linux-kernel - Re: EFI and multiboot2 devlopment work for Xen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 22 Oct 2013 21:12:27 +0400
From:	Andrey Borzenkov <arvidjaar@...il.com>
To:	The development of GNU GRUB <grub-devel@....org>
Cc:	phcoder@...il.com, keir@....org, ian.campbell@...rix.com,
	Daniel Kiper <daniel.kiper@...cle.com>,
	stefano.stabellini@...citrix.com, linux-kernel@...r.kernel.org,
	ross.philipson@...rix.com, jbeulich@...e.com,
	boris.ostrovsky@...cle.com, xen-devel@...ts.xen.org,
	richard.l.maliszewski@...el.com, david.woodhouse@...el.com
Subject: Re: EFI and multiboot2 devlopment work for Xen

В Mon, 21 Oct 2013 23:16:24 +0200
Vladimir 'φ-coder/phcoder' Serbinenko <phcoder@...il.com> пишет:

> GRUB has generic support for signing kernels/modules/whatsoever using
> GnuPG signatures. You'd just have to ship xen.sig and kernel.sig. This
> method doesn't have any controversy associated with EFI stuff but at
> this particular case does exactly the same thing: verify signature.
> multiboot2 is mainly memory structure specification so probably how the
> files are checked is outside of its scope. But it's possible to add
> specification on how to embed signatures in kernel.
> 

I'm a bit skeptical here. Given that

- EFI secure boot will still be needed to handle Windows
- kernel can be launched directly as EFI application
- there are other bootloaders with secure boot support

distributions will likely need to carry on EFI secure boot support. At
which point it is not clear what advantages second, parallel,
infrastructure for the sake of single application will bring.

The most compelling reason would be allowing module loading (which is
currently disabled by secure boot patches).

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)