"You're confusing KEK and db, but even so - Microsoft aren't going to blacklist anything that has no security issues, since it would be clear anticompetitive behaviour."
Really the shim and mok current design does have a security issue it allowed booting unsigned.
UEFI design has booting unsigned as an action of EFI setup mode when you deleted the PK or if in firmware you have turned secure boot off.
Tightening security requirements is not anti-competitive behaviour. That is the problem.
You say that we need lockdown in the Linux kernel so the Linux kernel cannot be used as a boot loader to unsigned/unapproved then mok has that feature. To turn off lockdown you suggest using mok switch to boot what ever.
Reality if you are running a Linux kernel without lockdown validation of kernel, drivers and key applications comes way more important so that what you loading is what you think you are loading. At times you will need to perform tasks that lockdown forbids this does not mean that performing those tasks you have to take major risks. Like a distribution locked down repair tool could have a kernel without lockdown to fix common faults but be using IMA heavily to limit is operations so not be a security risk.
Power management, mobile and firmware developer on Linux. Security developer at nvidia. Ex-biologist. Content here should not be interpreted as the opinion of my employer. Also on Mastodon and Bluesky.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: Here we go again.
Date: 2018-04-07 03:06 am (UTC)Really the shim and mok current design does have a security issue it allowed booting unsigned.
UEFI design has booting unsigned as an action of EFI setup mode when you deleted the PK or if in firmware you have turned secure boot off.
Tightening security requirements is not anti-competitive behaviour. That is the problem.
You say that we need lockdown in the Linux kernel so the Linux kernel cannot be used as a boot loader to unsigned/unapproved then mok has that feature. To turn off lockdown you suggest using mok switch to boot what ever.
Reality if you are running a Linux kernel without lockdown validation of kernel, drivers and key applications comes way more important so that what you loading is what you think you are loading. At times you will need to perform tasks that lockdown forbids this does not mean that performing those tasks you have to take major risks. Like a distribution locked down repair tool could have a kernel without lockdown to fix common faults but be using IMA heavily to limit is operations so not be a security risk.