Messages in this thread | | | Date | Fri, 1 Mar 2013 18:21:57 +0000 | From | Matthew Garrett <> | Subject | Re: [GIT PULL] Load keys from signed PE binaries |
| |
On Wed, Feb 27, 2013 at 08:35:45PM +0000, ownssh wrote: > Matthew Garrett <mjg59 <at> srcf.ucam.org> writes: > > > There's no way to update the UEFI key database without the update being > > signed by an already trusted key, so what you're proposing isn't > > possible. > > > > I confused. > Isn't custom mode can add user's own key?
Yes, but that involves physically-present end-user interaction. A bootloader can't do it even if it's signed by Microsoft.
-- Matthew Garrett | mjg59@srcf.ucam.org
| |