lkml.org 
[lkml]   [2012]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] Second attempt at kernel secure boot support
On Mon, Nov 05, 2012 at 09:20:17AM +0100, James Bottomley wrote:
> On Sun, 2012-11-04 at 13:52 +0000, Matthew Garrett wrote:
> > You don't get to punt on making the kernel secure by simply asserting
> > that some other system can be secure instead. The chain of trust needs
> > to go all the way back - if your security model is based on all installs
> > needing a physically present end user, all installs need a physically
> > present end user. That's not acceptable, so we need a different security
> > model.
>
> I didn't. I advocated a simple security model which you asserted
> wouldn't allow unattended installs, so I explained how they could be
> done.

You've explained that a hypothetical piece of software could handle key
provisioning without providing any explanation for how it would be able
to do so in a secure manner.

--
Matthew Garrett | mjg59@srcf.ucam.org


\
 
 \ /
  Last update: 2012-11-05 14:21    [W:0.020 / U:0.360 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site