lkml.org 
[lkml]   [2017]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown
On Tue, Nov 14, 2017 at 12:31 PM, Matthew Garrett <mjg59@google.com> wrote:
>
>> This is all theoretical security masturbation. The _real_ attacks have
>> been elsewhere.
>
> People made the same argument about Secure Boot, and then we
> discovered that people *were* attacking the boot chain. As we secure
> other components, the attackers move elsewhere. This is an attempt to
> block off an avenue of attack before it's abused.

The thing is, if you have attested the system from boot, then you've
already attested the firmware before it even gets loaded.

And if you haven't, then you can't trust anything else anyway.

So I really don't see your point.

Linus

\
 
 \ /
  Last update: 2017-11-14 21:36    [W:0.168 / U:2.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site