Re: Plug-and-wipe and Secure Boot semantics

[Florian Weimer <fweimer () redhat com>]

On 12/19/2012 06:39 AM, Greg KH wrote:

> > > > Most signed Linux boot loaders only verify the kernel (and,
> > > > indirectly, code that's loaded into the kernel), but not the
> > > > initrd contents.
> > >
> > > Given that there is only one public signed Linux boot loader, saying
> > > "most" is a bit odd here :)
> >
> > Uhm, aren't there a couple of them in circulation?
>
> Not that I know of, all of the "public" ones are based on Matthew
> Gerritt's code, do you know of another one that has made it through the
> Microsoft signing process?

I was mistaken, I assumed that Fedora was shipping Matthew's 0.1 code, 
which differs significantly from the 0.2 code.  But it turns out that 
Fedora ships 0.2 instead (since the end of November).  Oh well.

> > The Fedora 18 TC3 installer boots on the machine mentioned above, in
> > the factory default configuration.  Previous installer versions
> > showed a Secure Boot error message.  I've run into an installer bug,
> > though:
> > <https://bugzilla.redhat.com/show_bug.cgi?id=888232>
>
> Previous versions of Fedora 18 betas didn't have a valid signed
> bootloader to allow anything to be installed, are you sure it's all
> properly built now?

Yes, or the UEFI implementation on the box is buggy.  It could not boot 
the installer before, but now it can.

> But, more on-topic, how does UEFI secure boot have anything to do with
> this mailing list?

Aren't vendors basing their implementation on the open-source code from 
Intel?  Or are you referring to the fact that Secure Boot has little to 
do with security?

--
Florian Weimer / Red Hat Product Security Team