|
|
|
| Authored by: Anonymous on Tuesday, July 03 2012 @ 03:21 PM EDT |
Lessay I have a box that has SecBo and only the MegaUpSofT
(MUST) private key. If you have a bootable thing that is
signed with the MUST key you can boot it.
So lessay I use Fegora which has a bootable binary signed
with the MUST key. I can boot Fegora as distributed, and
the kernel (plus, through a [TBD1] mechanism, other files)
can be verified by the box's bootloader. So Fegora boots
and Fegora runs.
I want to modify Fegora to change the spin of a given
spinlock. However, the file that implements the spin change
needs to be signed, and I (naturally) do not have the Fegora
Private key.
So I generate a key pair (call that My-Authorization-Keys,
MAK) in a well-defined [TBD2] format. I then use either the
[TBD3] BIOS-resident Private Key Loader or a (signed) piece
of code running under Fegora to insert that into the BIOS'
key store, and reboot.
Now if I get it well, when checking that specific files are
properly signed, the BIOS checks against all the keys in its
store, in turn. So it tries to load initrd: checks against
MUST, passes; and so on. When it is asked to check my
spinchange file, checking against MUST fails, but checking
against MAK passes, so all is well.
I have no idea of the details of [TBDn|0<n<4], but the above
is about the only way this signing nightmare may work with
user-based updates.. Naturally, MUST doesn't care about
user-provided updates, so the scheme above is unnecessary.
As it's unnecessary for MUST, it is most likely not
implemented that way.
However, the Canonical method actually boots a small,
single-file secondary boot loader, which they do not expect
will need be changed by the user. So, as far as this code
is concerned, they will expect to be the sole providers. In
essence, unless Canonical provides a signing service for
that specific code, that code has been Tivoized by the
definition of the secure boot system. So, unless that
signing service exists, the code must not be GPLv3.
Now, the coed implements ... a boot loader, which needs to
be able to handle user-originated changes: so it implements
something along the lines above, where all components loaded
by that "secondary" loader can be signed by a user-provided
key and can be under GPLv3.
...
Nothing is ever simple.
[ Reply to This | Parent | # ]
|
|
|
|
|
