UKI on Fedora: Manually Packaging the Kernel for Absolute Secure Boot Security

Quick Start: Switch to UKI in 5 Minutes

Want your Fedora machine to automatically generate Unified Kernel Image (UKI) files instead of using the traditional method? I’ve implemented this on Fedora 39 and 40, and the system runs very stably. It only takes a few setup steps.

First, install ukify and the supporting tools:

sudo dnf install systemd-ukify binutils

Next, we need to tell kernel-install that you want to export UKI files. Open the /etc/kernel/install.conf file:

sudo nano /etc/kernel/install.conf

Add the following configuration line:

layout=uki

To test, try reinstalling the current kernel. You should see an .efi file appear in the EFI partition:

sudo kernel-install add $(uname -r) /lib/modules/$(uname -r)/vmlinuz

Check the /boot/efi/EFI/Linux/ directory. If you see a file with the .efi extension there, congratulations, you’ve succeeded. From now on, every time you run dnf update, Fedora will handle the rest.

Why UKI is the “Holy Grail” for Security

Have you ever been frozen in front of a grub rescue screen at 2 AM? I once experienced this after resizing a partition and the system reported an “Initrd not found” error. That was when I clearly saw the fragmented nature of the old Linux boot architecture.

Typically, GRUB must load the Kernel, then load the Initrd and the Command Line. These three components reside separately. An attacker with root privileges could modify /etc/default/grub, adding init=/bin/bash to easily bypass the password.

UKI (Unified Kernel Image) is a complete game-changer. It bundles the Kernel, Initrd, Command Line, and boot logo into a single EFI executable (.efi) file.

When everything is in one “package”, you can use Secure Boot to digitally sign it. Even a 1-bit discrepancy in the command line will invalidate the signature. The computer will immediately refuse to boot, blocking any unauthorized tampering attempts.

Practical Configuration: Avoiding Common Pitfalls

Having used Fedora as my primary workstation for two years, I’ve noticed a few small details that could break your system if you’re not careful.

1. EFI Partition: Don’t Run Out of Space

This is the most common mistake. Fedora’s default /boot/efi partition is usually only 200MB to 600MB. Meanwhile, a UKI file typically weighs around 80MB – 120MB (depending on the number of drivers).

If you keep three kernel versions, space will run out very quickly. My advice is to set the EFI partition to about 1GB. If you cannot repartition the drive, limit the number of old kernels by setting installonly_limit=2 in /etc/dnf/dnf.conf.

2. Customizing the Command Line

Since boot parameters are “frozen” inside the .efi file, you cannot press the ‘e’ key to edit them temporarily in GRUB. To add options like nvidia-drm.modeset=1, you need to create a configuration file for ukify.

Create the /etc/kernel/uki-conf.conf file:

[UKI]
Cmdline=root=UUID=xxxx-xxxx ro rhgb quiet

Don’t forget to replace the placeholder with the correct UUID by running the lsblk -f command to get the root partition parameters.

Advanced: Self-signing UKI with a Personal Key

UKI is only truly powerful when paired with Secure Boot. Instead of relying on Microsoft’s keys, I chose to create my own keys to have full control over the hardware.

Create a security key pair (Private/Public key):

openssl req -new -x509 -newkey rsa:2048 -nodes -days 3650 -outform DER -keyout MOK.key -out MOK.der

Then, configure /etc/kernel/install.conf to automatically sign every time you build:

layout=uki
uki_generator=ukify

Install sbsigntools to perform the signing operation:

sudo dnf install sbsigntools

Finally, enroll the key into the BIOS via mokutil:

sudo mokutil --import MOK.der

After rebooting, the machine will display a blue screen (MOK Manager). Select “Enroll MOK”, enter the password you created, and from then on, the system will only trust kernels signed by your own hand.

Troubleshooting Tips

While supporting the dev team in implementing UKI, I’ve gathered a few important notes:

• Prioritize systemd-boot: UKI works best with systemd-boot. If using GRUB, use the chainloader command to point directly to the .efi file instead of the traditional linux command.
• Optimize Initrd: If the UKI file exceeds 150MB, enable hostonly mode in dracut. This helps remove redundant drivers, keeping only what your machine actually needs.
• Debugging: If booting fails, remove the quiet parameter when building the UKI. The log lines scrolling on the screen at that moment are more valuable than any documentation.

Switching to UKI isn’t just about chasing new technology. It’s a modern way of thinking: turning the Kernel into a unified, manageable block that is extremely difficult to compromise. For those using Fedora on laptops containing sensitive data, UKI is an indispensable security barrier.