Hi! > > But that doesn't really help me: untrusted root is an oxymoron. > > Imagine you run windows and you've never heard of Linux. You like > that only windows kernels can boot on your box and not those mean > nasty hacked up malware kernels. Now some attacker manages to take > over your box because you clicked on that executable for young models > in skimpy bathing suits. That executable rewrote your bootloader to > launch a very small carefully crafted Linux environment. This > environment does nothing but launch a perfectly valid signed Linux > kernel, which gets a Windows environment all ready to launch after > resume and goes to sleep. Now you have to hit the power button twice > every time you turn on your computer, weird, but Windows comes up, and > secureboot is still on, so you must be safe! Ok, so you cripple kexec / suspend to disallow this, and then... ...attacker launches carefuly crafter Linux environment, that just launches X and fullscreen wine. Sure, timing may be slightly different, but Windows came up and secureboot is still on.. so user happily enters his bank account details. Could someone write down exact requirements for Linux kernel to be signed by Microsoft? Because thats apparently what you want, and I don't think crippling kexec/suspend is enough. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
