On Tue, Sep 04, 2012 at 05:08:53PM +0100, Alan Cox wrote: > On Tue, 4 Sep 2012 11:55:06 -0400 > Matthew Garrett <[email protected]> wrote: > > > The UEFI Secure Boot trust model is based on it not being possible for a > > user to cause a signed OS to boot an unsigned OS > > Unfortunately you can't fix this at kernel level because an untrusted > application can at GUI level fake a system crash, reboot cycle and phish > any basic credentials such as passwords for the windows partition.
Any well-designed software asking for credentials should already be requiring a SAK, so in that case we just need to implement sensible SAK support in Linux. -- Matthew Garrett | [email protected] -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
