Re: [GIT PULL] Load keys from signed PE binaries

From: Florian Weimer
Date: Tue Feb 26 2013 - 14:41:10 EST

* Theodore Ts'o:

> On Tue, Feb 26, 2013 at 02:25:55PM +1000, Dave Airlie wrote:
>> Its a simple argument, MS can revoke our keys for whatever reason,
>> reducing the surface area of reasons for them to do so seems like a
>> good idea. Unless someone can read the mind of the MS guy that
>> arbitrarily decides this in 5 years time, or has some sort of signed
>> agreement, I tend towards protecting the users from having their Linux
>> not work anymore, because we were scared of a PE loader in the kernel.
> If Microsoft will revoke keys for whatever reason they want, without
> any regard to the potential PR and legal consequences to Microsoft,
> there's absolutely **nothing** you can do, short of choosing to use
> more open hardware (for example, like the Chromebook Pixel).

| No, there's no way to set the legacy boot as the default option.


So non-interactive booting of alternative operating systems is *not*
supported. This is way more restrictive than any x86 UEFI device I've
heard of (even in the face of a potential revocation of the boot
loader by Microsoft).
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at