Home page logo

oss-sec logo oss-sec mailing list archives

Re: Plug-and-wipe and Secure Boot semantics
From: Florian Weimer <fweimer () redhat com>
Date: Wed, 19 Dec 2012 10:20:12 +0100

On 12/19/2012 06:39 AM, Greg KH wrote:

Most signed Linux boot loaders only verify the kernel (and,
indirectly, code that's loaded into the kernel), but not the
initrd contents.

Given that there is only one public signed Linux boot loader, saying
"most" is a bit odd here :)

Uhm, aren't there a couple of them in circulation?

Not that I know of, all of the "public" ones are based on Matthew
Gerritt's code, do you know of another one that has made it through the
Microsoft signing process?

I was mistaken, I assumed that Fedora was shipping Matthew's 0.1 code, which differs significantly from the 0.2 code. But it turns out that Fedora ships 0.2 instead (since the end of November). Oh well.

The Fedora 18 TC3 installer boots on the machine mentioned above, in
the factory default configuration.  Previous installer versions
showed a Secure Boot error message.  I've run into an installer bug,

Previous versions of Fedora 18 betas didn't have a valid signed
bootloader to allow anything to be installed, are you sure it's all
properly built now?

Yes, or the UEFI implementation on the box is buggy. It could not boot the installer before, but now it can.

But, more on-topic, how does UEFI secure boot have anything to do with
this mailing list?

Aren't vendors basing their implementation on the open-source code from Intel? Or are you referring to the fact that Secure Boot has little to do with security?

Florian Weimer / Red Hat Product Security Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]