Language Selection

English French German Italian Portuguese Spanish

Why UEFI secure boot is difficult for Linux

Filed under
Linux

I wrote about the technical details of supporting the UEFI secure boot specification with Linux. Despite me pretty clearly saying that this was ignoring issues of licensing and key distribution and the like, people are now using it to claim that Linux could support secure boot with minimal effort. In a sense, they're right. The technical implementation details are fairly straightforward. But they're not the difficult bit.

Secure boot requires that all code that can touch hardware be trusted

Right now, if you can run unstrusted code before the OS then you can subvert the OS. Secure boot gives you a mechanism for making sure you only run trusted code, which protects against that. So your UEFI drivers have to be signed, your bootloader has to be signed, and your bootloader must only load a signed kernel. If you've only booted trusted code then you know that your OS is safe. But, unlike trusted boot, secure boot provides no way for you to know that only trusted code was executed. That has to be ensured by OS policy.

Rest here




More in Tux Machines

Android Leftovers

Fedora 22 Coming Next Tuesday and Converting Users

At the Fedora release Go/No-Go meeting last night it was determined that three bugs were serious enough to violate the release readiness criteria. As a result, the Final was blocked and a second Go/No-Go was scheduled for today. The results of that meeting are in! Elsewhere, Jack Germain said, "Simplicity Linux is easy to use and runs fast" and Swapnil Bhartiya shared his secret to converting users to Linux. Read more

What If Ubuntu Touch Would Support Android Apps?

Because it is a new platform, the main problem is that it does not have a lot of applications yet, despite the fact that it has a big and active community, the community-driven apps are not enough. Read more

Q4OS Linux Distro Will Allow Users to Purchase Apps via New Software Center

On May 22, Softpedia was informed by the developer of Q4OS, a small distribution of GNU/Linux that uses the old-school KDE3 desktop environment and was designed for low-end computers, that the distro reached version 1.2.2. Read more