Arch Linux with UKI & Secure Boot

On your existing system, or on a system at the boot loader phase of the install, we will need to configure mkinitcpio to write to an UKI image. Ensure the mkinitcpio package is installed. Then, we will edit the preset file for mkinitcpio, located at /etc/mkinitcpio.d/linux.preset (or a similar name depending on your kernel flavour of choice like linux-lts.preset). Disable the classical initramfs generation by commenting the default_image and fallback_image options, then enable UKI generation by uncommenting the default_uki and fallback_uki options. Ensure the paths are correct. For a UEFI boot partition mounted at /boot/efi:

Finally, mkinitcpio expects the parent folder to already exist which is not by default the case. Use mkdir to ensure the folder is created.

In a traditional Linux setup, the kernel options (or command line) is stored and passed by the bootloader, and usually configured there. Here, we have no bootloader, but still need to provide the command line options.

The UKI build process assemble the command line from files in /etc/cmdline.d. You can create .conf files in this folder containing command line arguments (which also allows you to group related arguments together). Simplest example is to create a /etc/cmdline.d/root.conf with the root configuration:

Of course, adapt it to your configuration and needs.

Now that things are configured, you can just build the image like you do traditionally:

The process should end without errors, and you should find the new files at the location indicated above.

UEFI boot programs are normally registered into the firmware settings as boot entries. If we want to boot our kernel, we need to register our kernel in the firmware with efibootmgr. First, ensure the efibootmgr package is installed.

Note that the second command for the fallback image is created with --create-only instead of --create. This way, it will not be booted automatically, but still be available as a boot option.

Everything is set up! Now, you can finalise the installation steps (if applicable) and reboot your machine, then check that your system boots directly into Arch Linux. You can also trigger the UEFI boot menu to check for the additional entry for the fallback image.

Congratulations! You now boot entirely through your UKI image.

If your root partition is encrypted, you have to enter the passphrase at every boot. If you have a TPM, you can use it to automatically provide this passphrase to the system. While this seem like a downgrade in security, your system is normally still password protected at the login prompt, so your data should be safe, but it is your choice between more security and ease of use. However, it becomes dangerous if coupled with auto-login!

The boot process and the TPM will ensure that your system has not been tempered with. It means that it will compare Secure Boot certificates at boot and will refuse to use the saved credentials if they are modified, which is even stronger than the base Secure Boot check.

systemd provides the systemd-cryptenroll command to make the process easy. First, check that your TPM device is detected:

If it is visible, you can then use it with your root partition:

Replace /dev/vda2 by your root partition physical device (the encrypted layer, not the /dev/mapper mapping). It should ask you for the current encryption passphrase before registering the new TPM slot.

Reboot, and you should not have to input your passphrase anymore.

If you have an other system you often use besides your Arch Linux, you may want to still keep a bootloader, depending on how tedious your UEFI firmware is to override the default boot setting. rEFInd is a generic UEFI boot loader, but a very capable one, as well as providing a graphical user interface to choose where to boot from.

While rEFInd will find and boot your Linux configuration in the current state, a few tweaks will improve the experience a bit.

First step is to install the refind package, then run its built-in script to make the install automatically:

Now, we need to tweak mkinitcpio configuration a bit. If you already have your UKI images generated at this point, I would advise you to remove completely the /boot/efi/EFI/Linux folder.

rEFInd has some automatic heuristics to try to guess what kind of system is an image for to display an appropriate icon. However, it seems to not be good with UKI images (yet), but we can help it. If it cannot determine the type of an image, it will use the name of the parent folder as a hint. In the current configuration, it will see the Linux folder, and will display a generic Tux icon. If you want to have Arch Linux branding, we need to rename the folder to arch. Go back to the linux.preset file from earlier, and change the two lines to replace Linux with arch. Do not close the file yet, we have another change to make.

For distributions that may install different kernel versions at the same time, rEFInd will try to determine which version is the latest to use it as default. However, it gets a bit lost with Arch Linux and believes that the default and fallback images are of the same system, but since no kernel version is given in the file name, it will fallback to the file creation date to determine the newer (and default) kernel. By default, mkinitcpio creates the default image first, and the fallback one in second, which, in our case, would make the fallback image the default.

There is a little trick to solve this: make mkinitcpio build the images the other way around. In the .preset file, simply switch the presets around:

You can now close the preset file. Recreate the parent folder with mkdir, then run mkinitcpio -P to re-create the images in the right order.