any VM installation method available in RHEL 10, the installation fails. For more information, see RHEL 7 or higher can’t install guest OS from CD/DVD-ROM (Red Hat Knowledgebase).

  • Optional: A Kickstart file can be provided for faster and easier configuration of the installation.

About this task

Secure Boot helps prevent certain types of attacks against the guest OS. It also acts as an additional layer of protection for the host OS, on top of the isolation already provided by virtualization. If the guest OS supports it, enable Secure Boot to improve the security of your VM.

Note

When you create a VM with the UEFI firmware on a host that uses the AMD64 or Intel 64 CPU architecture, the VM uses Secure Boot by default.

Procedure

  1. Use the virt-install command to create a VM as detailed in Creating virtual machines by using the command line. For the --boot option, use the uefi,firmware.feature0.name=enrolled-keys,firmware.feature0.enabled=yes value.

    For example:

    # virt-install \
  --name rhel10sb --memory 4096 --vcpus 4 \
  --os-variant rhel10.0 \
  --boot uefi,firmware.feature0.name=enrolled-keys,firmware.feature0.enabled=yes \
  --disk boot_order=2,size=10 \
  --disk boot_order=1,device=cdrom,bus=scsi,path=/images/RHEL-10.0-installation.iso

    Alternatively, you can adjust the --boot line to modify the Secure Boot setting of the new VM:

    • --boot uefi - Enables UEFI and Secure Boot for AMD64 or Intel 64 VMs. For 64-bit ARM VMs, this currently enables UEFI but leaves Secure Boot disabled.
    • --boot uefi,firmware.feature0.name=enrolled-keys,firmware.feature0.enabled=no - Enables UEFI but disables Secure Boot for the VM.
  2. Follow the OS installation procedure according to the instructions on the screen.

Results

  1. After the guest OS is installed, access the VM’s command line by opening the command line in the graphical guest console or connecting to the guest OS using SSH.
  2. To confirm that Secure Boot has been enabled on the VM, use the mokutil --sb-state command: 
    # mokutil --sb-state

    Successful output:

    SecureBoot enabled