News for hackers. Stuff that matters.

A comment on Booting a Self-signed Linux Kernel. Parent comment

Re:Booting a Self-signed Linux Kernel by pilif on Tuesday September 03, 2013 @04:13AM (#6319684)
That procedure was only needed in order to show how booting a non-signed kernel was made possible and later how that was turned off again.

The magic is in KeyTool and that doesn't require the user to alter the BIOS in any way. You boot from that USB drive (sb-usb.img linked in the article) by the usual methods of booting from an external drive. It will boot because its bootloader is the Linux Foundation one that was signed by MS. Then you launch keytool and change the key config.

At this point, your bios will boot a kernel you have signed.

The only BIOS intervention in the article was to first allow booting unsigned kernels (not needed with that sb-usb thing) and then to turn it off again. At least that was my impression.

[ Parent | on HN ]
Re:Booting a Self-signed Linux Kernel by Filligree on Tuesday September 03, 2013 @06:17AM (#6320050)
Ah, hold on.

Doesn't running keytool require you to turn off security in the bios first?

[ Parent | on HN ]
Re:Booting a Self-signed Linux Kernel by VladRussian2 on Tuesday September 03, 2013 @06:30AM (#6320093)
> its bootloader is the Linux Foundation one that was signed by MS.

sounds like abomination. Even in the early 1998 our web browser had 4 or 5 root certificates. Why only one in the case of secure boot?

[ Parent | on HN ]
Re:Booting a Self-signed Linux Kernel by lisper on Tuesday September 03, 2013 @04:19AM (#6319709)
Ah. Well, it's possible I misunderstood that. I hope you're right.
[ Parent | on HN ]