Secure boot UEFI clarifications

[sidalit]

Hello

I have questions regarding UEFI secure boot.
My setup is a Jetson Orin Nano 8GB devkit with latest jetpack 36.3 with bootloader secure boot enabled so that the root-of-trust can start from the BootROM.

I have read UEFI documentation and UEFI secure boot.

I have generated UefiDefaultSecurityKeys.dtbo using script gen_uefi_default_keys_dts.sh.

I enabled UEFI secure boot at flashing time and now I can use tools such as sbctl and mokutil to check that UEFI secure boot is enabled and PK, KEK and db keys are enrolled correctly.

My questions are:

1. May I consider there is no possible way for user to change any of the keys or update the OS with another one?

2. Even if access to UEFI menu at boot due to 5 seconds timeout (we plan on removing this timeout) is possible, can this be a security concern?

3. Same if user has access to root permission?

4. Can a user register MOK keys and sign its own UEFI payloads using MOK ?

Thanks for clarifications.

[JerryChang]

hello sidalit,

If an attacker with physical access, they may manipulate UEFI variables.

here’re more details,
In a deployed production scenario, QSPI flash is protected from non-secure side access via firewalls so that no unauthorized access can happen and make a change that can block the system from booting or tampering with its security settings.
However, if an attacker can manipulate contents of QSPI flash by physically talking to it (out of band), there was no protection for it.
an attacker can attach a QSPI NOR flash programmer (dediprog, etc.) to the flash directly and read/write its contents. Attackers can not only manipulate UEFI variables, but can also change the boot firmware.