Language Selection

English French German Italian Portuguese Spanish

Why UEFI secure boot is difficult for Linux

Filed under

I wrote about the technical details of supporting the UEFI secure boot specification with Linux. Despite me pretty clearly saying that this was ignoring issues of licensing and key distribution and the like, people are now using it to claim that Linux could support secure boot with minimal effort. In a sense, they're right. The technical implementation details are fairly straightforward. But they're not the difficult bit.

Secure boot requires that all code that can touch hardware be trusted

Right now, if you can run unstrusted code before the OS then you can subvert the OS. Secure boot gives you a mechanism for making sure you only run trusted code, which protects against that. So your UEFI drivers have to be signed, your bootloader has to be signed, and your bootloader must only load a signed kernel. If you've only booted trusted code then you know that your OS is safe. But, unlike trusted boot, secure boot provides no way for you to know that only trusted code was executed. That has to be ensured by OS policy.

Rest here

More in Tux Machines

Chrome Remote Desktop is used on Deepin 15 for remote assistance

If you’ve installed the latest pre-stable edition of Deepin 15 (Deepin 2015), which I just wrote about earlier today (see Deepin 15. This could be the best Linux desktop distribution of the year), a module you’ll find in the Control Center, is Remote Assistance. Read more

Itty bitty ARM module starts at $27

Variscite’s rugged, 50 x 25mm “DART-6UL” COM runs Linux on an i.MX6 UltraLite SoC, offers NAND, eMMC, and wireless, and starts at $27 in volume. In April, Variscite announced the world’s smallest i.MX6 computer-on-module with its 50 x 20mm, Freescale i.MX6-based DART-MX6. At 50 x 25mm, the DART-6UL doesn’t quite match those dimensions, but it offers greater power efficiency, making it well suited for IoT applications and battery-powered devices. Variscite claims it consumes only 5mA in suspend mode. Read more