[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 19 Dec 2012 10:20:12 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Plug-and-wipe and Secure Boot semantics
On 12/19/2012 06:39 AM, Greg KH wrote:
>>>> Most signed Linux boot loaders only verify the kernel (and,
>>>> indirectly, code that's loaded into the kernel), but not the
>>>> initrd contents.
>>>
>>> Given that there is only one public signed Linux boot loader, saying
>>> "most" is a bit odd here :)
>>
>> Uhm, aren't there a couple of them in circulation?
>
> Not that I know of, all of the "public" ones are based on Matthew
> Gerritt's code, do you know of another one that has made it through the
> Microsoft signing process?
I was mistaken, I assumed that Fedora was shipping Matthew's 0.1 code,
which differs significantly from the 0.2 code. But it turns out that
Fedora ships 0.2 instead (since the end of November). Oh well.
>> The Fedora 18 TC3 installer boots on the machine mentioned above, in
>> the factory default configuration. Previous installer versions
>> showed a Secure Boot error message. I've run into an installer bug,
>> though:
>> <https://bugzilla.redhat.com/show_bug.cgi?id=888232>
>
> Previous versions of Fedora 18 betas didn't have a valid signed
> bootloader to allow anything to be installed, are you sure it's all
> properly built now?
Yes, or the UEFI implementation on the box is buggy. It could not boot
the installer before, but now it can.
> But, more on-topic, how does UEFI secure boot have anything to do with
> this mailing list?
Aren't vendors basing their implementation on the open-source code from
Intel? Or are you referring to the fact that Secure Boot has little to
do with security?
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
