Re: [PATCH] Fix kexec forbidding kernels signed with custom platform keys to boot

[James Bottomley]

On Wed, 2018-08-15 at 23:31 +0200, Yannik Sembritzki wrote:
> On 15.08.2018 23:13, James Bottomley wrote:
> > Consider a UEFI system for which a user has taken ownership, but
> > which
> > has some signed ROMs which are UEFI secure boot verified.ÂÂSimply
> > to
> > get their system to boot the user will be forced to add the ODM key
> > to
> > the UEFI db ... and I'm sure in that situation the user wouldn't
> > want
> > to trust the ODM key further than booting.
> 
> I definitely agree with this point.
> 
> Is there any solution, except from building your own kernel, to the
> scenario I described?
> I think there should be. (I've personally run into this with
> VirtualBox, which I IIRC couldn't load, even though I provisioned my
> own PK, and signed both kernel and VirtualBox module with my own key.
> I could've compiled my own kernel with my //own key, but that is
> pretty impractical for most users.)

What about the key linking patches:

https://lkml.org/lkml/2018/5/2/989

? They allow you to insert your own binary key into bzimage and then
resign the resulting blob for secure boot.  It's a fairly painless
process.  The patches have been languishing for an unstated reason but
it's suspected to have something to do with Red Hat not wanting to
support Enterprise users signing their own kernels.

James