oss-security - Re: Plug-and-wipe and Secure Boot semantics

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121219163459.GA24439@kroah.com>
Date: Wed, 19 Dec 2012 08:34:59 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Plug-and-wipe and Secure Boot semantics

On Wed, Dec 19, 2012 at 10:20:12AM +0100, Florian Weimer wrote:
> On 12/19/2012 06:39 AM, Greg KH wrote:
> >>The Fedora 18 TC3 installer boots on the machine mentioned above, in
> >>the factory default configuration.  Previous installer versions
> >>showed a Secure Boot error message.  I've run into an installer bug,
> >>though:
> >><https://bugzilla.redhat.com/show_bug.cgi?id=888232>
> >
> >Previous versions of Fedora 18 betas didn't have a valid signed
> >bootloader to allow anything to be installed, are you sure it's all
> >properly built now?
> 
> Yes, or the UEFI implementation on the box is buggy.  It could not
> boot the installer before, but now it can.
> 
> >But, more on-topic, how does UEFI secure boot have anything to do with
> >this mailing list?
> 
> Aren't vendors basing their implementation on the open-source code
> from Intel?  Or are you referring to the fact that Secure Boot has
> little to do with security?

We don't know what vendors are basing their UEFI bios implementation on
the open source version, I know there is at least one UEFI bios that is
not based on the open source version, or so it is reported (the BSD
license of Tianocore means that we will never really know.)

Determining what machine is running what bios from what company that was
based on what version of the open source UEFI implementation is going to
be a huge problem in the long run and something that I sure don't want
to have to track.

There have been reported bugs in the Tianocore in the past, I don't
think they were "security" issues in and of themselves, should we be
reporting them here to get CVE numbers if they are?

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.