| |||||||||||||
Garrett: Why UEFI secure boot is difficult for LinuxGarrett: Why UEFI secure boot is difficult for LinuxPosted Jan 19, 2012 2:15 UTC (Thu) by mjg59 (subscriber, #23239)In reply to: Garrett: Why UEFI secure boot is difficult for Linux by martin.langhoff Parent article: Garrett: Why UEFI secure boot is difficult for Linux
There is a blacklist, but there's currently no policy for updating it.
(Log in to post comments)
Garrett: Why UEFI secure boot is difficult for Linux Posted Jan 19, 2012 3:06 UTC (Thu) by laptop006 (subscriber, #60779) [Link]
What about mechanisms? Can a Windows update silently blacklist keys? (Or even add a new one?)
Garrett: Why UEFI secure boot is difficult for Linux Posted Jan 19, 2012 3:12 UTC (Thu) by mjg59 (subscriber, #23239) [Link]
Keys can be added to the whitelist or the blacklist by updating the DB or DBX variables. Doing that requires that the update be signed by a valid KEK. Windows 8 logo machines will have a Microsoft key in KEK, so Windows Update can certainly add keys to either.
|
|||||||||||||