# Startup Security

> The Settings page that says how this computer starts: Secure Boot, whose keys it trusts, kernel lockdown, the security chip, the sealed system, and the one button that finishes a waiting setup.

Source: https://wolos.org/manual/startup-security

## What it is

**Startup Security** is a page in Settings, under **Privacy & Security**. It reads how this computer started and says it in one row per fact. When a Secure Boot setup is still waiting, it also has the button that finishes it. It changes nothing on its own.

![Startup Security in Settings: Secure Boot, keys, kernel lockdown, the security chip, measured startup, the sealed system and the release number, one row each.](/img/manual/settings-startup-security.png)

## Why

What protects a computer before anything is on screen is invisible: the firmware, its keys, the first program it starts. If something there is off, you would not notice until it matters. This page puts those facts where you can check them in a few seconds, in words, and offers the fix right there instead of in a terminal. How Secure Boot is set up in the first place is on [Secure Boot](/manual/secure-boot).

## How

Open **Settings > Privacy & Security > Startup Security**, or type "startup" in the Settings search.

### Reading the rows

| Row | What it says | What it means |
|---|---|---|
| **Secure Boot** | On, with this computer's own keys / On, with this computer's enrolled key / On / Off in the firmware settings / Off | Whether the firmware checks the signature of what it starts, and with which keys. "Off in the firmware settings" means WolOS is set up for it but the firmware's switch is off. |
| **Keys** | This computer's own keys / This computer's enrolled key / The firmware's keys / None | Whose keys WolOS is signed for. *Own keys*: the installer put WolOS's keys into the firmware. *Enrolled key*: a key you confirmed once on the blue key screen. *The firmware's keys*: the keys the computer came with. |
| **Kernel lockdown** | On / On, strict / Off | Whether the running system refuses changes to itself while it runs (unsigned drivers, writing to its memory). It is on whenever WolOS started signed. |
| **Security chip** | TPM 2.0 / None | The chip that can open an encrypted disk by itself when the computer starts unchanged. |
| **Measured startup** | On / Off | Whether each step of the start was recorded in the chip, so a changed step is noticed. |
| **Sealed system** | On / Off | Whether the system files are checked against a signed list at every start ([Recovery](/manual/recovery)). |
| **Release** | a number | The release this system belongs to. An older, retired copy with a lower number is not started again. |

If the facts cannot be read, the page shows **Secure Boot: Unknown**.

### Finish Secure Boot setup

When the key still has to reach the firmware, the page has a row **Finish Secure Boot setup** with a **Finish Setup** button.

1. **Press Finish Setup.** If Settings asks for an administrator’s password, enter it.
2. The page then says "This computer’s key is queued: a blue screen asks once at the next restart." and lists the steps of that screen.
3. **Restart** and follow the blue screen: press a key, choose *Enroll MOK*, then *Continue*, then *Yes*, type the password the page names, and choose *Reboot*. The full walk-through, with what to do if you miss it, is on [Secure Boot](/manual/secure-boot).

After the restart the row is gone: there is nothing left to finish.

## A worked example

Alice installed WolOS with Secure Boot on and wonders whether it worked. She opens Settings > Privacy & Security > Startup Security and reads: Secure Boot On, Keys: this computer's enrolled key, Kernel lockdown On, Security chip TPM 2.0, Sealed system On. Everything is as it should be, so she closes the page; nothing was changed by looking.

## If something goes wrong

| What you see | What to do |
|---|---|
| "This computer’s key is queued: a blue screen asks once at the next restart." | Restart and confirm the key on the blue screen. It stays queued until you do. |
| Secure Boot says Off in the firmware settings | Turn Secure Boot on in the firmware's setup (often F2 or Del while the computer starts). WolOS is ready for it. |
| Keys says None and Secure Boot is Off | WolOS started without signatures, as it said at install. If you turn Secure Boot on later, come back here to finish the setup. |
| Security chip says None | The computer has no chip, or it is off in the firmware. Disk encryption then asks for your password at every start. |
| Finish Setup did not work | The page says why, in one sentence at the bottom. Try again, or run `wol boot enroll` in a terminal and restart. |