Re: [RFC] First attempt at kernel secure boot support

[Matthew Garrett]

On Tue, Sep 04, 2012 at 05:08:53PM +0100, Alan Cox wrote:
> On Tue,  4 Sep 2012 11:55:06 -0400
> Matthew Garrett <mjg@xxxxxxxxxx> wrote:
> 
> > The UEFI Secure Boot trust model is based on it not being possible for a
> > user to cause a signed OS to boot an unsigned OS
> 
> Unfortunately you can't fix this at kernel level because an untrusted
> application can at GUI level fake a system crash, reboot cycle and phish
> any basic credentials such as passwords for the windows partition.

Any well-designed software asking for credentials should already be 
requiring a SAK, so in that case we just need to implement sensible SAK 
support in Linux.

-- 
Matthew Garrett | mjg59@xxxxxxxxxxxxx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/