On Thu, 2022-11-10 at 01:01 +0100, Morten Linderud wrote: [...] > efi_mokvar_entry_find doesn't simply read an UEFI variable as the > commit message suggests, it will look for the MOK variable loaded > into the EFI configuration table. This implies we need this table > setup in early boot to take usage of this patch set. > > The only bootloader that does setup this table, is the `shim` as > described. But no other bootloader implements support for the MOK EFI > configuration table. Just to be precise: shim isn't a boot loader. It's a trust pivot device away from the built in UEFI keys to the Machine Owner Keys. Shim is designed to be used with another bootloader like grub or sd- boot. Now you could load a kernel directly with shim, in the same way you could load it directly from UEFI, but that doesn't make it a bootloader. > > This effectively means that there is still no way for Machine Owners > to load keys into the keyring, for things like module signing, > without the shim present in the bootchain. I find this a bit weird. > > Is this an intentional design decision, or could other ways be > supported as well? Yes, rather than try to have all bootloaders conform to the MoK protocol, it's easier to implement it in a single purpose component that can be used with any of them. Essentially if you want to rely on the UEFI keys and not do an MoK pivot (as some people do) then you can remove shim from the sequence. In many ways that's part of the problem with this patch set: The underlying assumption is everyone does this trust pivot. If you don't do this trust pivot (I don't for instance, having replaced my UEFI keys with my own) you can't add keys to the kernel this way. However, how would the kernel know whether you trust the UEFI keys or not? The other problem is that without the shim protocol being present, grub can't check the kernel signature, which means that even if you do own your own UEFI keys, you need something to replace shim, like: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/tree/ShimReplace.c James
