Re: [PATCH v5] efi: Do not import certificates from UEFI Secure Boot for T2 Macs

[Aditya Garg]

> Based on your explanation, there seems to be two issues - inability to
> read EFI variables, "users can't add their own" keys. Neither of which
> mean "a non-standard implementation of secure boot". Please fix the
> "cause" and "affect" in the patch description and comments.

Sending a v6

Also, I guess I should just remove the secure boot bit, cause secure boot, though kinda related, doesn’t have much role here.

The “cause” is reading of specific UEFI variables, like db, dbx etc, and the “affect” being crashing of EFI Runtime Services.

The “fix”, simply prevent reading of these variables

The role of secure boot (Which I have removed in the description of v6, cause its not of much significance in regard to this patch) :-

Loading of these certificates is required to “boot securely”. By disabling loading of these certificates, we are technically preventing booting Linux “securely” on these machines. But, this shouldn’t be a matter to worry about. The reason being, Apple doesn’t allow anything other that macOS or Windows to boot if Secure Boot in turned on, on these Macs, making it impossible to boot Linux with secure boot on, unless Apple itself updates the firmware on the T2 Chip, to support Linux as well, which is highly unlikely.
> 
> thanks,
> 
> Mimi