[lkml]   [2012]   [Jun]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: UEFI Secure boot using qemu-kvm
On Wed, Jun 27, 2012 at 06:34:05PM +0100, James Bottomley wrote:

> The purpose of this email is to widen the pool of people who are playing
> with UEFI Secure boot. The Linux Foundation Technical Advisory Board
> have been looking into this because it turns out to be rather difficult
> to lay your hands on real UEFI Secure Boot enabled hardware. is the canonical source, but I believe that
these are now out of stock and waiting for Intel to finish the
firmware for the replacement.

> The current state is that I've managed to lock down the secure boot
> virtual platform with my own PK and KEK and verified that I can generate
> signed efi binaries that will run on it (and that it will refuse to run
> unsigned efi binaries). Finally I've demonstrated that I can sign
> elilo.efi (this has to be built specially because of the bug in gnu-efi)
> and have it boot an unsigned linux kernel when the platform is in secure
> mode (I've booted up to an initrd root prompt).

It's probably worth noting that booting unsigned kernels violates the
expectations of various vendors
would be unnecessary if you're supporting unsigned kernels, for
example). There's no public cross-vendor guidance on this, but I'm
trying to get that rectified.

As well as sbsign there's also for
anyone stuck relying on nss rather than openssl for awkward regulatory

Matthew Garrett |

 \ /
  Last update: 2012-06-27 21:01    [W:0.081 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site