Re: [RFC] Second attempt at kernel secure boot support

2012-11-02 Thread Vivek Goyal
On Fri, Nov 02, 2012 at 05:22:41PM +0100, Jiri Kosina wrote: On Fri, 2 Nov 2012, Vivek Goyal wrote: crash utility has module which allows reading kernel memory. So leaking this private key will be easier then you are thinking it to be. That's not upstream, right? Yes,

Re: [RFC] Second attempt at kernel secure boot support

2012-11-02 Thread Eric W. Biederman
Matthew Garrett mj...@srcf.ucam.org writes: On Fri, Nov 02, 2012 at 01:49:25AM -0700, Eric W. Biederman wrote: When the goal is to secure Linux I don't see how any of this helps. Windows 8 compromises are already available so if we turn most of these arguments around I am certain clever

Re: [RFC] Second attempt at kernel secure boot support

2012-11-02 Thread Chris Friesen
On 11/02/2012 04:03 PM, Eric W. Biederman wrote: Matthew Garrettmj...@srcf.ucam.org writes: On Fri, Nov 02, 2012 at 01:49:25AM -0700, Eric W. Biederman wrote: When the goal is to secure Linux I don't see how any of this helps. Windows 8 compromises are already available so if we turn most

Re: [RFC] Second attempt at kernel secure boot support

2012-11-02 Thread Alan Cox
No reason to? How can I configure an off the shelf system originally sold with windows 8 installed to boot in UEFI secure boot mode using shim without trusting Microsoft's key? Assuming its an x86 and a PC class platform and thus should allow you to disable secure boot mode then you disable

Re: [RFC] Second attempt at kernel secure boot support

2012-11-02 Thread Matthew Garrett
On Fri, Nov 02, 2012 at 05:47:02PM -0700, Eric W. Biederman wrote: No reason to? How can I configure an off the shelf system originally sold with windows 8 installed to boot in UEFI secure boot mode using shim without trusting Microsoft's key? Delete the installed keys, install your choice