Re: Plug-and-wipe and Secure Boot semantics

[Greg KH <greg () kroah com>]

On Wed, Dec 19, 2012 at 10:20:12AM +0100, Florian Weimer wrote:
> On 12/19/2012 06:39 AM, Greg KH wrote:
> > > The Fedora 18 TC3 installer boots on the machine mentioned above, in
> > > the factory default configuration.  Previous installer versions
> > > showed a Secure Boot error message.  I've run into an installer bug,
> > > though:
> > > <https://bugzilla.redhat.com/show_bug.cgi?id=888232>
> >
> > Previous versions of Fedora 18 betas didn't have a valid signed
> > bootloader to allow anything to be installed, are you sure it's all
> > properly built now?
>
> Yes, or the UEFI implementation on the box is buggy.  It could not
> boot the installer before, but now it can.
>
> > But, more on-topic, how does UEFI secure boot have anything to do with
> > this mailing list?
>
> Aren't vendors basing their implementation on the open-source code
> from Intel?  Or are you referring to the fact that Secure Boot has
> little to do with security?

We don't know what vendors are basing their UEFI bios implementation on
the open source version, I know there is at least one UEFI bios that is
not based on the open source version, or so it is reported (the BSD
license of Tianocore means that we will never really know.)

Determining what machine is running what bios from what company that was
based on what version of the open source UEFI implementation is going to
be a huge problem in the long run and something that I sure don't want
to have to track.

There have been reported bugs in the Tianocore in the past, I don't
think they were "security" issues in and of themselves, should we be
reporting them here to get CVE numbers if they are?

thanks,

greg k-h