Linux 6.9 Makes a Change to Satisfy Microsoft for EFI x86 Shim Loader Signing

https://www.phoronix.com/news/Linux-6.9-EFI-Updates

by mfiguiere • 2 years ago

37 27 2 years ago

bitwize• 2 years ago

Yet another reminder that PCs boot alternate operating systems only because Microsoft allows it for the time being.

wmf2• 2 years ago

In the EU you can boot any OS you want. It's a little annoying to click through 15 "are you sure?" screens but it works.

lmz2• 2 years ago

Reminder that PC hardware has multiple sources and even if it splits into Windows-booting and OtherOS-booting hardware, someone will probably sell you such hardware when the time comes.

SuperNinKenDo• 2 years ago

Yes, but pretty much everybody got their start with Linux by installing it on a computer they already had and experimenting with it, whether it was the family computer, an old laptop, etc.

If you start needing to buy specialist hardware before you can even try out something other than Windows, the barrier to entry and inertia this creates will mean less and less people ever even develop a desire to try it.

smitty1e• 2 years ago

Reminder that there are a finite number of chip fabs and, as challenging as it is for the Free Software Foundation, hardware is worse.

taskforcegemini• 2 years ago

and then there will be software you depend upon that disallows OtherOS-booting hardware.

tangential example: banking apps on non-google androids

loeg• 2 years ago

Consumers can just turn "secure boot" off.

jsheard• 2 years ago

You can on x86 machines, but AIUI they require ARM machines that ship with Windows to have secure boot permanently enabled. That hasn't been much of a factor so far given the false starts that Windows ARM has gone through, but with Qualcomm set to launch their Apple M-series competitor soon it might start to actually matter.

Habgdnv• 2 years ago

Don't say "alternate" like that! Have some respect. Windows is the most popular alternative OS to linux, right after macOS.

mise_en_place• 2 years ago

I'm not sure when booting a computer became so complicated. Reasoning about this patch is near impossible unless you know the inner workings of EFI and TPM. It does not bode well for user privacy.

charcircuit6• 2 years ago

Blame the Linux project's workflow. It's hard to reason about because that patch is Linus merging 7 other patches together and you need to go read the mailing list archives if you want to look up more context about the changes.

[0] https://lore.kernel.org/linux-efi/20240308085754.476197-7-ar...

[1] https://lore.kernel.org/linux-efi/20240308085754.476197-8-ar...

[2] https://lore.kernel.org/linux-efi/20240308085754.476197-9-ar...

[3] https://lore.kernel.org/linux-efi/20240308085754.476197-10-a...

[4] https://lore.kernel.org/linux-efi/20240308085754.476197-11-a...

[5] https://lore.kernel.org/linux-efi/20240308085754.476197-12-a...

[6] https://lore.kernel.org/linux-efi/CAMj1kXEoLOshENQO=RjQRq48D...

[7] https://lkml.org/lkml/2023/12/26/220

[8] https://lkml.org/lkml/2023/12/26/218

jauntywundrkind• 2 years ago

Rather than blame the Linux patch process & iteration for obfuscating, I kind of want to throw the shade & nastiness at Microsoft for iterating security posture & requirements in a subtle way over time where it wasn't clear up front why Linux would need to leap through Gates' hoop of fire here.

If it were crystal clear what the need being satisfied were, these patches would probably explain themselves.

lostmsu• 2 years ago

TL;DR; Microsoft requires pages to be either writable or executable, but not at the same time in a certain scenario, which is actually a good practice.

Linux 6.9 Makes a Change to Satisfy Microsoft for EFI x86 Shim Loader Signing

Related Stories