3 ms·
No, the specification is not against user freedom. "Always Execute" is not against the spec. "Query User" is partially broken, so it's not even that useful. If
by dawidpotocki 4y ago
No, the specification is not against user freedom. "Always Execute" is not against the spec. "Query User" is partially broken, so it's not even that useful. If you use a bootloader, you will only be able to confirm booting of the bootloader, you won’t be able to confirm the OS that it starts. You will get the dialog, but the input won’t work.
MSI did not add any of these features, they are available in EDK II.
https://github.com/tianocore/edk2/blob/9ce09870e721efacc41fa7ee684e9e299f120350/SecurityPkg/SecurityPkg.dec#L267-L278 https://github.com/tianocore/edk2/blob/9ce09870e721efacc41fa...
- Conan_Kudo 4y agoAt one point, I would have agreed with you. But Microsoft and Intel have been strong-arming implementations to reduce or eliminate user freedom over the past few years. It's been a sad state of affairs.
- Randor 4y agoThe modes "Allow Execution" at 0x2 and "Query User" at 0x5 are both documented in the UEFI security spec.