Slashdot Mirror
Systemd Getting UEFI Boot Loader
New submitter mrons writes: Many new features are coming for systemd. This includes the ability to do a full secure boot. As Lennart Poettering mentions in a Google+ comment: "This is really just about providing the tools to implement the full trust chain from the firmware to the host OS, if SecureBoot is available. ... Of course, if you don't have EFI SecureBoot, than nothing changes. Also if you turn it off, than nothing changes either. [sic]" Phoronix notes, "Gummiboot is a simple UEFI boot manager that's been around for a few years but only receives new work from time-to-time. Lennart and Kay Sievers are looking at adding Gummiboot to systemd to complete the safety chain of the boot process with UEFI Secure Boot. Systemd will communicate with this UEFI boot loader to ensure the system didn't boot into a compromised state."
Many features
In the bloat
Off to FreeBSD
In a safety boat
burma shave
CLI paste? paste.pr0.tips!
Just wait. One of these days I expect to read, "Systemd to get Emacs editor."
This is an evil ploy to prevent freedom-seeking users from trying Windows 10 alongside Systemd OS.
Trust chain. Systemd. Amusing.
Maybe it's time to switch back to paper tape boot loader, or better yet, toggling it in. That would be more secure, and most importantly, more reliable. I've had it with all the security bullshit being added. Just more frustration for the end user.
Yes, UEFI is still an evil misguided thing.
But let's make the best of the situation.
Just over four months ago, I updated my Debian testing workstation. To keep a long story short, systemd was installed, and my workstation basically got trashed. It no longer booted properly, and none of my attempts to fix it worked. I used a livecd to perform one final backup.
I proceeded to install FreeBSD 10. In hindsight, I wish I had done this years ago. FreeBSD has worked almost perfectly for me. The installation was fast and actually quite simple. All of the open source software I used to use under Debian is available and easily installed. ZFS is amazing. My system feels faster than it ever did before. It has yet to crash even once, unlike Debian and Linux, where I'd get a kernel panic around once a month. The upgrade to FreeBSD 10.1 went very smoothly, with almost no effort on my part.
I used to be disturbed by the recent degradation of the Debian project. But now I no longer care. Since moving to FreeBSD, I have no need for Debian. Debian is basically dead to me now. If it dies as a project, I don't care. FreeBSD does everything I need, and it does it better than Debian and Linux ever did.
Good riddance, Debian. Good riddance, Linux. Good riddance, systemd. All of them are failures compared to FreeBSD.
This was the only piece that was missing from systemd.
I'm sure now all of the growth will end and the community will start rallying around systemd.
Hmm, is that hell freezing over outside?
With Lennart Poettering and Kay Sievers lol. 2 of the most untrustworthy and two faced developers in the Linux world.
Something isn't quite right here
I for one have been waiting for the promise of a UEFI bootloader for some time, but as an avid Systemd fan I can't help but wonder when Pottering and the team are going to get off their lazy asses and implement a systemd version of the Kernel. The Kernel (linux, ganoo, whatever) is old, inefficient, and can be handled much better by systemd. dmesg is a confusing command too. to replace it in systemd you would just issue a simple systemctl service engage geiss wobble manager=1 --upchuck --lasermode /var/tmp/var/eng/lib/lib64/service/svc/portal/optimized/Skernel.wrapper to get the same data converted from a binary disk image into real text, imaginary text, a full color background, and a chart-topping indie song (--noyuke to remove yukelele) Its really quite simple and I dont understand why linux makes such a fuss about their old fashioned kernels.
Good people go to bed earlier.
Systemd is the one project that has the potential to exceed the reach of Emacs. All they really need to do is to include a lisp interpreter and we could eliminate the need for installing emacs altogether.
Alex, I'll take keybindings not used by Emacs for $400....
Can be used for good or evil. Depends if control is in the hands of the hardware manufacturers or the users.
When will Systemd get 3D printing capabilities?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
The Systemd Consortium of Uber-Masters (SCUM) is proud to announce the finalization of it's acquisition of the NSA. Hot on the heels of absorbing the CIA and FBI, Vice Chancellor Lennart Poettering had this to say: ".. this brings us one step closer to our ulitimate goal of reducing complexity for the common man."
... a great many new contributors to BSD :)
I apologize for the lack of a signature.
After the systemd fiasco what are people moving to mostly?
3-4 naysayers? More like the majority of the linux community. As for a new init process, sure , there's room for *improvement*. Systemd is not an improvement - its a bug ridden overly complex dogs dinner that is one mans ego trip being ridden roughshod through the whole linux/unix principal of KISS and do one thing well. Now you might not give a stuff about that principal but most of us do and we do not want to see this POS being installed by default.
This is quite the common tactic in some places. So much so that islamists have a word for it: taqiyya.
No, I'm not saying you should grow a beard and start wearing a tent, go ass-in-the-air on a mat five times a day offering praise to the prophet poettering. I'm saying your words employ a tactic that's been used before, to the point that there's a word for it.
The only thing missing was kitchensinkd!
A couple of the items were interesting (i.e. ntp-lite). I think the biggest take-away from this is that in the very near future every 'application' will be its own container. While this has some very good merits I am not sure how I feel about it. Cautiously optimistic?
As a server admin I hate systemd and all of its hell-spawn, but as an end-user i like some of these features.
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
Too much effort to cover an attack vector that is rarely used in practice. Even if you consider it a move against modders/free platforms it's still a geeky waste of time to stop something that is a niche activity and matters little for anyone's bottom line.
Just an honest question.
Certainly this does not have to be part of systemd to work, just like udev did not have to be part of systemd to work.
So why?
Here's what sure looks like Mr Poettering's plan going forward:
1. Expand systemd to the point where large swaths of everything depend on it, so that he is controlling as much of the code base as possible.
2. Insult Linus Torvalds for a while to try to undermine his authority.
3. Fork Linux, or demand that Linus give control of Linux over to him, or he will rage-quit and take his code with him.
His goal doesn't seem to be great code (given the number of times he's screwed up big time), or great design (given that he seems to ignore everything Thompson, Ritchie, etc said about how Unix should work). It sure seems to be about becoming the Grand High Poobah of the open source world, without any idea what that actually takes.
What he doesn't understand is that Linus is in charge because other open source developers genuinely respect his judgment. If Linus was doing a lousy job in his role, there would be calls for Alan Cox or someone else who's been in the inner circle forever to take over, and Linus might actually step aside. If, on the other hand, you're running around insulting everyone for no good reason, you're not going to have the respect of other developers, and they will quite happily shunt you aside, forking systemd if necessary to get rid of you, and life will go on.
Lovely to see how the systemd bunch has gone from a political movement to a religious cult in mere months, starting when it became painfully obvious they had run out of arguments shortly before.
Just look at this presentation, where a presenter dares to suggest that some people don't want Gnome, and then Lennart construes this (immediately) as an attack on handicapped people or people who don't speak English. I'm not exaggerating at all - as soon as someone even suggests doing things a different way, he'll just jump up and say, 'you must hate handicapped people.'
In fact, this is exactly how Debian has turned now that it's been taken over by his cronies. Anyone who even dares to go against him and Gnome gets insta-banned.
It's just a simple and very extreme case of playing the victim: pretending he's done nothing wrong and claiming all kinds of discrimination and personal attacks when people criticize him, even if they're just saying that they don't want to use systemd or whatever clusterfuckery he's come up with most recently.
I've said it before and I'll say it again - Poettering and Co. are the new Steve Jobs Klan of open source, and we need immediate action to get rid of his influence. Everything he's doing for the Free Software community is bad and he should be excommunicated permanently.
First of all, UEFI is more than Secure Boot. UEFI has been standard on PCs for the past few years, and on Macs ever since they switched to x86. Secure Boot is just a feature of some newer UEFI implementations.
Second, Secure Boot is a legitimate security feature that helps to protect against boot-time malware. There's nothing inherently evil about it. The controversy is over who should have the power to decide which OS is considered trustworthy and allowed to boot: the owner of the computer, or the vendor of the OS that came preinstalled on the computer?
Naturally, you don't want to buy a computer that doesn't let you choose which OS you trust. But if you have a computer that does give you that choice, why not take advantage of it? Seems to me that it's good to have hardware vendors see increased demand for machines that support securely booting the OS of your choice, as opposed to those where you just have to disable Secure Boot entirely if you want to run something other than Windows.
Probably someone who hasn't discovered --no-install-recommends yet.
If I have been able to see further than others, it is because I bought a pair of binoculars.
In Windows, it's not unheard of that a piece of malware with sufficient access interjects itself where the next boot will be picked up before the OS has a chance to set up it's own protection. Of course my complaint is that this vector would have easily been sidestepped without a huge firmware mess. If the OS set up access to that area as very very very very special, requiring signed code within the OS to modify that section of the platform, then the problem would have been solved. .
Sorry, but no. If you knew anything about threat modelling and OS design, you would know that code running at a trust level cannot protect against other code running with the same trust. The x86 architecture does have 4 levels, but for a number of reasons (mostly portability) practically no OSes use more than 2 levels (rings): protected/kernel and user mode.
What you are proposing is using a 3rd ring - something more privileged than kernel mode. This would constitute a major architectural redesign and would trash portability/compatibility with other architectures.
The fact is that UEFI Secure Boot is a very effective mechanism for blocking boot sector infections. As Windows has grown ever more resilient against permanent infections (app/driver signing, checksum tables, strong named assembly cache etc) malware authors were forced into infecting at an earlier stage of the boot process, if they wanted to take up permanent residence.
The OS kernel mode MUST have the capability to write all sectors of the disk. It can effectively block usermode apps from writing such sectors, but if kernel mode driver contains a vuln, rogue code can bypass any security mechanisms enforced by the kernel. It can just jump to the address efter the security check or control the IO itself.
Bootkits exists for Wndows. It was a real threat. A few unscrupolous individuals (lookng at you Garett) chose to instigate a FUD campaign, deliberately misrepresenting facts and knowlingly failing to correct misunderstandings when they advanced their case.
And you are still part of that.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*