| From: |
| David Howells <dhowells-AT-redhat.com> |
| To: |
| Andy Lutomirski <luto-AT-kernel.org> |
| Subject: |
| Re: [GIT PULL] Kernel lockdown for secure boot |
| Date: |
| Wed, 04 Apr 2018 09:05:17 +0100 |
| Message-ID: |
| <20736.1522829117@warthog.procyon.org.uk> |
| Cc: |
| dhowells-AT-redhat.com, Jann Horn <jannh-AT-google.com>, Linus Torvalds <torvalds-AT-linux-foundation.org>, Matthew Garrett <mjg59-AT-google.com>, Ard Biesheuvel <ard.biesheuvel-AT-linaro.org>, James Morris <jmorris-AT-namei.org>, Alan Cox <gnomes-AT-lxorguk.ukuu.org.uk>, Greg Kroah-Hartman <gregkh-AT-linuxfoundation.org>, Linux Kernel Mailing List <linux-kernel-AT-vger.kernel.org>, Justin Forbes <jforbes-AT-redhat.com>, linux-man <linux-man-AT-vger.kernel.org>, joeyli <jlee-AT-suse.com>, LSM List <linux-security-module-AT-vger.kernel.org>, Linux API <linux-api-AT-vger.kernel.org>, Kees Cook <keescook-AT-chromium.org>, linux-efi <linux-efi-AT-vger.kernel.org> |
Andy Lutomirski <luto@kernel.org> wrote:
> As far as I can tell, what's really going on here is that there's a
> significant contingent here that wants to prevent Linux from
> chainloading something that isn't Linux.
You have completely the wrong end of the stick. No one has said that or even
implied that. You are alleging dishonesty on our part.
What we *have* said is that *if* we want to pass the secure boot state across
kexec, then we have to make sure that:
(1) no one tampers with the intermediate kernel between boot and kexec
otherwise the secure boot state is effectively invalidated, and
(2) the image that gets kexec'ed is trusted.
Remember: you cannot know (2) if you don't have (1).
And if someone tampers with the aim of breaking, say, Windows, then someone,
e.g. Microsoft, might blacklist the shim.
David
