lkml.org 
[lkml]   [2014]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 0/4] KEYS: validate key trust with owner and builtin keys only
From
Date
On Tue, 2014-06-10 at 08:20 -0400, Josh Boyer wrote: 
> On Tue, Jun 10, 2014 at 11:48:14AM +0300, Dmitry Kasatkin wrote:

> > Also I want to discuss here Fedora UEFI patches as they are the reason for
> > the these original patchset.
> >
> > http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch
> >
> > They provide functionality to specify MokIgnoreDb variable to limit loading of
> > UEFI keys only from MOK List, while ignoring DB. This is certainly a good
> > functionality. But once MODULE_SIG_UEFI is enabled, it looks there is no way
> > to prevent loading keys from UEFI at all. And this might not be a good default
> > functionality. Someone might want not allow loading of keys from UEFI unless
> > kernel parameter is specified to allow it without recompiling the kernel
> > and disabling MODULE_SIG_UEFI.
> >
> > Josh, why such design decision was made?
>
> IIRC, it's because kernel parameters can be added programmatically from a
> remote user if they gain root access. Having a kernel parameter to
> disable a key piece of secure boot isn't all that great. We disable
> other kernel parameters like acpi_rspd as well.

In this case, there shouldn't be a problem as the kernel parameters
would further limit the keys usage.

Mimi



\
 
 \ /
  Last update: 2014-06-10 15:21    [W:0.200 / U:10.372 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site