Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Dec 2012 15:52:50 +0100
From: Florian Weimer <>
Subject: Re: Plug-and-wipe and Secure Boot semantics

On 12/18/2012 03:41 PM, Greg KH wrote:
> On Tue, Dec 18, 2012 at 01:46:47PM +0100, Florian Weimer wrote:
>> Some UEFI machines seem to boot from USB by default, without any
>> prompting, probably assuming that a signed boot loader cannot cause
>> any damage.
> Specific model name(s) please?

Lenovo M72e 0896A9G

This is a business-class Windows 8 machine which comes with a Windows 8 
logo sticker, so Secure Boot was enabled in the factory (and my testing 
reflected that).  I'm not sure if the type number encodes that—Lenovo 
surely offers essentially the same hardware with Secure Boot disabled by 
default, so that customers can install Windows 7 more easily.

>> Most signed Linux boot loaders only verify the kernel (and,
>> indirectly, code that's loaded into the kernel), but not the
>> initrd contents.
> Given that there is only one public signed Linux boot loader, saying
> "most" is a bit odd here :)

Uhm, aren't there a couple of them in circulation?

The Fedora 18 TC3 installer boots on the machine mentioned above, in the 
factory default configuration.  Previous installer versions showed a 
Secure Boot error message.  I've run into an installer bug, though:

Florian Weimer / Red Hat Product Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.