Re: [GIT PULL] Load keys from signed PE binaries

[Florian Weimer]

* Theodore Ts'o:

> On Tue, Feb 26, 2013 at 02:25:55PM +1000, Dave Airlie wrote:
>> 
>> Its a simple argument, MS can revoke our keys for whatever reason,
>> reducing the surface area of reasons for them to do so seems like a
>> good idea. Unless someone can read the mind of the MS guy that
>> arbitrarily decides this in 5 years time, or has some sort of signed
>> agreement, I tend towards protecting the users from having their Linux
>> not work anymore, because we were scared of a PE loader in the kernel.
>
> If Microsoft will revoke keys for whatever reason they want, without
> any regard to the potential PR and legal consequences to Microsoft,
> there's absolutely **nothing** you can do, short of choosing to use
> more open hardware (for example, like the Chromebook Pixel).

| No, there's no way to set the legacy boot as the default option.

<https://plus.google.com/100479847213284361344/posts/QhmBpn5GNE9>

So non-interactive booting of alternative operating systems is *not*
supported.  This is way more restrictive than any x86 UEFI device I've
heard of (even in the face of a potential revocation of the boot
loader by Microsoft).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/