Re: [GIT PULL] Load keys from signed PE binaries
From: Matthew Garrett
Date: Mon Feb 25 2013 - 22:43:01 EST
On Mon, Feb 25, 2013 at 07:32:04PM -0800, Linus Torvalds wrote:
> On Mon, Feb 25, 2013 at 7:28 PM, Matthew Garrett <mjg59@xxxxxxxxxxxxx> wrote:
> > You're happy advising Linux vendors that they don't need to worry about
> > module signing because it's "not obvious" that Microsoft would actually
> > enforce the security model they've spent significant money developing
> > and advertising?
> And you're happy shilling for a broken model?
> The fact is, the only valid user for the whole security model is to
> PROTECT THE USER.
The user Microsoft care about isn't running Linux. The user is running
Windows, and someone's merely using Linux as a vector to launch their
backdoored Windows kernel. How do Microsoft protect that user? They
blacklist the signature used by that Linux bootloader. If we want to
protect the user's ability to boot Linux, we need to protect the
Windows users from having Linux used against them.
Matthew Garrett | mjg59@xxxxxxxxxxxxx
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/