Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2

http://www.phoronix.com/scan.php?page=news_item&px=MTEyNDY

by pwg • 14 years ago

156 135 14 years ago

Looks like all the distributions are going to be signed with the MS key.

In which case, would it not be worth clubbing together to have a root key manager, who can take the place of MS in signing packages?

fl3tch• 14 years ago

You mean like a CA? Of course they could do that, but then it wouldn't be Windows Certified (it would just be Somebody-Else Certified), which is how OEMs want to brand their products. This is all about dealing with Microsoft's hegemony.

Albuca• 14 years ago

I agree. It looks like all the Distro's will have to jump on the bandwagon so to speak in order to be used by the new Windows 8 boxes.

Then in this case, why are all the distro's having to shell out to get a licence key from Microsoft? I know of a lot of small distro's that dont produce any income, and pay for their webspace out of their own pocket. Why are we going to force them to purchase a key to allow their distro to run on a Windows 8 box?

AndrewDucker3• 14 years ago

If they don't want Secure Boot then the user can turn it off.

If they do want secure boot then it needs to be signed by _someone_, and none of the Linux distributors have been willing to step forward and be that someone.

jroll• 14 years ago

Does this mean it might be possible to install Ubuntu on ARM devices preloaded with Windows 8?

abrowne• 14 years ago

No, only on Intel.

From the "Requirements for certifying Windows 8 systems" PDF available at http://msdn.microsoft.com/library/windows/hardware/hh748188 :

    MANDATORY. On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified [...]

    On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled.

setrofim_3• 14 years ago

    On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled.

Does this mean that , on compliant ARM devices, only Windows 8 may be run? If so, how is this not anti-competitive?

MichaelGG• 14 years ago

How does that prevent a signed Ubuntu loader from running? Custom mode is to allow running differently-signed or unsigned loaders, right?

davidcollantes• 14 years ago

From the source[1][2] and not on an advertising infested page.

[1] http://blog.canonical.com/2012/06/22/an-update-on-ubuntu-and...

[2] https://lists.ubuntu.com/archives/ubuntu-devel/2012-June/035...

nicholassmith• 14 years ago

What a catch 22. We want commitment to OSS so we're GPL v3, but because of our commitment we can't supply OSS so instead we're going to go for something else that's not OSS so we don't disclose the key.

Someone, somewhere, has just torn their beard out in fury.

rquirk• 14 years ago

efilinux looks to be BSD, so at least it isn't like they are using a proprietary boot loader. https://github.com/mfleming/efilinux

_delirium• 14 years ago

While true that you will be able to modify the efilinux code, you won't be able to run the modified version, since it won't be signed, making it a very theoretical sort of open source. That kind of open-source-but-not-really situation is exactly what GPLv3 was trying to prevent.

gcb6• 14 years ago

No. You're wrong. We want open source because we want control of what run on our machines.

That standard goes against it.

Why not have a per machine signature that you sign your code against?

Centralize it and have no more control. That's no catch22 whatsoever.

recoiledsnake7• 14 years ago

>We want open source because we want control of what run on our machines

>That standard goes against it.

>Why not have a per machine signature that you sign your code against?

And the Microsoft UEFI rules for getting a Windows 8 Logo REQUIRES UEFI setup to provide to a physically present user the option to turn off secure boot and add/delete your own keys.

How many times has this to be repeated to the same seasoned and regular commentators on this site and many others in similar stories from the past few months?

Is there a problem with communication here? Or is it intentional misunderstanding with an aim to spread FUD?

Sorry for the outburst, but I am really lost here with the same people making the same 50 silly wrong comments many, many times over and over again about UEFI secure boot. It's like they just see the headline like 'Red Hat to pay MS for booting Linux' and don't care or bother to read Microsoft's, Red Hat's and Ubuntu's take before spouting off in the comments about evil lockdown.

adestefan2• 14 years ago

The GPLv3 does not require you to provide a key. It only requires you to provide a way to bypass the need for a key. Allowing a user to add their own keys or even the option to disable the need for a key is fully within the bounds of the GPLv3.

There's also the outstanding issue that if you only supply software, then you might not even need to do anything to comply with the TiVo-ization clauses of GPLv3.

obtu• 14 years ago

Interesting, but I think this needs further analysis. That bypass mechanism must also comply with the “no additional restricions” aspect of the licence.

dsr_• 14 years ago

"That if once you have paid him the Danegeld, You never get rid of the Dane." -- Rudyard Kipling

pieter• 14 years ago

From the mailing list:

"We believe that the intention of secure boot is to protect against malicious use or modification of pre-boot code, before the ExitBootServices UEFI service is invoked. Currently, this call is performed by the boot loader, before the kernel is executed.

Therefore, we will only be requiring authentication of boot loader binaries. Ubuntu will not require signed kernel images or kernel modules."

That's completely different from what Fedora is doing (signing all kernels and modules). I hope for them Microsoft agrees with their interpretation and won't revoke their signed binaries. I'm not sure what advantage they would get from a signed boot loader, if you can run any arbitrary kernel from within the loader.

ajross3• 14 years ago

I was wondering about this too. From the user's perspective, this is great, as it basically means that everything downstream from the custom UEFI bootloader can be unsigned, user-defined code.

But at the same time, it pretty clearly defeats the purpose of the UEFI signature chain. A plausible malware vector would thus be to install the ubuntu loader, which then loads your malware payload and chains to windows, compromising the "secure" boot.

Basically, it undoes secure boot entirely. Which is a good thing. I hope Microsoft is willing to look the other way on this, but I fear that they are not.

wissler2• 14 years ago

AKA boiling frog.

gcb6• 14 years ago

Any and every malware will be signed with windows (version of the year) private key. They will have way less difficulty to run than oss

wmil2• 14 years ago

If the boot loader is required to show a splash screen the user will still get clear evidence that something strange is going on.

Havoc• 14 years ago

Yes it does seem like a decidedly half-baked plan. All the hassle and none of the benefits.

StavrosK2• 14 years ago

Can someone explain what the practical advantage of DRMing all our computers is?

hk_kh3• 14 years ago

To perceive the computer as an appliance instead of a piece of hardware.

Alienate the users on their machine, not something that can be hacked, studied and understood as a computer, instead a piece of magical wisdom.

Dumb down the mainstream user, and tie them up on their products.

"Protect" their software, being the computer just a black box projecting their knowledge / entertainment.

I hope DRM backfires really hard on the companies advocating for it.

StavrosK2• 14 years ago

No, I meant the advantage to users. Why would I buy a computer that's crippled like that?

rimantas• 14 years ago

  > To perceive the computer as an appliance instead of a piece of hardware.

For many (most?) computers are appliances. Which does not contradict them being pieces of hardware.

  > Alienate the users on their machine, not something that can be hacked,
  > studied and understood as a computer, instead a piece of magical wisdom.

What a load of bullshit.

  > Dumb down the mainstream user, and tie them up on their products.

It seems it is extremely hard to grasp the simple true: only minority of the population is interested in being hackers, programmers and IT guys. They just want to use computers — much the same way like they drive their cars without any wish and ambition to be a car mechanic. It is not "dumbing down" — it is freeing them from caring "how do I make this fucking thing work" to just doing what they want to do: be it browsing Facebook, writing a research paper or calculating orbit to Mars.

zokier• 14 years ago

Avoiding boot-sector malware

xaa3• 14 years ago

Why is this whole SecureBoot saga not being considered as anticompetitive behavior by Microsoft? It's pretty clear that the only "advantage" of SecureBoot is to hinder competing OSes.

And that Microsoft has only been able to obtain such a favorable result from the UEFI forum by throwing its weight around.

blahedo2• 14 years ago

Agreed. Microsoft has used their dominant position to strongarm the hardware companies into putting up a tollgate, which forces all of Microsoft's competitors to pay Microsoft if they want to keep competing.

Right?

bschlinker2• 14 years ago

You think Microsoft believes that a 99$ fee (as described in the article) will hinder their competitors?

btilly• 14 years ago

$99 from a vendor for all of their sales is not a big financial deal.

The interesting part comes the first time Microsoft decides to revoke a competitor's key as part of a Windows update, and people who dual-boot find out about it because they no longer can dual-boot. Even if the mess gets fixed quickly, it will be a cause of FUD. How blatant will they be in taking advantage of that?

apendleton2• 14 years ago

As much as I'm not a Microsoft fan, this strikes my as conspiracy theorizing.

Firstly, nobody--not Linux or anyone else--seriously threatens Microsoft in the commodity PC space. They probably see Apple as a threat, but this move has nothing to do with Apple, since they build their own hardware and won't be affected by these signing key requirements. Linux users make up a tiny percentage of desktop and laptop users, and many of those bought OEM machines with Windows pre-installed, meaning Microsoft got paid anyway. The idea that Microsoft would undertake this kind of technical hurdle to stave off the coming hoards of Ubuntu users simply isn't realistic.

Secondly, pre-boot security vulnerabilities are very much real, and exceptionally difficult to detect in an already-booted operating system. Here's an area where Microsoft does feel competitively threatened, since Apple has been able to win market share on the back of Microsoft's poor security record, so Microsoft has had to come up with some way to shore up this gaping hole in their anti-malware strategy. Matthew Gerring of Red Hat, who's basically been leading the Linux efforts to figure out this UEFI stuff, readily admits that there are attacks already in the wild that UEFI addresses, and that no viable solutions other than signed OSes have been proposed to deal with them (see http://mjg59.dreamwidth.org/10971.html for a more thorough treatment). It's a hard problem, and while I would concede that Microsoft doesn't care how this affects the Linux world, I don't think hurting Linux was their primary motivation.

xaa3• 14 years ago

Yes, pre-boot vulnerabilities were a motivating factor.

But why forcibly disable Custom mode on ARM then? This is especially disturbing considering that ARM may very well be the major computing platform of the future.

spinchange• 14 years ago

There are legit reasons for secured boot systems. Even the Cr-48 Chromebooks shipped that way by default (and still fully hackable)

I think it just happens to be extremely convenient for Microsoft that doing this makes life a little harder for Linux/Alternate OS people.

gcb6• 14 years ago

You sir, are correct.

People ignore that this has nothing to do with desktops, but the newly forming tablet (or whatever is to came) market.

How many touchpads run webos now? Heck craigslist is filled with $50 offers to install Android there.

MS knows they will heavily subside their new hardware to kill competition, just like the do with xobox, and the last thing they want is Android or something there.

Safeboot never took off because ms never had a reason to push it before. As another post here correctly say, they own desktops already with no threat in sight.

mkjackson• 14 years ago

This is just disgusting. How in the world did our hardware get hijacked by MS and nobody anywhere did anything to stop it? Seriously! I can only hope that there's enough backlash to stop this mockery of consumer freedom to put things back to the way they are now.

RobAley• 14 years ago

Apple and smartphone manufacturers started the locked down hardware trend, Microsoft are riding their coat tails to achieve what they've wanted all along.

To be fair, these standards aren't controlled by Microsoft, but they've thrown their weight at the manufacturers to make sure the standards are implemented in a way which grossly favours them as the PC OS incumbent.

But they are using the recent success of Apple & co in consumer circles to diminish the appearance of their monopoly and make it look as if choices abound to the consumer.

adestefan2• 14 years ago

Locked down hardware started long before smartphones and Apple were even thought of.

whalesalad• 14 years ago

How the fuck do people tolerate Phoronix? I know they do good reporting and are awesome in the Linux community ... but good god browsing their website is like walking through an old minefield in Vietnam. Every other word opens a popover, popovers on load, popovers if you scroll. Look at the sidebar and an ad will appear somewhere.

protomyth• 14 years ago

Its because "they do good reporting and are awesome in the Linux community" (also BSD). If someone else had the same level of reporting, I would go there. It is not much fun and I tend to hit "Read Later" and read it in InstaPaper.

ysangkok• 14 years ago

http://h-online.com/open

wissler2• 14 years ago

How the fuck does bitching about irrelevancy earn the highest number of upvotes?

sounds3• 14 years ago

I understand Phoronix's stated reason for papering themselves with ads, though I think it actually does them more harm than good. (They state it's because they are a one-man show and don't make much money.)

Though Phoronix occasionally puts up a plea not to do this, I just installed AdBlock Plus.

hollerith• 14 years ago

>How the fuck do people tolerate Phoronix?

I use Adblock Plus, and I never experience any ads or popovers on Phoronix.com.

bowyakka• 14 years ago

I actually had to turn off adblock to see the complaint, and indeed it is terrible

We really need to start thinking about the post advertising economy dont we

hippich• 14 years ago

I would imagine secureboot work this way - you start machine, UEFI detects that signature of bootloader or kernel or whatever fails signature verification. If it fails - ask user if he wants to save new signature instead or if he did not install any updates to kernel/boot/etc.

This way it will be:

  - universally between OSes
  - will allow GPL code to be used
  - will not lock people into particular software platform

Are there any problems with my approach?

charlieman• 14 years ago

People usually presses the first button they see without reading the message.

unimpressive• 14 years ago

>Are there any problems with my approach?

Yes. The classic "People ignore popups" dilemma. The thing is, 99% of people on the planet either wouldn't know what a change to their boot sector is, or what to do if one occurs. So they would just leave it and go on with their root kit installed.

bschlinker2• 14 years ago

The same reason why browsers are now making it so tough to get to a website without a "valid" SSL certificate -- the average user will ignore the warnings and accept anything to get to their objective. This is one of the reasons why Google Chrome now prevents users from accepting invalid SSL certificates for some Google properties.

mathnode• 14 years ago

How does this affect me as somebody who builds their own computers for personal use? Does this only affect vendor sourced desktops i.e. HP, dell etc ?

jiggy2011• 14 years ago

That would depend on the motherboard you bought

gcb6• 14 years ago

Translates like this: if you bought a safeboot system, you're helpless

It has absolutely no security soundness. It may protect you against evil maid attack. But even so, less than decent fs encryption.

It's nothing more than a ploy to help Microsoft, and Ubuntu and RH are falling for the sole reason of having too much money.

It's like ssl certificates for bios. Burn it.

rlpb• 14 years ago

"Booting our CDs will rely on a loader image signed by Microsoft's WinQual key...the UEFI specification only allows an image to be signed by a single key."

This is anti-competitive and should not be acceptable. The UEFI specification needs to be fixed before vendors are forced to comply with it. It is disappointing that this won't happen.

rplnt• 14 years ago

Some other organization could (should) take over but we see how that works with DNS - not so well.

maxerickson3• 14 years ago

Microsoft is requiring companies that want a 'Works with Windows 8' sticker to, um, work with Windows 8.

The logo program doesn't stop manufacturers creating similar unstickered hardware or putting more than one key in the stickered hardware.

andrewaylett• 14 years ago

That's orthogonal: the issue here is that if you want to sign a bootloader (or anything else) then you can only do it with a single key. While there's nothing stopping Win8 stickered machines containing two keys, you can be sure that not all of them will, so you need to sign your code with a Microsoft-derived key if you want it to work everywhere. That means you can't sign it with your own key.

sounds3• 14 years ago

Although I would like to agree with you, I'm not convinced.

The reason Ubuntu (and Red Hat) aren't pushing to get their key included in the hardware is clear from the article:

"Microsoft's WinQual key, for much the same reasons as Fedora: it's a key that, realistically, more or less every off-the-shelf system is going to have, as it also signs things like option ROMs, and the UEFI specification only allows an image to be signed by a single key."

The Microsoft WinQual key monopoly is there because option ROMs (and other drivers) are only given one slot for a signature. After Microsoft signs the ROM, the manufacturer _can't_ add a Red Hat or Ubuntu signature to the drivers for their hardware.

This means even if you convinced all the manufacturers to include, say, a Ubuntu key, you still couldn't verify option ROMs were secure. Only Microsoft's key would work for that - thus, Microsoft's key will be the only one installed by the manufacturers.

Your next solution - creating unstickered hardware - is not a solution. There are a few manufacturers offering a linux option (Dell, Lenovo), and a few who sell only linux hardware (system76.com). In a UEFI secure boot world, there would be < 1% of hardware that wasn't locked to Microsoft's key, while 99%+ would be locked. I know users are supposed to be able to access a BIOS screen to disable secure boot, but that makes installing Linux much more painful than installing Windows 8. Why cede the advantage to Microsoft?

The best way to fight this, I believe, is to put your time and resources into coreboot.org and the FSF.

Gormo• 14 years ago

> The logo program doesn't stop manufacturers creating similar unstickered hardware

Effectively, it does. Microsoft routinely audits OEMs' products for logo/MDA compliance, and if any product offered under the same brand name fails the audit, then the entire company could lose all of its MS 'discounts' (that they've already likely baked into their cost accounting.)

In other words, if MS audits you, and any of your products fail the audit, then your unit cost for Windows licenses goes up significantly across all of your product lines.

It's very difficult for an OEM to simultaneously offer some products which are covered by the MS logo agreement and some which aren't.

Source: I used to work for a large OEM, and dealt with MS logo compliance on a daily basis.

adambyrtek• 14 years ago

I'm surprised that Microsoft pushes this in such a blunt way. They could have at least created a semi-independent non-profit to take care of signing. It seems like EFF or some other organization should push for antitrust investigation on this issue.

wmf2• 14 years ago

Those who benefit from such an independent organization aren't willing to pay for it.

beagle36• 14 years ago

I'm willing to put a few K$ towards the cause of starting an antitrust inquiry against Microsoft for this (and the related ARM landgrab).

Any lawyer (or otherwise knowledgeable non-armchair HNers) knows how I can go about that?

Given that the EU and China antitrust authorities also need to okay things these days, I believe that the we should bring the legal fight to MS, rather than receive the technical battle and fight it on our turf.

cooldeal5• 14 years ago

It's my opinion that you should look deeper into the issues than just skimming it before throwing thousands of dollars away.

First, Microsoft has mandated(as much as they can mandate to OEMs without violating antitrust!) that in order to receive Windows 8 logo certification, the OEM must provide a way for a physically present user to turn off UEFI secure boot in the setup menu and for that user to be able to add remove signing keys(including removing Microsoft's key!) at their will.

Coming to ARM and Windows RT, perhaps your antitrust inquiry might want to look at the elephant in the HN discussion - Apple - first, instead of being laughed out of the courtroom about picking on a platform with 0% marketshare compared to a platform which does the same thing with ~80% marketshare and >90% profit share.

Coming to actual meaningful things that can be accomplished for F/OSS desktop, you might want to consider reading the Red Hat blog post about secure boot. OEMs are willing to add signing keys of other players, but no one is interested in starting or running an operation that can sign F/OSS kernels with their key(after checking if that it's not malware).

Perhaps your few K$ might be better spent on such a nonprofit organization or division of the Linux foundation instead of throwing it at lawyers? Just my thoughts.

vog• 14 years ago

Why not linking directly to the source?

http://blog.canonical.com/2012/06/22/an-update-on-ubuntu-and...

ward• 14 years ago

Because, as mentioned in the article, there was more interesting information to be found in the mailing list, which Phoronix combined into their blog post.

Karunamon4• 14 years ago

I'm really having a hard time getting worked up over a $99 key which will all but completely eliminate boot sector infectors and the like. I think a lot of this storm and strife comes as a result of who is pushing it, less than the concept.

jellicle• 14 years ago

It's not the fee that's the problem. It's the permission.

Suppose Wikileaks developed installable software that embarrassed the U.S. government. Would their key have been revoked, making it impossible for anyone to run their software? Yes.

Karunamon4• 14 years ago

What "permission"? The key is open to anyone with the $99, or at least that was my understanding.

Also, slippery slope. Cmon.

takluyver2• 14 years ago

You will still be able to run any software on your computer once it has booted, the signature is for the bootloader. So this would only be an issue if Wikileaks for some reason had to implement their own operating system. Even then, users would have the option to disable secure boot and run the unsigned bootloader.

recoiledsnake7• 14 years ago

>Suppose Wikileaks developed installable software that embarrassed the U.S. government. Would their key have been revoked, making it impossible for anyone to run their software? Yes.

Perhaps you posted this in the wrong story?

http://www.readwriteweb.com/archives/wikileaks_app_yanked_fr...

yason• 14 years ago

Having long lost the appetite to stay on top of PC hardware, could someone kind please post a pointer to an article that explain what this UEFI SecureBoot actually means for generic hackers intending to run Linux or $whatever on their computers? What's all the fuss here?

I know how secure booting works and that it would be detrimental if enforced unilaterally but I've also read you can just turn off the UEFI SecureBoot from the equivalent of BIOS settings of these Windows 8 compatible machines.

So, in order to boot into whatever I want, I just tick that check off and go play with my computer like before? If so, then what's the problem?

Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2

Related Stories