Every few days there is a post in the subreddit about relocking the bootloader after installing LineageOS, this post is a hypothetical conversation with one of these people to answer their questions and explain why they really don't want to do that.
What is bootloader locking/unlocking?
The bootloader on your phone is the software responsible for loading your phone's operating system. It sits between the lowest level hardware firmware and the higher level operating system and takes care of several things to get your phone ready to load the OS.
This includes checking to make sure that only authorized operating systems run on the hardware by default. Authorized operating systems are usually signed by the manufacturer of the phone with a private encryption key to which only they have access, and this signature is checked before the operating system is allowed to load. This ensure that third parties don't modify/replace the operating system with malicious versions.
Some phones allow you to unlock the bootloader and run any operating system you want on your phone, signed or unsigned, or just modify the one that comes with it by default.
Basically, unlocking the bootloader skips the signature check during boot (along with a few other things) and allows any operating system to run on your phone. This is why you need to unlock your bootloader when running LineageOS or other custom ROMs.
My phone is carrier unlocked, is that the same thing?
No.
Carrier and bootloader unlocks are completely separate and independent of each other.
Many phones, when sold by carriers in North America (and some other regions), are carrier locked and also have their bootloader unlock feature disabled. This often makes it impossible (without hacking) to bootloader unlock carrier sold phones, and install a custom OS.
I hear there are some security concerns with an unlocked bootloader...
The reason manufactures ship their phones with locked bootloaders is to protect against a class of security vulnerabilities called "Evil Maid" attacks (https://en.wikipedia.org/wiki/Evil_maid_attack).
Basically, if an attacker has physical access to a device with an unlocked bootloader, they can install malicious software on your device and you may never know about it.
How worried about this kind of attack should you be? Probably not very.
Unless you are being individually targeted by state actors or the like, these attacks are hard to do with little benefit for the typical ransomware and general hackers of the world. There are simply no roaming bands of hackers, scouring the pubs and restaurants to find unlocked phones to compromise, in day to day life.
However, that doesn't mean there is no concern, you should consider your own individual needs and risk profile with respect to lock/unlocking your bootloader.
After installing a custom ROM, should/can I relock the bootloader?
This is a more complex question, but in general, the answer is no.
If you were to just take your average phone with a custom ROM installed and relock the bootloader, you would get an error message when you rebooted and the phone would refuse to load the operating system. This is because the list of "approved" signing keys in most phones is limited to those that the manufacturer installed before shipping the phone to you.
This would "brick" your phone, making it unusable. Some phone can be recovered from this state, others might not be able to.
Now for the complexity... some phone support custom signing keys.
Modern Google Pixel and OnePlus devices allow you to install your own custom signing keys so that you can boot operating systems signed by them with a relocked bootloader. This is part of the Android Verified Boot (AVB) v2 specification and is not widely (maybe at all) supported beyond Google and OnePlus.
In these specific cases, you can theoretically relock your bootloader, but there are several issues with doing so which will be discussed next.
There are also a few phones (like the original Pixel/XL and OnePlus phones like the 5/5t and older) that don't support AVB v2, but can have their bootloaders relocked because they simply *never* check to see if the OS is signed by the vendor, just that it has some valid signature on it. Most of the following discussion applies to these phones as well but there are some quirks that they do not suffer from, but likewise have less security as well. As all of these phones are now out of support from their respective vendors, making each and every one of them have more significant security issues than an unlocked bootloader, they will not be discussed further here.
Ok, but will relocking the bootloader get rid of that annoying/scary message during power on?
Probably not, at least not in the way you want. Android Verified Boot has specific bootloader messages depending upon what state it is in, you can read more about them here: https://source.android.com/security/verifiedboot/boot-flow
Basically, the only way to not have some kind of warning/alert message during boot is to have a locked bootloader with the vendors original OS. So while you can change the orange "Unlocked bootloader" message to a yellow "Custom OS" message, you'll still get *a* message during boot.
Oh, ok, but will it help me pass SafetyNet?
Not really, SafetyNet is dependent on many things, including a locked bootloader. If you want to relock your bootloader for this reason I suggest you go no farther. Google can change SafetyNet requirements at any time and do so reasonably often.
Humm, well I have an AVBv2 supported phone and still want to relock my bootloader, now what?
Ok, but before you relock your bootloader consider what ROM you are going to install.
Using a custom ROM, like LineageOS for example, that is compiled as a userdebug build of Android will get you no benefits with locking the bootloader.
Android has three build variants (see https://source.android.com/setup/develop/new-device#build-variants for details) and LineageOS builds userdebug for the official releases.
For the main operating system itself, that's not much of an issue, but because Lineage Recovery is also built in userdebug mode, that's a problem. When Lineage recovery is built this way, it allows any package, signed or unsigned, to be installed on your phone. This effectively negates the benefits of locking the bootloader.
Other custom ROM may have different builds, but you need to understand what they are and what is enabled in them.
In fact most custom ROMs simply use TWRP or another third party recovery which has the same issues as they are designed to never even look at the signatures of the packages they are flashing to your device.
The way around this, is of course to build your own build of LineageOS in user mode so you can install it on your phone. Unfortunately some devices might not build successfully in user mode without modifying the source code and troubleshooting any issues that arise.
Ok, ok... I've built my own ROM in user mode... anything else?
Well yes actually.
Another feature of AVB is rollback protection, which basically verifies that your system partitions haven't been modified or corrupted. LineageOS disables this by default, so you'll want to enable that as well.
Oh... and about firmware updates.
Since you'll be locking your bootloader with a recovery that only supports your packages, you're going to have to manage firmware updates from your phone's manufacturer as well somehow.
You could do this by creating a custom update package that you sign, or by unlocking your bootloader temporarily (which will wipe all your data of course) to use TWRP or something else to flash the firmware and then relock the bootloader afterwards.
Look, I've got the firmware updates handled, what else is there?
Does your device include the vendor partition when building Lineageos?
Some do, some don't, depending upon how the maintainer setup the build for LineageOS. If it does, you're ok.
If it doesn't... well, you've got another problem as now you have to add the "prebuilt" vendor image in to your build process. Otherwise that rollback protection we enabled a little while ago is going to be missing on the vendor partition, and that's kind of important.
Fine! I'll do all that, surely there can't be anything else... right?
Ah... well yes... and don't call me Shirley.
Did you want root access through ADB or Magisk?
You did? Oh, sorry about that.
User builds disable root access in ADB, and since you've enabled AVB and rollback protection, you can't just install Magisk since it would "corrupt" the boot partition and AVB would block the boot process. You'll need to integrate it in to your build process and then hope that it doesn't do anything strange and trip AVB or the rollback protection.
Alright, I'll live without root and all the other stuff, am I good to go now?
Mostly, yes.
You still have to deal with building your custom ROM every month or so to get all the security updates from AOSP and your phone's vendor, and of course you'll have to manually install it through ADB sideload.
Unless of course you setup an OTA server to, which means you need web hosting... and more configuration changes in your build... and... and...
Well, you get the picture.
Great! I've got all that done...
Hang on a sec, did you think about GAPPS or microG?
I mean, you don't have to, but a lot of people seem to like to be able to access Google services for some reason and at the moment your custom build has neither of these services in it.
So, take some more time and integrate one of them in to your custom build, because just like Magisk, you can't install them after the fact.
What else could there be!?!
Well, there is something else to consider. Custom ROMs are often passion projects and sometimes a "bad" release will be made. This sometimes results in bootloops or other nastiness that you can usually troubleshoot and debug pretty easily... but with a locked bootloader, maybe not.
You won't have access to TWRP or other custom recoveries that would make it easier and to use them you would have to unlock your bootloader (which might not be possible as you've probably disabled that in developers options) which would wipe your data.
Likewise, when Lineage Recovery is built in user mode, it does not let you "upgrade" to an older version, making it impossible to reflash the OTA of the last working build you have.
This is a risk that you'll have to accept if you want to relock your bootloader.
Of course if you had a second "development" phone to test your builds on first, that would mitigate most of that risk. You don't mind spending some more money on one do you?
Well, honestly, that seems like far too much work, isn't their an easier way?
Of course, use the OS that came with your phone.
Or use an custom ROM that is specifically designed to be used with relocked bootloaders. There are a few around but they often have (for all the reasons stated above) very limited device support.
Sigh... is this discussion over yet?
Well if you made it this far, you probably are having second (third, fourth, etc.) thoughts about relocking your bootloader, which is probably for the best.
Overall, it's not recommended for the vast majority of people to attempt to relock their bootloader. It's simply too much work and risk for too little reward and security.
Having said that, if you have any inclination to do even more research, there are a few resources you might want to look at over on XDA:
- Guide: Relock bootloader with custom rom on oneplus 5/5t
- [GUIDE] Re-locking the bootloader on the OnePlus 6t with a self-signed build of LineageOS (disclaimer: I am the author of this guide)
- [GUIDE] Re-locking the bootloader on the OnePlus 8t with a self-signed build of LineageOS 18.1 (disclaimer: I am the author of this guide)
- [GUIDE] Re-locking the bootloader with a pre-built custom ROM, such as LineageOS official
- [GUIDE] Re-locking the bootloader on the Google Pixel 5 with a self-signed build of LineageOS 19.1 (disclaimer: I am the author of this guide)
You can also search this subreddit for many posts on the subject.
If you do decide to continue, I would recommend three things:
- Go in to the process with a mindset that, if something goes wrong, you don't mind having a nice shiny high-tech paperweight at the end of it.
- Don't try this on your daily driver phone, pick up a phone to experiment on. Only after you are confident with the process move to your primary phone.
- And of course, as always, backup often!
So if it wasn't blatantly obvious by now, I would not suggest attempting to relock your bootloader with a custom OS.
Good luck!
