Re: [GIT PULL] Load keys from signed PE binaries

[Matthew Garrett]

On Thu, Feb 28, 2013 at 08:41:13PM +0100, Florian Weimer wrote:
> * Matthew Garrett:
> 
> >> Would it be possible to have a signed bootloader that allows booting
> >> Win8 from within the secure environment, or it could exit the secure
> >> environment and run unsigned grub?
> >
> > What would stop the unsigned grub from installing a firmware hook that 
> > lies about whether or not Secure Boot is enabled, and then booting 
> > Windows?
> 
> Windows would not have access to the product key because it is stored
> in a variable without EFI_VARIABLE_RUNTIME_ACCESS, so WGA and other
> checks will fail, and the user will notice.

grub's running before ExitBootServices(), because otherwise it has no 
way to actually read anything off disk. Or draw to the screen. Or 
receive keyboard input. So if it boots Windows, Windows is running in 
exactly the environment it would expect to be in.

-- 
Matthew Garrett | mjg59@xxxxxxxxxxxxx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/