| |||||||||||||
'You have to divulge your private key' meme'You have to divulge your private key' memePosted Jul 6, 2012 17:23 UTC (Fri) by mjg59 (subscriber, #23239)In reply to: 'You have to divulge your private key' meme by davidescott Parent article: The FSF's advice to distributors on UEFI secure boot
In that case Canonical's position would make plenty of sense once Windows 9 ships. It seems kind of unnecessary now.
(Log in to post comments)
'You have to divulge your private key' meme Posted Jul 6, 2012 17:35 UTC (Fri) by davidescott (guest, #58580) [Link]
The whole thing seems unnecessary to me once efilinux is taken into account. I'm curious what your (Garrett's) opinion is of that. Why do we need all the machinery of grub these days? Is it just that efi doesn't/can't provide the necessary boot menu to allow us to select kernel version and boot parameters?
You've evidently decided that grub-efi is the way to go, but I missed whatever post explains what that gives us over using efi directly.
Thanks [and double thanks for fighting through this hardware nonsense all the time]
'You have to divulge your private key' meme Posted Jul 6, 2012 17:49 UTC (Fri) by mjg59 (subscriber, #23239) [Link]
efilinux has a tiny proportion of the functionality of grub, and much of that is functionality that we want. Where's efilinux's PXE support? Where's its ability to boot off anything other than a FAT partition? Support for locking down configuration for unattended systems? Its support for managing any kind of runtime configuration at all? The ability for the user to choose which kernel to boot? The ability to boot another operating system? efilinux is great at doing what it does, which right now is booting a single Linux kernel and initrd off a FAT partition with no kind of UI.
Duplicating EFI functionality is a waste of time Posted Jul 8, 2012 1:51 UTC (Sun) by zlynx (subscriber, #2285) [Link]
Network boot is done by EFI. No need to duplicate the code in another program.
Booting off FAT is a EFI requirement. Just put your boot kernel there on the boot partition and it works.
System lockdown is done in EFI with password, default boot option and 0 timeout or a startup.nsh script.
Other operating systems are supported by EFI unless it is a BIOS only operating system then a BIOS emulation layer is required to boot first, like Apple Bootcamp does for Windows XP.
You would not want another UI in a EFI bootloader because the EFI is supposed to have all of the UI already.
Summary: We do not need to duplicate everything EFI already does in a EFI boot loader.
Duplicating EFI functionality is a waste of time Posted Jul 8, 2012 2:00 UTC (Sun) by mjg59 (subscriber, #23239) [Link]
"Network boot is done by EFI. No need to duplicate the code in another program."
The firmware retrieves efilinux. How does efilinux download the kernel?
"Booting off FAT is a EFI requirement. Just put your boot kernel there on the boot partition and it works."
And now your /boot is FAT and you can't make symlinks in it, resulting in various existing tools now being broken.
"System lockdown is done in EFI with password, default boot option and 0 timeout or a startup.nsh script."
All well and good until you want to modify a kernel parameter and now have to wade through a configuration menu that differs between hardware vendors.
"Other operating systems are supported by EFI unless it is a BIOS only operating system then a BIOS emulation layer is required to boot first, like Apple Bootcamp does for Windows XP."
efilinux doesn't support chaining to other operating systems, so if your shim loader boots it first then you're stuck only booting Linux. Except for:
"You would not want another UI in a EFI bootloader because the EFI is supposed to have all of the UI already."
Have you actually used an EFI system? The UI is completely inconsistent between vendors, is often slow and awkward and may not let you edit command line options. Having half your technical documentation say "Refer to your system vendor documentation in order to determine if and how you can edit kernel options" is dreadful. Doing this in the bootloader means that you can guarantee consistency.
Duplicating EFI functionality is a waste of time Posted Jul 10, 2012 3:09 UTC (Tue) by raven667 (subscriber, #5198) [Link]
It seems that EFI has most of the features of GRUB and 90% of what is truly needed to direct boot a Linux kernel. Changing the Linux kernel and boot process to make it better integrate with EFI and changing the reference implementation of EFI when necessary sounds like a reasonable idea. Working on some conventions with the vendors to make the UI decent also seems like it would pay off in time. Maybe this would only work if you had a close relationship with some preferred vendors to ensure an Apple level of user experience.
Duplicating EFI functionality is a waste of time Posted Jul 10, 2012 3:12 UTC (Tue) by mjg59 (subscriber, #23239) [Link]
Given that even Microsoft use a full-featured EFI bootloader I have no faith whatsoever in our ability to get every vendor to adopt a common level of UI competence.
Duplicating EFI functionality is a waste of time Posted Jul 10, 2012 4:21 UTC (Tue) by raven667 (subscriber, #5198) [Link]
The whole thing seems like a missed opportunity then as we are going to be stuck with EFI for at least the next 20 years.
|
|||||||||||||