lkml.org 
[lkml]   [2014]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 0/4] KEYS: validate key trust with owner and builtin keys only
On Wed, Jun 11, 2014 at 12:34:28AM +0300, Dmitry Kasatkin wrote:

> My statement is still valid. It is a hole...
>
> To prevent the hole it should be explained that one might follow
> certain instructions
> to take ownership of your PC. Generate your own keys and remove MS and
> Vendor ones...

The hole is that the system trusts keys that you don't trust. The
appropriate thing to do is to remove that trust from the entire system,
not just one layer of the system. If people gain the impression that
they can simply pass a kernel parameter and avoid trusting the vendor
keys, they'll be upset to discover that it's easily circumvented.

--
Matthew Garrett | mjg59@srcf.ucam.org


\
 
 \ /
  Last update: 2014-06-11 00:01    [W:0.087 / U:10.548 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site