On Tue, Apr 3, 2018 at 2:21 PM Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > On Tue, Apr 03, 2018 at 09:08:54PM +0000, Matthew Garrett wrote: > > If you don't want Secure Boot, turn it off. If you want Secure Boot, use a > > kernel that behaves in a way that actually increases your security. > That assumes you *can* turn that shit off. On the hardware where manufacturer > has installed firmware that doesn't allow that SB is a misfeature that has > to be worked around. Making that harder might improve the value of SB to > said manufacturers, but what's the benefit for everybody else? This is why Shim has support for its own key database, as well as allowing you to disable further signature validation. If the hardware supports third party code at all, you can just use Shim to sidestep any unreasonable restrictions the vendor has imposed. (This doesn't help with systems that don't support third party code at all, but this patchset does nothing to make that worse - that hardware wouldn't boot your own kernel before this patchset, and it won't afterwards either) -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
