Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Fedora, secure boot, and an insecure future

Posted Jun 5, 2012 22:33 UTC (Tue) by nirik (guest, #71)
Parent article: Fedora, secure boot, and an insecure future

Overall great article, but two things:

1) It's worth noting that Matthew's plan is still simply a proposal at this stage. It's not yet been voted on by FESCo or the like. Perhaps something will change before that happens (although I doubt it), or FESCo could decide to reject the idea.

2) Additionally the article didn't touch on it, but hopefully there will be documentation and tools to allow any Fedora user to sign their own stuff. This way you could enable Secure Boot, but not use only your own keys signing your own bootloader shim/grub2/kernel. These tools and docs will of course be free and open.

An evolving resource with information on this for Fedora users:

https://fedoraproject.org/wiki/Secureboot

(Log in to post comments)

Fedora, secure boot, and an insecure future

Posted Jun 6, 2012 15:42 UTC (Wed) by gmaxwell (subscriber, #30048) [Link]

RedHat just ran press releases announcing it: http://www.muktware.com/3699/secure-boot-uefi-fedora-red-...

If you want FESCO to vote on it you're going to have to insist, because otherwise that vote isn't going to happen, it's just going to go in as updates to the relevant packages/toolchains.

Fedora, secure boot, and an insecure future

Posted Jun 7, 2012 9:35 UTC (Thu) by sochotnicky (subscriber, #65774) [Link]

You *do* realize you linked to muktware, while saying Red Hat ran a press release. Why not just point to the full press release text[1]?

Quoting:
"...first UEFI secure boot implementation *is expected* (emphasis mine) to appear in the upcoming Fedora 18 release."

UEFI secure boot will most likely appear on https://fedoraproject.org/wiki/Releases/18/FeatureList and thus FESCO vote will be mandatory.

[1] http://www.redhat.com/about/news/archive/2012/6/uefi-secu...

Fedora, secure boot, and an insecure future

Posted Jun 7, 2012 10:03 UTC (Thu) by neiljerram (subscriber, #12005) [Link]

How can that make sense? My understanding of Matthew's proposal is that

the kernel, being the software with direct access to the hardware, needs to be controlled, so that it can't do things to the hardware that might attack or subvert Windows or the boot system
if RH didn't (intentionally or by mistake) provide that control, the ultimate result would be RH's bootloader key being revoked, and then no RH systems would boot ever again.

Given those points, how can any RH/Fedora user be allowed to build and sign their own modified kernel, to be booted from the secure boot chain?

Personally, I just don't see what's hard about finding and toggling the BIOS secure boot setting. And to the extent that working with any of this is hard, I think better for that to create pressure on manufacturers to provide non-Windows-8-logo hardware.

Fedora, secure boot, and an insecure future

Posted Jun 7, 2012 13:37 UTC (Thu) by mjg59 (subscriber, #23239) [Link]

If a user installs their own key then a user can self-sign their kernel and bootloader.