3 ms·
Note that UEFI doesn't mean supporting most of those. UEFI without runtime UEFI variable writes is a thing, and that configuration is incompatible with mokutil
by my123 7mo ago
Note that UEFI doesn't mean supporting most of those.
UEFI without runtime UEFI variable writes is a thing, and that configuration is incompatible with mokutil.
- westurner 7mo agoFWIU, There is no SecureBoot without UEFI. UEFI without SecureBoot does have advantages over legacy BIOS with DOS MBR. > UEFI without runtime UEFI variable writes is a thing Which vendors already support this? Do any BIOS - e.g. coreboot - support disabling online writes to EFI? (with e.g. efibootmgr or efivar or /sys/firmware/efi) One of the initial use cases for SecureBoot is preventing MBR malware. What there be security value to addding checksums or signatures as args to each boot entry in grub.cfg for each kernel image and initial ramdrive? Unless /boot is encrypted, it's possible for malware to overwrite grub.cfg to just omit signatures for example.
- my123 7mo ago> Which vendors already support this? One implementation I've seen in the wild is: https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide/SD/Bootloader/UEFI.html#miniuefi-support https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide... Secure Boot is still supported in that configuration, but with PK/db/dbx being part of the firmware configuration and updating them requiring a UEFI capsule update.
- westurner 7mo agoLooks like UKI include the initrd in what EFI checks the signature of. Add signature checking for grub.cfg (instead of just the EFI shim) but that requires enrolling a local key Add initrd signatures to grub.cfg