Slashdot Mirror
Linux Foundation Offers Solution for UEFI Secure Boot
Ever since news broke last year that Microsoft would require Windows 8 machines to have UEFI secure boot enabled, there were concerns that it would be used to block the installation of other operating systems, such as Linux distributions. Now, reader dgharmon sends this quote from Ars Technica about a new defense against that outcome:
"The Linux Foundation has announced plans to provide a general purpose solution suitable for use by Linux and other non-Microsoft operating systems. The group has produced a minimal bootloader that won't boot any operating system directly. Instead, it will transfer control to any other bootloader — signed or unsigned — so that can boot an operating system."
The announcement adds, "The pre-bootloader will employ a 'present user'; test to ensure that it cannot be used as a vector for any type of UEFI malware to target secure systems. This pre-bootloader can be used either to boot a CD/DVD installer or LiveCD distribution or even boot an installed operating system in secure mode for any distribution that chooses to use it."
As per subject
This just got me thinking - can windows 8 run in as a virtual machine, in say, VirtualBox or VMWare player? Will current 'virtual' bootloaders be able to boot it?
I worry more about my inability to install Linux on an iPad...
My book: Friendly F#, fun with game development and XNA; my game: Galaxy Wars by VSTeam; my gamedev language: Casanova.
You target MS before Apple? That's like shooting at a vicious pomeranian nipping at your heels while a wolf is leaping for your throat.
"When information is power, privacy is freedom" - Jah-Wren Ryel
cause, no one else except for a small subset of geeks even care
To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots. In this way, it can't be silently installed and used to hand control to a rootkit without the user's knowledge
Doesn't this mean it is unsuitable for server use - or any "headless" operation such as MythTV?
Damnit you insightful bastard, I just spent my last mod point on another topic.
Yeah, you've beat them down from 97% of installs to 90% of installs. You've come so far in this fight. LOLzzz!!!
Anyone who uses Apple? You have nothing to worry about since the loss of marketshare that MS has suffered in the last 20 years is mostly due to Apple products.
Linux is teh failboat.
LF became slave of MS and now working under its decisions: "the Linux Foundation will obtain a Microsoft Key and sign a small pre-bootloader". Bad decision.
Never underestimate the dark side of the Source
The solution is simple. Simply do not purchase ANY computer that requires secure boot, or does not allow you do disable it!
Personally, I think this is a "feature" that is going to come back and bite MS in the derriere.. At least I hope so! :-)
When I turn on my PC, it will boot the pre-boot loader, which will then boot grub, which will then boot my initrd which will finally boot Linux. Can we put any more steps in there?
Give me Classic Slashdot or give me death!
That's funny. I've been dual booting OS X and Linux ever since the Intel transtion without any problems. Maybe it's because UEFI and Secure Boot are not the same thing.
That's ridiculous.. they're both wolves, just one is in really sexy sheeps clothing.
So far Apple only really care about and have control over their own products. Microsoft are trying to control everything else, which is something like 90% of general purpose PCs.
which is totally what she said
Maybe it's because UEFI and Secure Boot are not the same thing.
That is correct. AFAIK, Secure Boot is an optional feature of UEFI
I had a sig once. It was lost in the great storm of '09.
Apple is attacking the consumer's expectation of software freedom. You can't go any lower that that without a brain implant.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Linux is teh failboat.
Only if you measure it in terms of raw marketshare.
Personally I don't care much for the marketshare penis waving. Linux does me just fine, really it's the only OS I regularly use. Because it's not trying to pay 10,000 peoples salaries it wont got away even if the market share stays where it is.
This idea that linux needs to be on every machine is tiresome. It just needs to work for those who want to use it.
It's true. Someone said nobody except a small subset of nerds even cares. If all the developers who use MacBooks stopped buying them, it would be a big hit for Apple. Corporations would need to do it to get Microsoft's attention. Of course, Apple may not care at this point. You need a MacBook to develop for iOS, and that seems to be the only platform they really care about these days.
I'm ok with the concept of signed code at the hardware level, as long as keys can be totally maintained by the user.
I don't know enough about UEFI though to know what's required to sign binaries. Can Linux be signed? Can software from repositories be signed in a GPG kind of fashion?
If I have to enter a key in the BIOS and sign a kernel with a related key in order to install Linux, I could potentially live with that, and it actually might have a few security uses.
Your Scottish, aren't you?
(sorry, I have a friend who's a Scottsman who loves to make jokes about Scotts and sheep...)
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
This classic took Microsoft years to develop this technology and it takes the open source community less then a year I love the power of the open source community.
http://www.thetechnologygeek.org
I think it's worse than that.
Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Because you can compile with slightly different options and now the signature is different and won't boot. You can't sign the changes because the private keys allowed to sign are not given to you and the BIOS needs updating to accept any new ones, so expect to have to prove your existence and pay a LOT of money to get your keys added in to all the UEFI machines.
Boot sector viruses are the rarest form of virus, require root permissions to infect, and aren't especially hard to remove. And we've handed over a big chunk of freedom and made things worse for everyone to fight this minor annoyance (yeah right). This is worse than the computer equivalent of the PATRIOT act.
"When information is power, privacy is freedom" - Jah-Wren Ryel
No true Scottsman jokes about sheep.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
Your solution of any value mostly to newbies who are incapable of going to the BIOS and typing in a new signing key (yes, all BIOS manufacturers worth buying, like ASUS, offer this option). I, for one, will not purchase any computer without secure boot. I like having a trusted hardware root. I like the fact that no malware can get in the boot process without my consent.
Personally I don't care much for the marketshare penis waving. Linux does me just fine
Good thing I wasn't drinking anything when I read this... ;)
Install windows on my workstation? You crazy? Got any idea how much I paid for the damn thing?
Does this fix the Windows 8 ARM tablet problem?
Don't worry, I got it for you.
I suspect the vast majority of people who would be interested in your suggestion probably already pirate windows, if they use it at all. The negligible loss of sales you are promoting wouldn't even be an annoyance to MS.
Unfortunately, with the desktop losing a lot of ground, and that being the only really customizable platform (face it, DIY notebooks don't have nearly the variety of options, especially in the most important component - the motherboard), we won't see the option we would have seen a few years ago. Namely bios that will allow you to turn Secure Boot on or off. The vendors that cater to DIYers tend to be a lot more interested in the segment of the market you are discussing.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
And also points out that the vicious pomeranian is taking advantage of the situation by adding insult to injury picking on your heels when you've already got your hands ful dealing with the wolf.
Don't cut the pomeranian any slack just because the wolf happens to be bigger.
Pardon the pun, but dogpiling on someone already under attack is a pretty cheap tactic.
Okay, it's a bit weird that I'm defending Apple here, but before the iPhone most people didn't even install apps on their phones. I did personally, but Apple actually increased people's expectations of their phones. Yes they keep a tight reign on their market, but for those people who actually care, there is Android. I have 3 Android powered devices that I use regularly, and I much prefer them to the Apple alternatives.
Most people don't care about software freedom, and never have. There is no "expectation" from anyone apart from us geeks.
Also I just RTFA and I saw this:
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
This is completely different to what I'd expected after the anger and fear that I've seen here over the Secure Boot thing. It sounds like just another BIOS option. Anyone who wants to try out Linux probably also is aware how to edit BIOS settings. Or they can use a VM if they want to take the easiest route, that will presumably completely bypass Secure Boot too.
which is totally what she said
so we put bootloaders in your bootloaders.
Yo dawg!
I heard you like boot loaders. So we put a boot loader in your boot loader so you can boot up while you boot up!
If we make it, we can break it. Making secure boot just more locks to keep honest people out and more headaches for honest people to deal with.
Perhaps the real question here is why do people continue with Windows, when there are other options that have better general security?
Comment removed based on user account deletion
Why are you fighting secure boot? Secure boot is a GOOD thing. Making sure your BIOS/UEFI and boot loader haven't been tampered with is a GOOD thing. Let's figure a good way to make Linux work with it. I'm glad that Microsoft is taking this attack vector seriously.
And what exactly compels microsoft to add this key ?
Or add it and fsck it up so that it 'just happens to fail sir' ?
And then when this is "addressed" by making it not possible to turn off AT ALL, you now have a sanctioned monopoly of Windows Only PCs. Again.
Now, if this happens, you're STILL in a problem. Why are viruses so "bad"? Because they take your data and delete it. Well if I am the virus writer and I already HAVE your computer, you've already lost. If you are worried about your personal information being taken, if I have your computer then Secure Boot doesn't secure the disk drive from being read and you've already lost.
So what, precisely, does the scare of "what's to stop me installing a compromised version of Windows?" got to do with this if you need to be sitting at the keyboard to install a compromised version of Windows?
I'm Scottish, and it's written Scotsman/Scots by the way.
Anyway, back to the topic at hand; I have to say that I don't know what you're talking about. I'd say that at least 80% of sheep aren't that sexually attractive.
which is totally what she said
Yeah, great. How are non-MS operating systems going to use this mechanism for remotely initiated booting, as in WOL? Does that mean non-MS shops will have night shift "specialists" on-site to press the Any Key whenever required?
Seems to me that MS has finally given Linux the boot :-(
I like my spaghetti with source.
The purpose of Secure Boot is to prevent people from booting non-Microsoft operating systems.
Why on earth would Microsoft sign such a bootloader?
Anyone want to open an over/under line on when this happens?
I'll put $100 on the first patch Tuesday following the heat death of the universe.
That's like saying way back in the 90's, people didn't tend to install a lot of applications from the internet onto their PCs.
While true of the average user, the reason was people didn't know WHERE to find the stuff, or it just involved a little more work than people were willing to put into it (This coming from a guy who used Lycos and AltaVista... and who downloaded a I forget what game or game demo from HappyPuppy on a 2400 baud modem. The file was about a meg and a half if I recall and it took into the night to download, but at some point the modem got disconnected so I had to start all over).
You could argue AOL, CompuServ, Prodigy, etc were the "Apple" of the day, as it made it easy for people to find news, games, etc vs what the web was offering up at the time. It's not that the web didn't have it (or BBSes), but you had to be able to find it.
Oh, so you're saying the other 20% are asking for it by dressing that way?
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
Also I just RTFA and I saw this:
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
The only problem I have is the layman will not want to "make their computer insecure by disabling secure boot" which only serves to stigmatize alternative OSes as the insecure option while Windows is viewed as "more secure."
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
To address this, the Linux Foundation bootloader will present its own splash screen and require user input before it actually boots.
That seems like a LOT more of a pain in the butt than simply turning off the secure boot option. In fact, it would be a deal breaker for any of my Linux machines that must be able to reboot unattended every time. It's a "solution" to a trumped up problem. There are plenty of legit reasons to hate Microsoft, but this isn't one of them.
The bottom line: UEFI secure boot is not going to be enabled on any machine shipping with Linux unless that distro has the keys themselves. That is most likely the only group of Linux users not savvy enough to change a single setting in the firmware. If someone builds their own p.c. it won't have secure boot enabled. If someone decides to replace the MS os they paid for with Linux, it's not even slightly unreasonable to think they would be capable of changing the necessary firmware setting.
Every linux distribution I've EVER tried including the "easy" ubuntu is more complicated to install than changing this setting would be. Silliness...plain and simple.
Apple is building /their/ product and trying to get everyone to adapt their needs to it. At least MS is trying to make it's product general purpose (if ineptly in some cases), and allow people to have options at every level except the OS. Apple tries to restrict options at ALL levels.
One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products : people use it by choice, and are free to use alternatives. Maybe a few persons use a Mac at work because their company enforce it, plus of course the iOS developers.
In contrast, millions (billions?) of persons use Windows and Office because they have to (company policy) or because they need to produce Office documents.
"Although Microsoft's stipulations require also that x86/x64 systems provide an option to disable Secure Boot"
MS has to allow people to install other OSes in the x86 market. If you thought anti-trust over IE was bad, you'd love to see what happens if MS tried to lock down all computer systems with Windows installed.
They can get away with it in the ARM market because MS is ~1% or less of the market in that space, so they have absolutely zero monopoly power there.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
Give me Classic Slashdot or give me death!
I'm not forced to buy or use MS products any more than Apple products.
Actually, given all the peripherals made for Apple mobile products (with their different-from-everyone-else connectors), and not for their competitors, I feel more pressure towards buying Apple than towards buying MS.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
Sounds like a possible good-bye to automatic and unattended linux booting (like wake-on-LAN, timer based booting, etc...)
One huge difference between Apple and Microsoft is that nearly nobody is forced to buy or use Apple products
Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents? Would you rather live in the Apple "Cupertino controls your entire experience" world or the "Build on top of our platforms to do what you want, just don't muck directly with the licensed software" world of Microsoft?
Wouldn't a simpler solution just be to allow the end-user to sign his bootloader?
Once the boot loader is signed, it's trusted until the next time the system is reinstalled.
The idea is, if something replaces the bootloader, it needs to be re-signed by the user. The process of signing could be convoluted and long enough to keep a user from just blindly clicking "sign" (require special boot media, or a jumper to be set on the motherboard).
This will provide all the security benefits of UEFI secure boot, while retaining the user's control of the system.
I won't use anyone's binary blob, even if it is signed by Microsoft and distributed by the FSF. You Asshats are supposed to stand up for Free Software, bending over to MS and enabling the hardware manufacturers to shrug off pressure from end user complaints by giving them this release valve is BAD. Fuck you all, Each and every one.
...now we have to deal with a dummy/shell of a bootloader, which boots the real bootloader, before the OS will even be told to start booting? Come the fuck on--something needs to be done about this, because this is just bullshit. We shouldn't be forced into such unnecessary extra complexity to use our computers that we bought, just because some shitty crooked company decided they want to make everything that runs *their* (read: almost everything) insecure OS a locked-down fortress with the "claim" (hint: yeah, right) that it is being used specifically to stop the spread of malware. There has to be a better solution. Until then, it looks like I will have to stick with x86 machines unfortunately, as much as I would like an ARM-based laptop, until something good is released without Windows... er, I mean, without these restrictions. The Windows tax was bad enough; now we're paying in the form of our freedom to use our computers in the way we want. Thanks, Microsoft. Cocksuckers.
Okay, so what happens when millions (billions?) of persons use OS X and iTunes because they have to (company policy) or because they need to product iWhatever documents?
The same problems as we have today with Microsoft, yes. But we are still a very looooooong way from that.
I'm not forced to buy or use MS products any more than Apple products.
Lucky for you. But many people have a job and no choice.
where is the windows 7 UEFI boot loader?
More worryingly, what about when the "security companies" start promulagting the idea that "best practice" is to have secure boot enabled? Many of the security companies make money from the insecurity of Windows, so it is in their interest to make it more difficult to run Linux.
The real "Libtards" are the Libertarians!
Apple builds its own hardware. If they want to secure boot it or lock you into their walled garden, that's their prerogative.
Microsoft doesn't. They are not telling you what you can or can't run. They are telling hardware vendors. Specifically ARM based systems. And they are doing so in a manner that will decrease the value of ARM based hardware.
You might think that Microsoft has created a Windows vs Linux (Android, whatever) distinction on ARM. But who is to say that Windows 9 will get a different boot key than Windows 8? And then again for Windows 10, etc. Microsoft can now jerk the ARM platform manufacturers around any way they want. Maybe even issue a service pack that needs a new boot key and brick all older hardware platforms overnight. The owners of these platforms won't be able to say, "Screw it. I'll just install Ubuntu." The resale value of that hardware will be zero.
ARM just got pwned.
Have gnu, will travel.
Why is it so hard to put every device key in escrow and provide an automated and simple process that allows a user to individually unlock their own device? This escrow could also provide a signing service for any dists on neutral and fair terms that allowed them to replace the bootloader. A locked bootloader is desirable in some regards but it should not be under the control of a single OS vendor.
mmm, I tend to view microsofts actions in the arm market as indicative of what they would do in the x86 market if they thought they could get away with it.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
How does something like this get modded up? This is factually not true, and nothing but Apple haters spreading fud.
Apple is attacking the consumer's expectation of software freedom.
The mass market consumer product can have tens of millions, hundreds of millions of users --- and in the case of the Windows PC, a billion or more users --- who quite clearly don't give a s***t about "software freedom" as the geek understands it.
Every time I buy a laptop, I am _forced_ to buy M$ windows which I have _never_ used.
This, for the last 20 yrs. = real money, going to a company whose shite products, I have never fucking used.
Yeah, a bit bitter.
Apple is another (evil) company I don't choose to do business with-- at least with Apple, I have the choice.
Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
Wouldn't everyone also include Apple? How is Microsoft pushing this on Apple hardware?
My company is trying to help Microsoft capture that 0% market share. We're spending tons of resources writing and debugging UEFI to do it. While the rest of the company is making boat loads of cash making Android devices.
oh no, 50% of the remaining aren't the proper gender. 80% of sheep buggerers are straight you know....
I repeat it again, If you want to secure the bios put a jumper before the write pin of the eprom/flash memory/whatever. Those who can't open the case and locate it are surely not qualified for a bios upgrade.
It simply does not work that way. Especailly on ARM phones and tablets. Most vendors support secure ROM which is hard wired in the chip and requires a signed bootloader to proceed. Usually the vendor just offers a fake bootloader (or a fuse bit) that can then run uboot or whatever so you can get ChromeOS or Android up on the device.
For UEFI, the UEFI firmware itself is signed, and the AP(application processor, another word for CPU) will refuse to boot. There ain't shit you can do about it without replacing the AP.
It's not FUD. if a phone or tablet maker wants to have ARM Windows, they will be required by a licensing agreement to enable all of these security features from the processor vendor. And it will be nearly impossible for a non-technical person to run a free OS on them in a general way. Each device will have to be hacked and exploited in a unique way.
And I really doubt enough models will be compromised early enough to make running Linux on a cheap Windows ARM netbook a practical thing. Unless this ChromeOS thing catches on, you simply won't have a way to do a Linux ARM netbook in the next few years. (Android keeps resisting Netbooks, they don't sell very well).
It sucks to be a Linux user that has to piggy-back on hardware industry for a more popular OS. It sucks worse when Linux gets locked out of the hardware access we have been taking for granted.
Just turn secure boot off FFS. You are able to disable it. If you're going to go through all the trouble to use this work around, what is the actual benefit to the system anymore? Just turn it off.
I have a cure, if for some reason I get a PC with windows 8 on it I am gonna reformat the HDD and install windows 7, because windows 8 sux.
>Apple's policies only affect Apple hardware. Microsoft is pushing this on everyone.
Bullshit. "Everyone" being x86 compatible motherboards that were specifically engineered by OEMs to comply with the published Windows hardware standard. The fact that Linux happens to run on those motherboards doesn't mean anyone's automatically entitled for that happy state of affairs to continue. People are more than welcome to build their own Linux-specfic motherboards using whatever processors they want, e.g. Raspberry Pi.
How so? No hardware manufacturer is required to put a "Designed for Windows 8" sticker on the hardware they sell, and it's not illegal to install (or, indeed, even preinstall) Win8 on such hardware.
Apple has supported UEFI since the first release of the MacBook Pro back in 2006. It took about 4 months after that until *APPLE* released a means to boot other operating systems. That method (bootcamp) doesn't require any signed bootloaders or anything. In fact, the whole process can be done manually if you don't want to use the Apple-provided tool.
Please stop conflating UEFI with SecureBoot. They're two different things. It's like complaining that your engine sucks because the valve stems on your tires leak.
It's so obvious that Microsoft is practicing it's monopoly here, why, oh WHY are there no lawsuits?. I would gladly pitch in to stop the company I hate more than any other.
No.
This policy only affects a subset of Windows PCs.
PCs which were built for other OSes are not affected. Remember all those netbooks runnings Linux? You know how Dell sometimes produces Linux laptops? You remember how Walmart sold a Linux desktop? None of those would be affected.
Stop lying by saying that Microsoft somehow controls all the non-Apple hardware. If Linux fans spent more time improving Linux and less time bitching about Windows, then maybe there would be a bigger market for Linux boxes and manufacturers would produce more of them.
Sorry, that test fails my usability test. Any hardware manufacturer that wants to sell me a motherboard that requires I use this can stick their motherboard. I for one have no interest in a device which can never be rebooted remotely and can never bring itself back automatically after a power failure.
In the Intel case this is no more difficult than setting the BOIS date/time, or boot order, this is NOT the ISSUE ... It is the intended lock in in the ARM market, and these days it is much easier to beat M$ at their own game, just complain to Joaquín Almunia who has succeeded the redoutable Dr Nellie Kroes.
After another few billion EURO fines Balmer will fling another chair, and give in.
MFG, omb
Is this how Sheeple are made?
I don't give a damn about all this secure boot bullshit, do you have any idea how many decades I've wanted a bootloader bootloader that can boot from cd or usb? For years now, I've had to swear at fucked up BIOSes that couldn't boot from CD to install or couldn't boot from USB. Most recently (~5 years ago) I had a 1U server that I had to open up and hook up an IDE cdrom in because in an effort to save $30 I ordered it without a CD drive and ASSumed the BIOS could boot from a USB cdrom drive I had sitting around. With something like this, I could have dropped the drive in another machine to add the bootloader or installed the bootloader on a floppy or something and spared a LOT of headaches over the years dealing with shitty BIOSes.
Now most of the BIOSes do pretty well, even with USB cdroms, so I don't know that I'll ever need this, but man, if this had been around back then...
You choose to buy a laptop running Microsoft. You can find some laptops (system76, etc...) that comes with Linux pre-installed. Now, get off my lawn!
Tomorrow is another day...
How about an HTTP link. GIT can do that.
now we need to go OSS in diesel cars
Frickin' useless for home servers and the like.
> Why on earth would Microsoft sign such a bootloader?
Probably as there are monopoly/anti-trust implications if they don't.
Also FatPhil on SoylentNews, id 863
...Or just refuse to purchase any computer, motherboard, or other product that supports UEFI.
If enough people vote with their money, manufacturers will provide the option.
You target MS before Apple? That's like shooting at a vicious pomeranian nipping at your heels while a wolf is leaping for your throat.
Aah--so you're aware of the horrible abuses of police power in America to kill 'vicious' puppies...
No it is not. Wherever did you get this idea from!
(gosgog)
Seems to me that some new neck bearded geek just past coding exams and dreamed up this one...ultimately that means a future lifetime career as a member of that undistinguished well known group...CONGRESS! Where they are always trying to pass ridiculous laws.... or like Obama...the ultimate Yoyo, they use EXECUTIVE ORDER.
Linux owns every single market except desktop and the market for those is slowing shrinking.
In the very general market of computing device, MS is the bit player.
Since when is there Apple "hardware"
Apple is an OEM(think Dell but with a good OS) and gadget maker.
All are built COTH.
Let me guess, you put together your own desktop and now you think you can build hardware?
I have a job and a choice. I use Microsoft where it's appropriate, Linux where appropriate, and I could, if I wanted to, add BSD or Apple in there.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).