linux-kernel - Re: [GIT PULL] Load keys from signed PE binaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Feb 2013 14:55:32 +1000
From:	Dave Airlie <airlied@...il.com>
To:	"Theodore Ts'o" <tytso@....edu>, Dave Airlie <airlied@...il.com>,
	Greg KH <gregkh@...uxfoundation.org>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	David Howells <dhowells@...hat.com>,
	Florian Weimer <fw@...eb.enyo.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Josh Boyer <jwboyer@...hat.com>,
	Peter Jones <pjones@...hat.com>,
	Vivek Goyal <vgoyal@...hat.com>,
	Kees Cook <keescook@...omium.org>, keyrings@...ux-nfs.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] Load keys from signed PE binaries

On Tue, Feb 26, 2013 at 2:45 PM, Theodore Ts'o <tytso@....edu> wrote:
> On Tue, Feb 26, 2013 at 02:25:55PM +1000, Dave Airlie wrote:
>>
>> Its a simple argument, MS can revoke our keys for whatever reason,
>> reducing the surface area of reasons for them to do so seems like a
>> good idea. Unless someone can read the mind of the MS guy that
>> arbitrarily decides this in 5 years time, or has some sort of signed
>> agreement, I tend towards protecting the users from having their Linux
>> not work anymore, because we were scared of a PE loader in the kernel.
>
> If Microsoft will revoke keys for whatever reason they want, without
> any regard to the potential PR and legal consequences to Microsoft,
> there's absolutely **nothing** you can do, short of choosing to use
> more open hardware (for example, like the Chromebook Pixel).
>
> If you're that terrified of the completely arbitrary and capricious
> Microsoft guy having us by the short hairs, why aid and abet Microsoft
> control-freak model?
>

No what I said if you read it, was nobody knows, you don't, Greg
doesn't, Matthew doesn't.

That's the problem you are all arguing like you know shit that none of you know.

So you all have opinions on what Microsoft would do if faced with the
compromise Matthew reports, and really if you think MS are going to
leave a secureboot bypass via Linux live, then you wonder why they are
expending all this money on secureboot at all, since the first person
to write a Linux based exploit is safe because of a PR backlash? At
this point we'd be best served by writing the PoC exploit I suppose
and then seeing what MS do up front!

So it would be nice if LF could undertake to go and talk to Microsoft,
and get vague opinions turned into something real.

Ted you might be at liberty to get a chromebook pixel from google, but
that isn't going to help the other X% of users who have a PC they want
to use Linux on, and maybe boot Windows to do their taxes.

Dave.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/