lkml.org 
[lkml]   [2012]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC] Second attempt at kernel secure boot support
"H. Peter Anvin" <hpa@zytor.com> writes:

> This is not a good thing to assume. A vendor could have an external
> button, for example.

Facts are always a good thing to assume.

The fact is the general case does not admit an install without user
interaction.

It makes a lot of sense to revisit the working assumptions when for lack
of 3 o4 4 lines in the bootloader people are advocating turning gold
into lead at the cost of a national banking bailout.

Non-interactive installs are very interesting but they only make sense
in a very narrow range of cases not on every in every BIOS state on
every machine. If the UEFI firmware will let me install a platform key
and set ever other firmware setting in my installer, then it is a good
starting state. The rest of the time there will be some unpredictable
inconsistent mess of firmware settings that someone is going to have to
go in and fix. Or the install cd will have blown away my existing
partitions deleting data I forgot to back up that day.

The notion that a non-interactive install is possible in the general
case is complete and total hogwash.

Eric


\
 
 \ /
  Last update: 2012-11-05 10:41    [W:0.553 / U:0.428 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site