[personal profile] mjg59
The UEFI bootloader that the Linux Foundation have been working on has just been released. That means we now have two signed bootloaders available - this one and shim.

Does this mean Linux distributions can now support Secure Boot?

They've actually been able to for a while. Ubuntu shipped with Secure Boot support last October, and Fedora shipped with Secure Boot support in January. Both used Shim rather than the Linux Foundation loader, and Shim's also being used by a variety of smaller distributions. The LF loader is a different solution to the same problem.

Is the Linux Foundation the preferred loader for distributions?

Probably not in most cases. One of the primary functional differences between Shim and the LF loader is that the LF loader is based around cryptographic hashes rather than signing keys. This means that the user has to explicitly add a hash to the list of permitted binaries whenever a distribution updates their bootloader or kernel. Doing that involves being physically present at the machine, so it's kind of a pain.

Why use it at all, then?

Being hash based means that you don't need to maintain any signing infrastructure. This means that distributions can support Secure Boot without having to change their build process at all. Shim already supports this use case (and some distributions are using it), but the LF loader has nicer UI for managing it.

Any other reasons?

Actually, yes. Shim implements Secure Boot loading in a less than entirely ideal way - it duplicates the firmware's entire binary loading, validation, relocation and execution code. This is necessary because the UEFI specification doesn't provide any mechanism for adding additional authentication mechanisms. The main downside of this is that the standard UEFI LoadImage() and StartImage() calls don't work under Shim. The LF loader hooks into the low-level security architecture and installs its own handlers, which means the standard UEFI interfaces work. The upshot is that you can use bootloaders like Gummiboot or efilinux without having to modify them to call out to Shim.

Why doesn't Shim do the same?

The UEFI architecture is slightly complicated. The UEFI specification itself defines the upper layers of the firmware, basically covering everything that UEFI applications and operating systems need. It doesn't define the lower layers of a UEFI implementation. Those are contained in the UEFI Platform Initialization spec, and that's what defines the security architecture interfaces that the LF loader hooks into. The problem is that it's completely valid to implement the UEFI specification without implementing the Platform Initialization specification, and if anyone does that then the LF loader will fail.

Can't you try both approaches?

Yes, and that's actually pretty much the plan now. I'm working on integrating the LF loader's UI and security code into Shim with the aim of producing one loader that'll satisfy the full set of use cases, and James is happy with this.

Which should I use?

Depends. If you want to support gummiboot (and aren't willing to patch it to call out to Shim), you'll need to use the LF loader. If you want to use key-based signing setups to avoid forcing re-enrolment on updates, you'll need to use Shim. If you're somewhere in the middle, you can probably use either. Once we've got the code merged, you won't have to make a choice.

Present-user test

Date: 2013-02-10 07:16 pm (UTC)
From: [identity profile] https://www.google.com/accounts/o8/id?id=AItOawmy3iIBA3q2VxDn8VEhueNRjSoWm79j0J4
The original LF plan was to allow secure boot checks to be bypassed by simply pressing a key, thus verifying that the user is physically present at the computer. It looks like now the only options are:

- Use Shim with a signed bootloader and an embedded public key that matches the bootloader, and get MS to sign it. This is what the big distros like Ubuntu, Fedora and SUSE are doing.
- Use a generic Shim with a signed bootloader, and rely on the user to navigate the filesystem and add the public key to MOK.
- Use the LF loader with a generic bootloader, and rely on the user to add the hash to MOK.

These all require either dealing with MS, or a user sophisticated enough to handle enrolling keys/hashes in a pre-boot environment. Are there any plans to support a present-user check, as originally envisioned by LF?

Re: Present-user test

Date: 2013-02-15 01:13 pm (UTC)
From: [identity profile] https://www.google.com/accounts/o8/id?id=AItOawmy3iIBA3q2VxDn8VEhueNRjSoWm79j0J4
Thanks mjg. Sorry I asked the dumb question instead of checking for myself, I just don't have a computer with Secure Boot to test on.

Date: 2013-02-10 10:43 pm (UTC)
From: (Anonymous)
The UEFI architecture is slightly complicated.

"Slightly" complicated? From what I gather from following your posts on the subject, that's quite possibly the understatement of the century... :)

Profile

Matthew Garrett

About Matthew

Power management, mobile and firmware developer on Linux. Security developer at Nebula. Ex-biologist. @mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer.

Expand Cut Tags

No cut tags