Re: [GIT PULL] Load keys from signed PE binaries

[Florian Weimer <fw@deneb.enyo.de>]

* Greg KH:

> On Tue, Feb 26, 2013 at 03:13:38AM +0000, Matthew Garrett wrote:
>> Because Microsoft have indicated that they'd be taking a reactive 
>> approach to blacklisting and because, so far, nobody has decided to 
>> write the trivial proof of concept that demonstrates the problem.
>
> So, once that proof is written, suddenly all of the working Linux
> distros's keys will be revoked?

The counterargument to that is that Microsoft will not proactively
revoke UEFI drivers, only drivers which are actually abused.

As far as I know, there is no public commitment to this revocation
policy.  It makes sense, given the limited revocation space, but
that's all.

> I don't buy it.  Yes, I understand this is your position, and has been
> all along, and _maybe_ you can extend it to "we should sign our kernel
> modules", but to take it farther than that, like the list David has
> described, is not required by anyone here.

It's a logical extrapolation based on the technical specification.
I've been guilty of the same mistake, if you want to call it that way.
Basically, we're making up concrete security objectives because the
existing documentation doesn't provide them, and write our code
according to that.  But we can easily guess wrong, in both directions.

In any case, there's another reading of the UEFI Secure Boot
requirements: you may run any code you wish after calling
ExitBootServices().  That could be an unsigned, traditional GRUB.  But
this will not generally address the issue of dual-booting Windows 8 in
such a way that Windows sees that the device has enabled Microsoft
Secure Boot.