4 ms·

Linux 6.9 Makes a Change to Satisfy Microsoft for EFI x86 Shim Loader Signing

37 points by mfiguiere 3y ago

bitwize 3y ago
Yet another reminder that PCs boot alternate operating systems only because Microsoft allows it for the time being.
- wmf 3y ago
  In the EU you can boot any OS you want. It's a little annoying to click through 15 "are you sure?" screens but it works.
- lmz 3y ago
  Reminder that PC hardware has multiple sources and even if it splits into Windows-booting and OtherOS-booting hardware, someone will probably sell you such hardware when the time comes.
  - SuperNinKenDo 3y ago
    Yes, but pretty much everybody got their start with Linux by installing it on a computer they already had and experimenting with it, whether it was the family computer, an old laptop, etc. If you start needing to buy specialist hardware before you can even try out something other than Windows, the barrier to entry and inertia this creates will mean less and less people ever even develop a desire to try it.
    - lmz 3y ago
      Older unlocked hardware will still be available. Also people still buy the Raspberry Pi anyway which doesn't even run Windows.
    - charcircuit 3y ago
      The barrier to use Linux is lower than ever and doesn't require installing a new base os. On Windows you can just install Ubuntu from the microsoft store or run "wsl --install"
      - josephcsible 3y ago
        Rather than think "use Linux", think "not use Windows".
  - smitty1e 3y ago
    Reminder that there are a finite number of chip fabs and, as challenging as it is for the Free Software Foundation, hardware is worse.
  - taskforcegemini 3y ago
    and then there will be software you depend upon that disallows OtherOS-booting hardware. tangential example: banking apps on non-google androids
- loeg 3y ago
  Consumers can just turn "secure boot" off.
  - jsheard 3y ago
    You can on x86 machines, but AIUI they require ARM machines that ship with Windows to have secure boot permanently enabled. That hasn't been much of a factor so far given the false starts that Windows ARM has gone through, but with Qualcomm set to launch their Apple M-series competitor soon it might start to actually matter.
    - throwaway345353 3y ago
      All of this is moot if essential services like government or banking require root of trust attestation that is only available on windows. New chips already have Microsoft's pluton core.
      - charcircuit 3y ago
        Which is why Linux distros should be investing heavily in security now so they can prove to manufacturers / Microsoft / the government that they are secure (compared to other consumer operating systems) to avoid a future like that.
        imglorp 3y ago
        It's pretty hard to compete with open source plus byte-reproducible builds for anyone serious about security. Not only is MS neither of those, it's also the premier malware target and a voracious surveillance instrument on its own.
        charcircuit 3y ago
        >compete with open source Open source doesn't necessarily imply it is secure. Security isn't free and open source projects can struggle funding such development. >byte-reproducible builds This is mostly a party trick. Meanwhile the system is one curl | sh away from having all its cookies stolen, files cryptolocked, mic spied on, keylogger installed, clipboard sniffed, etc. Reproducible builds can't save you from insecure design which my comment was referring to investing in fixing and is what this patch being highlighted in the article is doing. >it's also the premier malware target Having a large market share is why. If Linux overnight gained a ton of marketshare the malware situation would be worse than windows.
- Habgdnv 3y ago
  Don't say "alternate" like that! Have some respect. Windows is the most popular alternative OS to linux, right after macOS.
mise_en_place 3y ago
I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It does not bode well for user privacy.
- charcircuit 3y ago
  Blame the Linux project's workflow. It's hard to reason about because that patch is Linus merging 7 other patches together and you need to go read the mailing list archives if you want to look up more context about the changes. [0] https://lore.kernel.org/linux-efi/20240308085754.476197-7-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-7-ar... [1] https://lore.kernel.org/linux-efi/20240308085754.476197-8-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-8-ar... [2] https://lore.kernel.org/linux-efi/20240308085754.476197-9-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-9-ar... [3] https://lore.kernel.org/linux-efi/20240308085754.476197-10-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-10-a... [4] https://lore.kernel.org/linux-efi/20240308085754.476197-11-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-11-a... [5] https://lore.kernel.org/linux-efi/20240308085754.476197-12-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-12-a... [6] https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48DTdMyrC98eejj8KUxwGZSHWW8Q@mail.gmail.com/T/ https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48D... [7] https://lkml.org/lkml/2023/12/26/220 https://lkml.org/lkml/2023/12/26/220 [8] https://lkml.org/lkml/2023/12/26/218 https://lkml.org/lkml/2023/12/26/218
  - jauntywundrkind 3y ago
    Rather than blame the Linux patch process & iteration for obfuscating, I kind of want to throw the shade & nastiness at Microsoft for iterating security posture & requirements in a subtle way over time where it wasn't clear up front why Linux would need to leap through Gates' hoop of fire here. If it were crystal clear what the need being satisfied were, these patches would probably explain themselves.
    - 3y ago
deleted 3y ago
[deleted]
lostmsu 3y ago
TL;DR; Microsoft requires pages to be either writable or executable, but not at the same time in a certain scenario, which is actually a good practice.

37 points by mfiguiere 3y ago

bitwize 3y ago

Yet another reminder that PCs boot alternate operating systems only because Microsoft allows it for the time being.

wmf 3y ago
In the EU you can boot any OS you want. It's a little annoying to click through 15 "are you sure?" screens but it works.
lmz 3y ago
Reminder that PC hardware has multiple sources and even if it splits into Windows-booting and OtherOS-booting hardware, someone will probably sell you such hardware when the time comes.
- SuperNinKenDo 3y ago
  Yes, but pretty much everybody got their start with Linux by installing it on a computer they already had and experimenting with it, whether it was the family computer, an old laptop, etc. If you start needing to buy specialist hardware before you can even try out something other than Windows, the barrier to entry and inertia this creates will mean less and less people ever even develop a desire to try it.
  - lmz 3y ago
    Older unlocked hardware will still be available. Also people still buy the Raspberry Pi anyway which doesn't even run Windows.
  - charcircuit 3y ago
    The barrier to use Linux is lower than ever and doesn't require installing a new base os. On Windows you can just install Ubuntu from the microsoft store or run "wsl --install"
    - josephcsible 3y ago
      Rather than think "use Linux", think "not use Windows".
- smitty1e 3y ago
  Reminder that there are a finite number of chip fabs and, as challenging as it is for the Free Software Foundation, hardware is worse.
- taskforcegemini 3y ago
  and then there will be software you depend upon that disallows OtherOS-booting hardware. tangential example: banking apps on non-google androids
loeg 3y ago
Consumers can just turn "secure boot" off.
- jsheard 3y ago
  You can on x86 machines, but AIUI they require ARM machines that ship with Windows to have secure boot permanently enabled. That hasn't been much of a factor so far given the false starts that Windows ARM has gone through, but with Qualcomm set to launch their Apple M-series competitor soon it might start to actually matter.
  - throwaway345353 3y ago
    All of this is moot if essential services like government or banking require root of trust attestation that is only available on windows. New chips already have Microsoft's pluton core.
    - charcircuit 3y ago
      Which is why Linux distros should be investing heavily in security now so they can prove to manufacturers / Microsoft / the government that they are secure (compared to other consumer operating systems) to avoid a future like that.
      - imglorp 3y ago
        It's pretty hard to compete with open source plus byte-reproducible builds for anyone serious about security. Not only is MS neither of those, it's also the premier malware target and a voracious surveillance instrument on its own.
        charcircuit 3y ago
        >compete with open source Open source doesn't necessarily imply it is secure. Security isn't free and open source projects can struggle funding such development. >byte-reproducible builds This is mostly a party trick. Meanwhile the system is one curl | sh away from having all its cookies stolen, files cryptolocked, mic spied on, keylogger installed, clipboard sniffed, etc. Reproducible builds can't save you from insecure design which my comment was referring to investing in fixing and is what this patch being highlighted in the article is doing. >it's also the premier malware target Having a large market share is why. If Linux overnight gained a ton of marketshare the malware situation would be worse than windows.
Habgdnv 3y ago
Don't say "alternate" like that! Have some respect. Windows is the most popular alternative OS to linux, right after macOS.

mise_en_place 3y ago

I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It does not bode well for user privacy.

charcircuit 3y ago
Blame the Linux project's workflow. It's hard to reason about because that patch is Linus merging 7 other patches together and you need to go read the mailing list archives if you want to look up more context about the changes. [0] https://lore.kernel.org/linux-efi/20240308085754.476197-7-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-7-ar... [1] https://lore.kernel.org/linux-efi/20240308085754.476197-8-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-8-ar... [2] https://lore.kernel.org/linux-efi/20240308085754.476197-9-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-9-ar... [3] https://lore.kernel.org/linux-efi/20240308085754.476197-10-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-10-a... [4] https://lore.kernel.org/linux-efi/20240308085754.476197-11-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-11-a... [5] https://lore.kernel.org/linux-efi/20240308085754.476197-12-ardb+git@google.com/ https://lore.kernel.org/linux-efi/20240308085754.476197-12-a... [6] https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48DTdMyrC98eejj8KUxwGZSHWW8Q@mail.gmail.com/T/ https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48D... [7] https://lkml.org/lkml/2023/12/26/220 https://lkml.org/lkml/2023/12/26/220 [8] https://lkml.org/lkml/2023/12/26/218 https://lkml.org/lkml/2023/12/26/218
- jauntywundrkind 3y ago
  Rather than blame the Linux patch process & iteration for obfuscating, I kind of want to throw the shade & nastiness at Microsoft for iterating security posture & requirements in a subtle way over time where it wasn't clear up front why Linux would need to leap through Gates' hoop of fire here. If it were crystal clear what the need being satisfied were, these patches would probably explain themselves.
  - 3y ago

deleted 3y ago

[deleted]

lostmsu 3y ago

TL;DR; Microsoft requires pages to be either writable or executable, but not at the same time in a certain scenario, which is actually a good practice.