> Imagine you run windows and you've never heard of Linux. To those people I think you mean "never heard of Ubuntu" ;-) > In this case we have a completely 'untrusted' root inside Linux. From > the user PoV root and Linux are both malware. Notice the EXACT same > attack would work launching rootkit'd Linux from Linux. So don't > pretend not to care about Windows. It's just that launching malware > Linux seems like a reason to get your key revoked. We don't want > signed code which can be used as an attack vector on ourselves or on > others. > > That make sense? Not really but it keeps some of the Red Hat security people happy and out of harms way. With all the current posted RH patches I can still take over the box as root trivially enough and you seem to have so far abolished suspend to disk, kexec and a pile of other useful stuff. To actually lock it down you'll have to do a ton more of this. I suspect folks who know windows innards well are probably thinking the same about Windows 8 8) Almost anyone attacking a secure boot box will do it via windows or more likely via EFI. EFI because its large, new and doesn't a great history, windows because its the larger target. Actually from what I've seen on the security front there seems to a distinct view that secure boot is irrelevant because Windows 8 is so suspend/resume focussed that you might as well just trojan the box until the next reboot as its likely to be a couple of weeks a way. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
