On Tue, 2014-06-10 at 08:20 -0400, Josh Boyer wrote: > On Tue, Jun 10, 2014 at 11:48:14AM +0300, Dmitry Kasatkin wrote:
> > Also I want to discuss here Fedora UEFI patches as they are the reason for > > the these original patchset. > > > > http://pkgs.fedoraproject.org/cgit/kernel.git/tree/modsign-uefi.patch > > > > They provide functionality to specify MokIgnoreDb variable to limit loading > > of > > UEFI keys only from MOK List, while ignoring DB. This is certainly a good > > functionality. But once MODULE_SIG_UEFI is enabled, it looks there is no way > > to prevent loading keys from UEFI at all. And this might not be a good > > default > > functionality. Someone might want not allow loading of keys from UEFI unless > > kernel parameter is specified to allow it without recompiling the kernel > > and disabling MODULE_SIG_UEFI. > > > > Josh, why such design decision was made? > > IIRC, it's because kernel parameters can be added programmatically from a > remote user if they gain root access. Having a kernel parameter to > disable a key piece of secure boot isn't all that great. We disable > other kernel parameters like acpi_rspd as well. In this case, there shouldn't be a problem as the kernel parameters would further limit the keys usage. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
