3 ms·
You usually can't run unsigned kernel modules if you have EFI secure boot turned on, depending on the way your distribution's kernel is configured.
by noodlesUK 3y ago
You usually can't run unsigned kernel modules if you have EFI secure boot turned on, depending on the way your distribution's kernel is configured.
- mort96 3y agoRight but then we're back to the "it's not my computer any more" problem. Disallowing me from running my own ring 0 code on my own computer isn't an acceptable trade-off.
- nequo 3y agoYou can opt in or opt out as you wish. You get to decide whether the added security of only allowing signed kernel modules is the right trade-off for you. Am I missing something here?
- mort96 3y agoIn cases where you can genuinely just flip a switch and get back proper access to the machine I don't mind it that much, but these "we must restrict the user for 'security' reasons" things usually don't stay like that forever.
- nequo 3y agoBut this is Linux so you can use a different distribution if your current distro is daft like that. Or do you mean that certain programs (like one mentioned by sibling) require the switch to be on?
- mort96 3y agoYeah, that's one of the ways these "optional" "security measures" often become non-optional. Android is a prime example of a system where this has already happened: sure, you can root your device (if your manufacturer allows you to), but none of the software you need. Another way is simply for the manufacturer to lock down the bootloader/BIOS and not let you disable "secure" boot, as is also common in the Android world.
- josephcsible 3y agoThat's what everyone said about TPM and Secure Boot, and now you can't, e.g., play Valorant without enabling both.
- ivlad 3y agoIf it’s me who disallowed “future me” (or someone pretending to be future me because my account was compromised) loading unsigned modules, I don’t see it as a problem.