veyepar: Making UEFI Secure boot work for you

Author(s):	James Bottomley
Location	MCC1
Date	jan Thu 31	Days Raw Files
Start	11:35	First Raw Start	error-in-template
Duration	0:45:00	Offset	None
End	12:20	Last Raw End
Chapters
Total cuts_time	None min.

http://lca2013.linux.org.au/schedule/30115/view_talk
raw-playlist raw-mp4-playlist encoded-files-playlist mp4 svg png

assets release.pdf Making_UEFI_Secure_boot_work_for_you.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

The Linux Foundation and its technical advisory board has a long history of working with UEFI (and indirectly Microsoft) to ensure that Secure Boot would function in a way that Linux Could take advantage of:

http://www.linuxfoundation.org/publications/making-uefi-secure-boot-work-with-open-platforms

In particular, we foresaw the GPLv3 bootloader problem and crafted a solution whereby the user would always be able to take control of the platform and install their own secure boot keys (this solution is now mandated by Microsoft in their Windows 8 hardware certification requirements).

This talk will review the history, give the current state of play of secure boot on Linux (we know it works with Red Hat and Ubuntu, but what about all the other distributions) paying particular attention to what the four secure variable databases actually are, what they can contain and how they all
interact.

Finally we will explain in detail how the end user can take full control of their platform, why this isn't as simple as simply throwing out Microsoft's key and installing your own and what all the technical requirements are to achieve full PC platform ownership (including installing trust signatures of bios rom drivers, creating additional EFI programmes for booting unsigned media and simply managing the secure variable databases).

Comment:

production notes