3 ms·
On some Lenovo machines (x86) deleting the key database can brick the machine. So while you can technically do it in practice you can't.
by goosedragons 4y ago
On some Lenovo machines (x86) deleting the key database can brick the machine. So while you can technically do it in practice you can't.
- still_grokking 4y agoThis sounds worrisome. Could you explain more? How can this brick a machine?
- goosedragons 4y agoSome pieces of firmware on the machines are signed by the same keys in the secure boot database. Deleting the keys ends up blacklisting the firmware and so now the machine can't start up correctly because it no longer trusts hardware it needs to work.
- usr1106 4y agoDo you have a reference? Deleting the key database can not be done programmatically (unless UEFI has a bug). In all machines I have looked it's an option in the BIOS. So that should be clear case of warranty repair. Which of course does not help you if you do it after warranty has ended.
- goosedragons 4y agohttps://forums.lenovo.com/t5/ThinkPad-T400-T500-and-newer-T-series-Laptops/Own-secure-boot-keys-on-T14/m-p/5069436?page=1 https://forums.lenovo.com/t5/ThinkPad-T400-T500-and-newer-T-... It's an option in the UEFI.
- usr1106 4y agoThanks for the link. I guess it remains unclear whether it was a firmware bug that has since been corrected or whether it depends on how exactly the user installs their own keys. The reply the UEFI itself would be signed and if you delete the matching keys from the relevant DB UEFI would no longer start does not sound right to me. Good the see that the option exists for AMD, too. I guess AMD had no dominating market share when secure boot was introduced. So they would probably not be legally obliged to provide it? Hopefully market power of those requiring independence of Microsoft is big enough to keep it that way.