linux-kernel - Re: [GIT PULL] Load keys from signed PE binaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Feb 2013 16:40:53 -0500
From:	Peter Jones <pjones@...hat.com>
To:	Florian Weimer <fw@...eb.enyo.de>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	"Theodore Ts'o" <tytso@....edu>,
	Greg KH <gregkh@...uxfoundation.org>,
	David Howells <dhowells@...hat.com>,
	Josh Boyer <jwboyer@...hat.com>,
	Vivek Goyal <vgoyal@...hat.com>,
	Kees Cook <keescook@...omium.org>, keyrings@...ux-nfs.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] Load keys from signed PE binaries

On Tue, Feb 26, 2013 at 10:30:46PM +0100, Florian Weimer wrote:
> * Linus Torvalds:
> 
> > So here's what I would suggest, and it is based on REAL SECURITY and
> > on PUTTING THE USER FIRST instead of your continual "let's please
> > microsoft by doing idiotic crap" approach.
> 
> I think the real question is this one: Is there *any* device out there
> which comes with Microsoft Secure Boot enabled, but doesn't have a
> copy of Windows 8 on it?
> 
> I guess there isn't.  So Secure Boot support is only required for
> supporting dual-booting Windows 8, while still retaining the automated
> recovery capabilities (which might well remove the Linux installation
> on the same box).
> 
> Without dual-booting, there is currently no reason whatsoever to
> enable UEFI Secure Boot (or the Microsoft variant).

It prevents a form of malware which exists in the wild.  I think that's
enough reason to want *something*, though SB isn't necessarily what
we'd have dreamed of.  Nevertheless, SB is what we've got, and as such
is why we've been working on how to use it meaningfully.

This all seems pretty orthogonal to the question at hand, of course.

-- 
        Peter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/