lkml.org 
[lkml]   [2023]   [Jul]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC PATCH v2] x86/boot: add .sbat section to the bzImage
On Fri, 14 Jul 2023 at 11:13, Matthew Garrett <mjg59@srcf.ucam.org> wrote:
>
> On Fri, Jul 14, 2023 at 10:52:20AM +0200, Ard Biesheuvel wrote:
>
> > Maybe the OEMs have gotten better at this over the years, but it is
> > definitely not possible for the distros to rely on being able to get
> > their own cert into KEK and sign their builds directly.
>
> Getting certs into local machine databases should[1] be possible on all
> Windows certified machines, but in the status-quo there's no
> cross-vendor solution to doing this. Relying on the Shim-provided
> mechanisms is much safer from a consistency perspective.
>
> [1] Every time someone has claimed it's impossible to me I've ended up
> demonstrating otherwise, but that's not a guarantee

Interesting. So by 'demonstrating', do you mean running some EFI app
that calls SetVariable() on PK/KEK/db directly, rather than going via
the UI?

\
 
 \ /
  Last update: 2023-07-16 20:48    [W:0.796 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site