Messages in this thread | | | From | (Eric W. Biederman) | Date | Fri, 02 Nov 2012 01:49:25 -0700 | Subject | Re: [RFC] Second attempt at kernel secure boot support |
| |
Matthew Garrett <mjg59@srcf.ucam.org> writes:
> On Thu, Nov 01, 2012 at 09:58:17PM +0000, Alan Cox wrote: >> On Thu, 1 Nov 2012 21:34:52 +0000 >> Matthew Garrett <mjg59@srcf.ucam.org> wrote: >> > I think you've misunderstood. Blacklist updates are append only. >> >> I think you've misunderstood - thats a technical detail that merely >> alters the cost to the people who did something improper. > > Winning a case is cold comfort if your software has been uninstallable > for the years it took to get through the courts. If others want to take > that risk, fine.
When the goal is to secure Linux I don't see how any of this helps. Windows 8 compromises are already available so if we turn most of these arguments around I am certain clever attackers can go through windows to run compromised kernel on a linux system, at least as easily as the reverse.
Short of instructing UEFI to stop trusting the Microsoft signing key I don't see any of the secureboot dance gaining any security of computers running linux or security from keys being revoked for non-sense reasons.
Eric
| |