Slashdot Mirror
Matthew Garrett Makes Available Secure Bootloader For Linux Distros
TrueSatan writes "Matthew Garrett, formerly of Red Hat, is providing a shim bootloader that will allow installation/booting of secure boot enabled computers. The shim is designed to chain boot GRUB (Grand Universal Bootloader) without the need for a distribution to obtain a key from Microsoft. Garrett asks that further contacts regarding the shim be made to him and not to Red Hat as he no longer works there and they may not have knowledge of the product."
I'm really proud of him and I really hope that there is no ensuing lawsuit for violating some sort of propitiatory BS.
Can anyone explain me like I am 5, how this must be working? Or speculate?
Some apps are WYSIWYG. Some others are WYSIWTF.
Kudos for Matthew Garrett!
Will someone one please clarify for me if we will always be able to buy computers without a securebootloader, or will I have to deal with this shit sometime down the road. Thanks!
The man delivered! I really hate not being able to use GRUB or some other bootloader anymore. Why the heck can't I choose what to install on the computer I bought with my own money? Imagine you were Linux Torvalds trying to write your own operating system but in a computer with UEFI enabled.
The way to get the key is also particularly weird. It's like Microsoft has gone out of their way to make it so you need to use Windows to get a key. .CAB files, Silverlight applications, .exe to generate a key, etc.
You can't even choose not to enable UEFI anymore. I bought a 3 TB hard disk recently and the BIOS isn't able to see anything above 2 TB on a non-UEFI system without GPT partitions.
So, Garret has created a boot loader shim that doesn't require signing, that then chainloads a bootloader that finally loads the OS or chainloads another bootloader?
1. How does this shim work without being signed? Clearly he's found a weakness in secure boot that he is exploiting.
2. If vulnerabilities exist that permit unsigned exploits, what's the point of secureboot? (Rhetorical)
3. If this is an exploit, how long will it be before the vulnerability is fixed and this shim is worthless?
I find it disappointing that instead of actively fighting secure boot and making a BIG PUBLIC STINK about it and embarrassing everyone involved in implementing this, the community is aquiescing to the concept and "working with it."
Stallman is right, guys, and anyone endorsing Trusted Computing 2.0 by either actively participating in the distribution of it, or tacit approval needs to be publicly humiliated and embarassed into doing the right thing.
Secure boot was never about protecting the end user.
--
BMO
I happen to have a computer with Secure Boot enabled by default. Matthew Garrett's boot loader doesn't work while Secure Boot is enabled. The reason being that the machine will not (repeat not) boot from any device except the hard drive unless Secure Boot is first disabled. The steps to load any OS, with or without Secure Boot support, goes like this:
Enter into UEFI control panel.
Disable Secure Boot
Enable Legacy boot options
Enable specific Legacy device, such as DVD drive
Save settings and reboot.
Change boot device to DVD
If Secure Boot is turned on, "Legacy" devices can not be used to boot the computer. Therefore having this boot loader doesn't do any good on machines with Secure Boot enabled. It has to be turned off just to access the installation media.
Or else he'll post ad-hominem personal attacks about you on his blog. He is the sole reason I migrated away from Fedora to Ubuntu/Debian.
-- Linux user #369862
What's the point of secure boot, if you can just use this bootloader to boot anything you want?
Computers that ship with Windows 8 for x86 or x86-64 must ship with Secure Boot turned on but (importantly) must ship with a way to turn it off.
With a UEFI Secure Boot that requires a Microsoft signed key, how does one generate a self-signed key that works?
By setting Secure Boot to custom mode and installing the self-signed key. Microsoft requires makers of x86 and x86-64 PCs to allow neutering Secure Boot as a condition for Windows 8 certification, just like Google requires a device to have Android Debug Bridge open as a condition for access to the Google Play Store. The strict game-console-style lockdown is only for Windows RT.
Microsoft requires OEMs shipping Windows 8 to provide both options for the user to turn secure boot off completly AND for the user to install new keys of their choice.
The other half of the truth is that on ARM devices, Secure Boot is ABSOLUTELY REQUIRED
And the gripping half is that the operating system for devices with an ARM CPU is not called Windows 8. It is called Windows RT (for 10" screens) or Windows Phone 8 (for 4" screens).
An ARM laptop running Linux
Is manufactured by ASUS, under its Transformer brand.
Why shouldn't I be able to put Linux or any other OS compiled for ARM on an ARM machine?
Do you feel entitled to put Linux on, say, a Nintendo DS family product?
Why do I have to supplicate and offer $$ to Redmond, from where I did not acquire the OS?
If you don't want money going to Microsoft, don't buy a Surface RT, Xbox 360, Lumia, or any of its other locked down hardware.
And here's to hoping coreboot renders UEFI obsolete someday!
Easier to install? Hardly. Its nearly identical. Don't tell me complicated windows gave you problems. This is just like the V chip inside every tv manufactured for the last 20 years. Must it be enabled for your tv to operate? No.
Only the State obtains its revenue by coercion. - Murray Rothbard
Not sure I understand this fully, but I guess a rootkit changes the windows kernel in such a way that the signature becomes invalid, and so the UEFI refuses to load the windows kernel - is that right? So I presume the only way a rootkit can circumvent this is to either not change the kernel, or to re-sign it with the correct key. Have I got this right?
D
I hope that this whole Secure Boot issue pushes more people to buy computers with Linux (or whatever other open system) pre-installed. Even if you need to dual boot, buying a copy of windows that's not pre-installed is reasonably cheap nowadays. Buy a free-as-in-speech laptop and install Windows as the secondary OS. This would be in contrast to the old days where you'd generally get windows pre-installed (because it was cheaper that way) then install Linux later.
Censorship is the opposite of education. If neo-darwinism were defensible, people would not need to try and censor ID.
The OP points out that MJG has left Redhat... but it doesn't mention where he's gone. Shortly after implementing SecureBoot, locked module loading, and the signed kernel and getting it released in Fedora 18 MJG has left RedHat to work at _Microsoft_. Surprise!
How about the shim running a real bootloader ... instead of some software stack that's trying to be an OS ... ?
now we need to go OSS in diesel cars
As I understand UEFI, the BIOS (UEFI) will refuse to load any software that has not been signed with a key that it (the BIOS) knows about.
So far the only company that has the clout to force the h/w manufacturers to install their key, is Microsoft.
So for the shim to run, it would have to be signed by MS, so that when the UEFI is asked to run it, the shim comes back as validly signed.
Have MS agreed to sign the shim?
If so, could they revoke their signature if they don't like the way the shim is being used?
pgmer6809
Did they mandate what steps must be used in order to [disable Secure Boot]?
Nor does Microsoft mandate what steps must be used to switch the PC's boot order from HDD first to the more malware-prone USB first, yet people switching to GNU/Linux work around that somehow. And will it be that hard to go to Bing* and type in the computer maker followed by disable secure boot ?
* Let me give Microsoft the benefit of the doubt here.
As long as Microsoft makes available downgrade rights to Windows 7, Microsoft has to support PCs that don't have Secure Boot. So "for now" could be a very long time, long enough for Chrome OS to mature, for Android to gain support for multiple windows on the screen, and for things like the recently funded PengPod to gain traction.
Current hardware trends suggest that, going forward, many/most laptops and replacements will be ARM-based. It's not a ferocious stretch to assume that, at least initially, Dell, ASUS, etc. will want to also ship those "laptops" with Windows as well
Right now people expect to run desktop applications on laptops. Windows RT runs exactly two desktop applications: IE and Office. So unless Microsoft allows selling desktop applications through the Windows Store, I don't see in which direction Microsoft plans to take Windows RT for the traditional laptop form factor.
Moreover, since new keys can't be added to ARM devices this sort of shim would mean having to confirm you wanted to boot an untrusted OS *EVERY* time you reboot
Would it be any more trouble than existing dual boot scenarios, where the user has to pick Windows or GNU/Linux from the GRUB or Boot Camp menu?
or wake from hibernation.
I thought tablet operating systems only went to suspend, not hibernation. Hibernation is intended to restore the state of multiple applications, and tablet operating systems generally don't support multiple applications' windows on the screen.
And (thinking long term) what happens if MS finds itself in a position of eventually having dominated the ARM "serious computing" market as well (which is now the vast majority of "computers"), and simply refuses to sign any further shims? [...] *Maybe* civilian governments could put the screws to MS to coerce them into backing down
What could happen is serious legal trouble, even if only in the European Union, which has shown itself willing to put the screws to Microsoft. Is Microsoft willing to exit the EU market over this, especially as the EU market grows larger than the NAFTA market?
For starters I'm sure Red Hat, Canonical, etc. make a point of verifying that their signed shims all come back completely unmodified, right?
A signed work is just the concatenation of the unsigned work, the hash of the work encrypted with the signer's public key, and optionally a certificate chain from the root down to the signer. If portion of the signed work representing the unsigned work is identical to the original unsigned work, then Microsoft hasn't added a time bomb.
Twitter means both a microblog service and a Slashdot personality known for pro-GNU/Linux, anti-M$ sockpuppetry. APK means both an Android application packaging format and a Slashdot personality known for promotion of hosts files as a component of Internet security. And now BMO means both the public bug tracker of Firefox and a Slashdot personality known for accusing people of astroturfing for Microsoft. Why do names have to be so overloaded?
After all you code to the API, not the device
For one thing, you code to the device when trying to get your system requirements down to those of the device that your target market owns. For another, Windows RT lacks a publicly accessible API for overlapping windows; applications are instead expected to use the "modern UI" widgets.
Yes. When I turn on my laptop it defaults to booting into Linux, I only have to respond to the multiboot menu if I want to use Windows instead.
Some people have their bootloaders configured the opposite way.
you get much the same effect if you run all your programs in fullscreen on a desktop.
On a desktop window manager, I can and do choose to unmaximize an application's window and show multiple windows in a tiled or overlapping configuration. The current tablet operating system's window managers deny me that choice.
Multiple programs are still running, all that's changed is the way you switch between them.
True, I can be providing keyboard and mouse input to only one application at a time, the one with focus. But with a tiling window manager, I can switch between the output of one application and the output of another application by moving only my eyeballs. It'd be handy to put Chrome on one half and ColorNote on the other, so that I can refer to a web page while taking notes.
As for hibernation - when your battery inevitably dies (quite often while you're not using it)
By "dies" in this sentence, do you mean "needs to be recharged", or do you mean "no longer holds a charge and needs to be replaced"?
your options are only that or lose any unsaved work
Or have the application auto-save when it loses focus, which is the norm on tablet operating systems.
If MS somehow managed to install a kill switch, how brave do you think the EU would be in the face of an ultimatum like "You let us off with a slap on the wrist, or we shut down 80% of the computers in your Union"?
A lot of organizations in the EU have switched to GNU/Linux, and should Microsoft do something that causes the EU not to want to do business with Microsoft anymore, these organizations will have the market.
oh, and that should be encrypted by their *private* key, the public key is used for decryption
Oops, my bad.
I agree with you that "But other kids do it; therefore that justifies it" is wrong. What I was trying to say was more along the lines of "But other kids do it; therefore avoid Windows RT devices like you avoid those other kids."
And my point is that as a whole, the locked bootloader has done plenty of harm (so many kids vandalizing things) but no demonstrable good.
The origin of this in home entertainment products can be traced to a recession in the North American video game market starting around 1983, as store shelves were flooded with hastily produced cash-ins like E.T. Toy retailers realized Sturgeon's Revelation, and in the fourth quarter of 1985, Nintendo wanted to reassure retailers carrying the NES that its third-generation console would not suffer from the same problem as the products on the market at the time. This led to the CIC, a matched pair of microcontrollers in the NES Control Deck and Game Paks that would continuously verify a pseudorandom stream, and to the digital signature in Atari 7800 cartridges.
Just because Microsoft has to support PCs that don't have secure boot doesn't mean they can't force machines that do to be Microsoft only.
UEFI can't tell that Windows 7 is a Microsoft operating system because Windows 7 doesn't carry a UEFI Secure Boot signature. Therefore, end users exercising downgrade rights will have to turn off Secure Boot to use Windows 7. And the page about downgrade rights implies that downgrade rights appear to cover the last two major versions: Windows 8 licensees can downgrade to 7 or Vista, and Windows 7 licensees can downgrade to Vista or XP. So Microsoft will more than likely allow end users to turn off Secure Boot until Windows 9 is no longer available, and that page states: "Note that end user downgrade rights will be available through the sales life cycle of Windows and Windows Server operating systems, which is up to two years after the launch date of a new version." So companies concerned about the Secure Boot problem have until two years after the launch of Windows 10 to plan their migration to hardware with a drawing of a penguin on the box. This could be seven or eight years from now.
The Windows 7 downgrade option can end tomorrow
From the page about downgrade rights: "Downgrade rights are an end-user right, documented in the Software License Terms that customers accept upon first running Windows software." If the Software License Terms are in fact a contract, then they bind Microsoft just as much as they bind the end user.
Because Microsoft owns the license. They can change the terms at will.
Consideration was exchanged: the customer gave Microsoft money in exchange for a copy of a program and a license to decrypt its installer. I was under the impression that this formed a contract that binds both parties.