Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #16980

Re: EUFI and LIVE CD/USB issues

Show all headers | View raw

Arkadiusz Drabczyk <arkadiusz@drabczyk.org> writes:
> On 2016-03-14, Roger Blake <rogblake@iname.invalid> wrote:
>> On 2016-03-14, T <T@invalid.invalid> wrote:
>>> I think I need to look for "secure boot" and disable it.  But,on the
>>> last HP $400 pieces of ..., I don't believe there was that option.
>>
>> Unless it's changed that was supposed to be a required part of the secure
>> boot spec for x86.

It still is.

> I am not sure if this was clarified in the spec but apparently MS has
> their own view on that matter.  As this
> https://en.wikipedia.org/wiki/Windows_10 wikipedia article says:
>
> "Unlike Windows 8, OEMs are no longer required to make Secure Boot
> settings user-configurable, meaning that devices may optionally be
> locked to run only Microsoft-signed operating systems."
>
> They cite this article:
> http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

That’s a presentation, not a specification, though for some reason it’s
popular to cite it instead of the actual specification, which requires,
among other things:

| On non-ARM systems, the platform MUST implement the ability for a
| physically present user to select between two Secure Boot modes in
| firmware setup: “Custom” and “Standard”. Custom Mode allows for more
| flexibility as specified in the following:
|
| * It shall be possible for a physically present user to use the Custom
|   Mode firmware setup option to modify the contents of the Secure Boot
|   signature databases and the PK. This may be implemented by simply
|   providing the option to clear all Secure Boot databases (PK, KEK,
|   db, dbx), which puts the system into setup mode.
|
| * If the user ends up deleting the PK then, upon exiting the Custom
|   Mode firmware setup, the system is operating in Setup Mode with
|   SecureBoot turned off.
|
| * The firmware setup shall indicate if Secure Boot is turned on, and
|   if it is operated in Standard or Custom Mode. The firmware setup
|   must provide an option to return from Custom to Standard Mode which
|   restores the factory defaults. On an ARM system, it is forbidden to
|   enable Custom Mode. Only Standard Mode may be enabled.

I don’t know UEFI secure boot well, but my understanding is that PK is
the trust anchor, making the ability to change or remove it sufficient
to boot anything you like.

-- 
http://www.greenend.org.uk/rjk/

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

EUFI and LIVE CD/USB issues T <T@invalid.invalid> - 2016-03-12 21:02 -0800
  Re: UEFI and LIVE CD/USB issues Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2016-03-13 11:28 +0100
  Re: EUFI and LIVE CD/USB issues Arkadiusz Drabczyk <arkadiusz@drabczyk.org> - 2016-03-13 19:37 +0000
    Re: EUFI and LIVE CD/USB issues T <T@invalid.invalid> - 2016-03-13 18:37 -0700
      Re: EUFI and LIVE CD/USB issues Roger Blake <rogblake@iname.invalid> - 2016-03-14 02:51 +0000
        Re: EUFI and LIVE CD/USB issues Arkadiusz Drabczyk <arkadiusz@drabczyk.org> - 2016-03-14 08:09 +0000
          Re: EUFI and LIVE CD/USB issues "Carlos E.R." <robin_listas@invalid.es> - 2016-03-14 10:29 +0100
          Re: EUFI and LIVE CD/USB issues Richard Kettlewell <rjk@greenend.org.uk> - 2016-03-14 10:41 +0000
      Re: EUFI and LIVE CD/USB issues The Natural Philosopher <tnp@invalid.invalid> - 2016-03-14 10:01 +0000
        Re: EUFI and LIVE CD/USB issues dlbendigo  <laidlaws@hotkey.net.au> - 2016-03-15 08:42 +1100

csiph-web