Date: Tue, 5 Jun 2012 17:00:14 -0400 (EDT) From: Daniel Feenberg <feenberg@nber.org> To: Polytropon <freebsd@edvax.de> Cc: Kurt Buff <kurt.buff@gmail.com>, FreeBSD Questions <questions@freebsd.org> Subject: Re: Is this something we (as consumers of FreeBSD) need to be aware of? Message-ID: <Pine.GSO.4.64.1206051653120.5642@nber6> In-Reply-To: <20120605203717.5663bdf7.freebsd@edvax.de> References: <CADy1Ce7MihpmMowc265%2BS_RKorMO3KEKsCgr=pdnjg2jzq-dYQ@mail.gmail.com> <20120605203717.5663bdf7.freebsd@edvax.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 5 Jun 2012, Polytropon wrote: > On Tue, 5 Jun 2012 11:19:26 -0700, Kurt Buff wrote: >> UEFI considerations drive Fedora to pay MSFT to sign their kernel binaries >> http://cwonline.computerworld.com/t/8035515/1292406/565573/0/ > > I may reply with another link: > http://mjg59.dreamwidth.org/12368.html > I have a pretty basic question that probably displays some ignorance... Does the loader need to be signed? Once signed, can it load anything, or just things MS has approved? If MS signs the kernel, can the kernel run anything, or just things MS has approved? If RH has a signed kernel, do they have to sign all the userland programs that run under that kernel? Can users sign programs compiled from source? If MS only has to sign the first link in the chain, then the $99 certificate is not really a problem except for the pure of heart. If MS or someone else has to sign all the way down to the userland binaries, then users of FreeBSD will have to turn off secure boot in CMOS, and it will lose a few users. But I can't tell from the discussions mentioned above. Either way, I don't think it will destroy FreeBSD, or Linux, but I would be interested anyway. Daniel Feenberg
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.GSO.4.64.1206051653120.5642>