Messages in this thread | | | Date | Tue, 10 Jun 2014 16:21:36 +0300 | From | Dmitry Kasatkin <> | Subject | Re: [PATCH 0/4] KEYS: validate key trust with owner and builtin keys only |
| |
On 10/06/14 15:52, Mimi Zohar wrote: > On Tue, 2014-06-10 at 08:20 -0400, Josh Boyer wrote: >> On Tue, Jun 10, 2014 at 11:48:14AM +0300, Dmitry Kasatkin wrote: >>> Also I want to discuss here Fedora UEFI patches as they are the reason for >>> the these original patchset. >>> >>> http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch >>> >>> They provide functionality to specify MokIgnoreDb variable to limit loading of >>> UEFI keys only from MOK List, while ignoring DB. This is certainly a good >>> functionality. But once MODULE_SIG_UEFI is enabled, it looks there is no way >>> to prevent loading keys from UEFI at all. And this might not be a good default >>> functionality. Someone might want not allow loading of keys from UEFI unless >>> kernel parameter is specified to allow it without recompiling the kernel >>> and disabling MODULE_SIG_UEFI. >>> >>> Josh, why such design decision was made? >> IIRC, it's because kernel parameters can be added programmatically from a >> remote user if they gain root access. Having a kernel parameter to >> disable a key piece of secure boot isn't all that great. We disable >> other kernel parameters like acpi_rspd as well. > In this case, there shouldn't be a problem as the kernel parameters > would further limit the keys usage. > > Mimi
Josh probably means that it can be removed and restriction is lifted.. And after reboot, all keys come to the keyring..
>
| |