On Tue, Apr 3, 2018 at 5:56 PM Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Tue, Apr 3, 2018 at 5:46 PM, Matthew Garrett <mjg59@xxxxxxxxxx> wrote: > > > > The generic distros have been shipping this policy for the past 5 years. > .. so apparently it doesn't actually break things? Why not enable it > by default then? Because it does break things, and the documented fix is "Disable Secure Boot by running mokutil --disable-validation". > And if "turn off secure boot" really is the accepted - and actuially > used - workaround for the breakage, then > WHY THE HELL DIDN'T YOU START OFF BY EXPLAINING THAT IN THE FIRST > PLACE WHEN PEOPLE ASKED WHY THE TIE-IN EXISTED? > Sorry for shouting, but really. We have a thread of just *how* many > email messages that asked for the explanation for this? All we got was > incomprehensible and illogical crap explanations. There are four cases: Verified Boot off, lockdown off: Status quo in distro and mainline kernels Verified Boot off, lockdown on: Perception of security improvement that's trivially circumvented (and so bad) Verified Boot on, lockdown off: Perception of security improvement that's trivially circumvented (and so bad), status quo in mainline kernels Verified Boot on, lockdown on: Security improvement, status quo in distro kernels Of these four options, only two make sense. The most common implementation of Verified Boot on x86 platforms is UEFI Secure Boot, so this patchset includes an option that (if set) results in the kernel doing the right thing without user intervention. This makes it easy for a user to switch between the two states that make sense by running a single command and then following some prompts on the next reboot. The alternative would be to provide a signed kernel that always enabled lockdown and an unsigned kernel that didn't, which would (a) increase load on distributions and (b) force users to both run mokutil --disable-validation and also install a different kernel. I'm sorry if I've appeared tetchy in this discussion - having several of my coworkers shot has not done wonders for my mood. -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
