3 ms·
Interesting. The question that immediately popped into my head was: How does the secure boot system determine the “security generation” of GRUB exactly? Sounds
by skywhopper 2y ago
Interesting. The question that immediately popped into my head was: How does the secure boot system determine the “security generation” of GRUB exactly? Sounds like just based on the assertion of GRUB itself (and trusted signature of the distribution that built GRUB)?
The fact that the list of allowed GRUB versions is itself manageable via a Windows Update points to some other issues with this particular security scheme, given Microsoft’s own recent history of mishandling private keys.
- dist-epoch 2y agoIt goes the other way too. An Ubuntu Update could put the Windows bootloader on the deny list.
- wolrah 2y ago> It goes the other way too. An Ubuntu Update could put the Windows bootloader on the deny list. I don't think this is generally true. Since most computers don't ship with Ubuntu's CA directly trusted their signed components rely on a chain of trust that goes up through Microsoft's 3rd party UEFI CA cert to their root. I don't know the specific details of UEFI's implementation but it seems incredibly unlikely that it'd allow a subordinate CA to sign an update that distrusts components upstream of it. If an OEM does ship Ubuntu's root or if a system owner has manually installed it then sure, but that's not the majority of systems.