Linked by Thom Holwerda on Fri 22nd Jun 2012 23:17 UTC
Ubuntu, Kubuntu, Xubuntu After Fedora, Ubuntu has now also announced how it's going to handle the nonsense called "Secure" Boot. The gist: they'll use the same key as Fedora, but they claim they can't use GRUB2. "In the event that a manufacturer makes a mistake and delivers a locked-down system with a GRUB 2 image signed by the Ubuntu key, we have not been able to find legal guidance that we wouldn't then be required by the terms of the GPLv3 to disclose our private key in order that users can install a modified boot loader. At that point our certificates would of course be revoked and everyone would end up worse off." So, they're going to use the more liberally licensed efilinux loader from Intel. Only the bootloader will be signed; the kernel will not.
Permalink for comment 523453
To read all comments associated with this story, please click here.
RE: The solution[tm]...
by vaette on Sat 23rd Jun 2012 10:15 UTC in reply to "The solution[tm]..."
vaette
Member since:
2008-08-09

Making a signed bootloader that chainloads into an unsigned bootloader would break Secure Boot completely since malware makers would just install your signed bootloader and have it chainload into their unsigned malware (which in turn will set up various hooks then load the OS in a controlled way). This is also the reason why it seems improbable that Ubuntu will be able to do what they are planning to do, since loading a unsigned kernel amounts to chainloading. Malware makers will be able to use Ubuntus signed bootloader and have it launch what looks like an Ubuntu Linux kernel, but which is actually a small piece of malware that just installs hooks and then launches Windows, faking a secure boot.

Trusted Boot does not, as far as I can tell. Load sufficiently early, if a piece of malware manages to write to the MBR it will just refrain from running Trusted Boot and instead load the OS in an insecure way itself.

Edited 2012-06-23 10:16 UTC

Reply Parent Score: 3