On Tue, Apr 3, 2018 at 2:26 PM Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Tue, Apr 3, 2018 at 2:08 PM, Matthew Garrett <mjg59@xxxxxxxxxx> wrote: > > > > Secure Boot ensures that the firmware will only load signed bootloaders. If > > a signed bootloader loads a kernel that's effectively an unsigned > > bootloader, there's no point in using Secure Boot > Bullshit. > I may want to know that I'm running *my* kernel, but once that is the > case, I trust it. If you don't believe that your self-signed kernel is going to be a threat against your security model then great! Don't turn this on when you build it. But if you built a kernel that didn't have this lockdown functionality and got it signed with, say, Red Hat's signing keys, anyone could take Red Hat's bootloader chain and that kernel and subvert the Secure Boot chain on any machine that trusts the third party signing key (ie, basically all of them) > Yes, on x86 hardware at least at some point MS actually had the rule > that it has to be something you can turn off. That rule is apparently > not true on ARM, though. Correct - there's no requirement that it be something you can disable on ARM, but since Microsoft won't sign any third-party code for ARM anyway it makes no difference to this discussion. > If you want lockdown, fine, enable it. But what the F*CK does that > have to do with whether you had secure boot or not? Because a kernel signed with a generally trusted key that doesn't implement any lockdown functionality is effectively a bootloader that will load unsigned material on most machines on the market, which reduces the security of users running those machines with Secure Boot enabled. -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
