Re: [PATCH] Fix kexec forbidding kernels signed with custom platform keys to boot

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2018-08-16 at 08:16 -0700, James Bottomley wrote:
> So your lawyers tell you if you sign a third party module for your
> kernel then you could get blamed for the damage it causes?  So this
> whole escapade is about Red Hat trying to evade legal responsibility
> for allowing customers to load third party modules.
> 
> Firstly, your lawyers are wrong: Microsoft took a lot of legal advice
> before they agreed to become the third party signing authority for
> UEFI.  They definitely believe they can't be sued if they sign
> something that later breaches UEFI security.  However, I realise
> trying to overcome overly cautious legal advice is a no win
> situation, so lets move on.

Let me give you some advice from an old hand on this: You definitely
can't overcome a lawyer with a legal argument (well, unless you're
really good, pig headed and come spoiling for a fight), but you
definitely can with a business case.  Once you present a business case
for doing whatever it is the lawyer's have said no to, the next
instruction a good executive will issue is "quantify the legal risk so
we can balance it against the business benefit".  That's where a "no"
based on over caution usually gets overruled because the risks look
minor when exposed to scrutiny.

To generate that business case, why not merge Mehmet's patches?  If
other distributions start using them successfully, then you'll have
both direct and indirect business pressures for Red Hat to do the same
and it will force the re-evaluation you need.  If no-one uses them
there'll be no additional pressure and you'll be no worse off.

James