Hi everyone,<br><br>Update on secure boot from the Melbourne Free Software mailing list.<br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Chris Samuel</b> <span dir="ltr"><<a href="mailto:chris@csamuel.org" target="_blank">chris@csamuel.org</a>></span><br>
Date: 31 May 2012 16:43<br>Subject: [free-software-melb] Draft Fedora plan to cope with Secure Boot on x86 hardware<br>To: Melbourne Free Software Interest Group <<a href="mailto:free-software-melb@lists.softwarefreedom.com.au" target="_blank">free-software-melb@lists.softwarefreedom.com.au</a>><br>
<br><br>Hi all,<br>
<br>
Matthew Garrett has just posted a draft plan on how Fedora 18 plans to<br>
cope with Windows 8 certified x86 hardware that has Secure Boot<br>
enabled in EFI.<br>
<br>
<a href="http://mjg59.dreamwidth.org/12368.html" target="_blank">http://mjg59.dreamwidth.org/12368.html</a><br>
<br>
Basically it involves signing up with Microsoft, paying a $99 one-off<br>
fee and then getting them to sign a boot shim that will boot Grub2<br>
that has been signed by a Fedora key. Then it has to be signed code<br>
all the way down to user space, so no loading out-of-tree drivers,<br>
filesystems or other modules, either FLOSS or proprietary (and<br>
certainly not a custom kernels) whilst Secure Boot is enabled.<br>
<br>
For those who've not come across what this means, he has a nice<br>
summary:<br>
<br>
# Secure boot is built on the idea that all code that can touch the<br>
# hardware directly is trusted, and any untrusted code must go through<br>
# the trusted code. This can be circumvented if users can execute<br>
# arbitrary code in the kernel. So, we'll be moving to requiring<br>
# signed kernel modules and locking down certain aspects of kernel<br>
# functionality. The most obvious example is that it won't be possible<br>
# to access PCI regions directly from userspace, which means all<br>
# graphics cards will need kernel drivers. Userspace modesetting will<br>
# be a thing of the past. Again, disabling secure boot will disable<br>
# these restrictions.<br>
#<br>
# Signed modules are obviously troubling from a user perspective.<br>
# We'll be signing all the drivers that we ship, but what about out<br>
# of tree drivers? We don't have a good answer for that yet. As<br>
# before, we don't want any kind of solution that works for us<br>
# but doesn't work for other distributions. Fedora-only or<br>
# Ubuntu-only drivers are the last thing anyone wants, and this<br>
# really needs to be handled in a cross-distribution way.<br>
<br>
<br>
Interestingly he also shows that you can use Secure Boot to ensure<br>
that your system will only be able to boot Fedora (etc) and never boot<br>
a proprietary OS:<br>
<br>
# A system in custom mode should allow you to delete all existing keys<br>
# and replace them with your own. After that it's just a matter of<br>
# re-signing the Fedora bootloader (like I said, we'll be providing<br>
# tools and documentation for that) and you'll have a computer that<br>
# will boot Fedora but which will refuse to boot any Microsoft code.<br>
# It may be a little more awkward for desktops because you may have<br>
# to handle the Microsoft-signed UEFI drivers on your graphics and<br>
# network cards, but this is also solvable. I'm looking at ways to<br>
# implement a tool to allow you to automatically whitelist the<br>
# installed drivers. Barring firmware backdoors, it's possible to<br>
# configure secure boot such that your computer will only run software<br>
# you trust. Freedom means being allowed to run the software you want<br>
# to run, but it also means being able to choose the software you<br>
# don't want to run.<br>
<br>
<br>
Interesting times!<br>
<br>
cheers,<br>
Chris<br>
<span><font color="#888888">--<br>
Chris Samuel : <a href="http://www.csamuel.org/" target="_blank">http://www.csamuel.org/</a> : Melbourne, VIC<br>
<br>
This email may come with a PGP signature as a file. Do not panic.<br>
For more info see: <a href="http://en.wikipedia.org/wiki/OpenPGP" target="_blank">http://en.wikipedia.org/wiki/OpenPGP</a><br>
</font></span><br>_______________________________________________<br>
Free-software-melb mailing list<br>
<a href="mailto:Free-software-melb@lists.softwarefreedom.com.au" target="_blank">Free-software-melb@lists.softwarefreedom.com.au</a><br>
<a href="http://lists.softwarefreedom.com.au/mailman/listinfo/free-software-melb" target="_blank">http://lists.softwarefreedom.com.au/mailman/listinfo/free-software-melb</a><br>
<br></div><br>