3 ms·
Presumably in that case you'd also want the kernel to fail loudly when it isn't booting securely. Say you enable lockdown but somehow manage to misconfigure sec
by Doxin 9y ago
Presumably in that case you'd also want the kernel to fail loudly when it isn't booting securely. Say you enable lockdown but somehow manage to misconfigure secure boot, You'd much rather have the kernel go "oh whoops I've got lockdown enabled but I wasn't booted securely" than to boot the kernel insecurely without notice.
And just like that it stops being a magically enabled thing and becomes something you have to either have fully on or fully off.
- Jasper_ 9y agoOne would hope your system would complain loudly in the BIOS if Secure Boot wasn't on regardless of the operating system. If some malware manages to misconfigure Secure Boot, it can also patch your kernel to remove the complaining.
- mjg59 9y agoThe kernel isn't able to determine whether you booted in a verifiable manner in all cases, so there's functionality that allows the bootloader to make that decision rather than the kernel. But if you don't have a verified boot environment and someone is deliberately attacking you, it's easy for them to fake up your early boot environment such that the kernel believes it's booted securely even if it hasn't been. If you want to protect against accidents then you can do that in userspace. There's no need for the kernel to be involved.