Setting up the BIOS (UEFI firmware)

The BIOS, on any computer from the last ten years really UEFI firmware, is what runs before any operating system: it decides what may start, from which disk, and which devices exist at all.

Wren Linux can't change these settings from inside; you set them once, by hand. This page says which ones matter for installing Wren Linux, and which make any computer harder to tamper with.

Every maker names and places these settings differently. The words below are the common ones; look for something close. When unsure, leave a setting as it is: none of them is worth a computer that won't start.

Getting into it

Restart and press the setup key over and over as the maker's logo shows: usually F2 or Del; F1 or Enter on Lenovo, Esc then F10 on HP, F2 on Dell.

A second key opens a one-time boot menu (often F12, F9, F11 or Esc) to start from a USB stick once, without changing the boot order.

If Windows is installed, Fast Startup can skip the keys: hold Shift while choosing Restart, then Troubleshoot > UEFI Firmware Settings.

For a Wren Linux install

In this order:

1. Update the firmware first, from the maker's support page for your exact model. Updates fix security holes that no operating system can, and a later update can reset your settings, so do it before the rest. (After the install Debian's fwupd can update many computers; not all makers support it.)

2. Boot mode: UEFI only. Switch off "CSM", "Legacy" or "Legacy boot support". Debian's installer, and Wren Linux's install stick, start in either mode, but Secure Boot needs UEFI, and so does the rest of this list.

3. Secure Boot: on, with the maker's own keys ("Standard" or "Factory" keys, not "Setup mode" or "Custom"). Debian's boot loader and kernel are signed for it, and Wren Linux uses them unchanged, so it starts as Debian does.

   A kernel module built on your computer (DKMS: some Wi-Fi drivers, NVIDIA's own driver) won't load with it on until you enroll a key for it (mokutil); Wren Linux's own scripts need none.

4. Storage: AHCI, not "RAID" or "Intel RST/VMD". With RST the installer often can't see the disk at all. (On a computer that also runs Windows, changing this makes Windows fail to start until it is set up for AHCI.)

5. Virtualization: on. "Intel VT-x" or "AMD-V" (sometimes "SVM"), and "VT-d" or "AMD-Vi"/"IOMMU". The first lets claude-vm, whonix and other virtual machines run; the second lets the kernel keep devices from reading memory they weren't given (see Thunderbolt below).

6. Fast Boot: off, at least for the install: with it on, many computers skip the USB ports and the keyboard before the boot loader, so the stick and the setup key go unseen.

7. Start from the stick with the one-time boot menu (choose the entry starting with "UEFI:"), and install.

8. Afterwards, back in the BIOS: put the internal disk first, switch off booting from USB and from the network, and set the supervisor password (below). From then on, starting from a stick needs that password.

Check from Wren Linux, in a terminal:

[ -d /sys/firmware/efi ] && echo "started with UEFI"
sudo dmesg | grep -i 'secure boot'      # "Secure boot enabled" when it is on
grep -cE 'vmx|svm' /proc/cpuinfo         # above 0: the CPU can run VMs
ls /dev/kvm                              # exists: virtualization is switched on

For security, on any computer

Passwords

• Supervisor (administrator, setup) password: yes. Without it anyone at the keyboard can switch Secure Boot off, start their own system from a stick, or change any of this. Use a long one, write it down and keep that safe: on many laptops a forgotten supervisor password means a new mainboard.

• Power-on password: optional. It asks before anything starts. Your disk encryption passphrase already protects what is on the disk, so this mainly stops someone from using the computer's own boot menu.

• Disk (HDD/NVMe) password: optional. The disk asks for it itself. Wren Linux's disk encryption (LUKS) is what protects your files, whatever this is set to.

What may start

• Secure Boot on, UEFI only, boot from USB and from the network (PXE, "UEFI network stack") off, internal disk first, as above.

• BIOS updates only with the supervisor password, and rollback protection ("BIOS downgrade", "Secure rollback prevention") on, so nobody can put back an older firmware with known holes.

Devices you don't use: off in the firmware

The firmware's switch makes the device absent: nothing running on the computer can switch it back on, unlike Wren Linux's microphone and webcam switches, which are software (see THREAT-MODEL.md).

Common ones: the webcam, the microphone, Bluetooth, a mobile broadband (WWAN) card, the fingerprint reader, the SD card reader, Wake on LAN, and Thunderbolt if you never use it. Unused USB ports can go too, where the firmware offers it.

Where to look: on ThinkPads these switches are under Security → I/O Port Access (microphone, webcam, Bluetooth, WWAN, fingerprint reader, memory card slot, Thunderbolt and others); other makers use other names, often under "Security", "Advanced" or "Onboard devices".

Be aware that on some computers, switching the microphone off also hides the whole audio controller, speakers and headphone jack included, because they are one device. If sound disappears after you do, that is why: look for a separate "Audio" entry, or use a USB or Bluetooth headset. Wren Linux then sees no sound hardware and shows no microphone switch, which is correct: there is nothing to mute.

Thunderbolt and other ports that can read memory

A Thunderbolt (or USB4) device can ask to read the computer's memory directly.

If you use the port, set its security to "User Authorization" or "Secure Connect" rather than "No security", and switch on "Kernel DMA protection" or "Pre-boot DMA protection" with the IOMMU (VT-d/AMD-Vi, above). parts/boot-hardening.sh then has Linux use the IOMMU in its strict mode.

Wren Linux already blocks FireWire, the older port that could do the same.

Remote management and tracking agents

• Intel AMT ("vPro", "Active Management Technology", "MEBx"), on business laptops: off, unless an IT department runs it. It can manage the computer over the network beneath the operating system.

• Absolute / Computrace ("Absolute Persistence"), an anti-theft agent built into many Dell, HP and Lenovo laptops: off. Some offer "Permanently disable", which can't be undone: fine if you don't use that service.

• Intel's Management Engine and AMD's PSP themselves can't be switched off; firmware updates are what keep them patched.

Tamper signs

• Chassis intrusion or "bottom cover tamper" detection, where there is one: on. It warns at the next start when the case was opened.
• Keep a photo of the BIOS settings pages. If one is ever different when you didn't change it, someone else did.

A checklist

What this doesn't protect

• Someone with time and a screwdriver. On most desktops, and some laptops, removing a battery or setting a jumper clears the BIOS password. A firmware chip can be rewritten with a clip and another computer. The settings above slow an attacker and make tampering easier to notice; they don't stop one.

• The unencrypted boot partition. Secure Boot checks the boot loader and the kernel, but Debian's initramfs (what asks for your disk passphrase) isn't signed, and Wren Linux doesn't measure the boot with the TPM.

  Someone who changes it while you're away isn't detected: see "Physical tampering" in THREAT-MODEL.md, and shut down rather than leave the computer asleep.

• The TPM is neither used nor needed by Wren Linux; leaving it on is fine.

• Holes in the firmware itself, until the maker fixes them and you install the update.

More on the physical side, and the rest: opsec.md.