[lkml]   [2012]   [Jun]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: UEFI Secure boot using qemu-kvm
On Wed, 2012-06-27 at 19:15 +0100, Matthew Garrett wrote:
> On Wed, Jun 27, 2012 at 06:34:05PM +0100, James Bottomley wrote:
> > The purpose of this email is to widen the pool of people who are playing
> > with UEFI Secure boot. The Linux Foundation Technical Advisory Board
> > have been looking into this because it turns out to be rather difficult
> > to lay your hands on real UEFI Secure Boot enabled hardware.
> is the canonical source, but I believe that
> these are now out of stock and waiting for Intel to finish the
> firmware for the replacement.
> > The current state is that I've managed to lock down the secure boot
> > virtual platform with my own PK and KEK and verified that I can generate
> > signed efi binaries that will run on it (and that it will refuse to run
> > unsigned efi binaries). Finally I've demonstrated that I can sign
> > elilo.efi (this has to be built specially because of the bug in gnu-efi)
> > and have it boot an unsigned linux kernel when the platform is in secure
> > mode (I've booted up to an initrd root prompt).
> It's probably worth noting that booting unsigned kernels violates the
> expectations of various vendors
> (
> would be unnecessary if you're supporting unsigned kernels, for
> example). There's no public cross-vendor guidance on this, but I'm
> trying to get that rectified.
> As well as sbsign there's also for
> anyone stuck relying on nss rather than openssl for awkward regulatory
> reasons.

I've tried to build pesign, but I have huge problems with the make
process; how did you build it?

However, sbsign (with four extra patches I've sent to Jeremy) seems to
be built and working.


 \ /
  Last update: 2012-06-27 23:41    [W:0.036 / U:3.984 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site