lkml.org 
[lkml]   [2012]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] First attempt at kernel secure boot support
On Tue, Sep 04, 2012 at 05:08:53PM +0100, Alan Cox wrote:
> On Tue, 4 Sep 2012 11:55:06 -0400
> Matthew Garrett <mjg@redhat.com> wrote:
>
> > The UEFI Secure Boot trust model is based on it not being possible for a
> > user to cause a signed OS to boot an unsigned OS
>
> Unfortunately you can't fix this at kernel level because an untrusted
> application can at GUI level fake a system crash, reboot cycle and phish
> any basic credentials such as passwords for the windows partition.

Any well-designed software asking for credentials should already be
requiring a SAK, so in that case we just need to implement sensible SAK
support in Linux.

--
Matthew Garrett | mjg59@srcf.ucam.org

\
 
 \ /
  Last update: 2012-09-04 19:02    [from the cache]
©2003-2011 Jasper Spaans