Matthew Garrett Elaborates More On Lockdown + Secure Boot Pairing
A few days back we covered the heated exchange on the kernel mailing list over the path being pursued by the Linux kernel "lockdown" patches. Those back and forth messages between Google's Matthew Garrett and Linus Torvalds have now spilled over into a blog post by Garrett.
Linus Torvalds isn't against the kernel lockdown patches, he just is against it being explicitly enabled with UEFI SecureBoot and can't be easily turned off in that scenario. Matthew Garrett has written a blog post to lay out the case for UEFI SecureBoot with the lockdown functionality.
His argument is that what distributions wants, "The reason it's integrated with UEFI secure boot is because that's the policy most distributions want, since the alternative is to enable it everywhere even when it doesn't provide real benefits but does provide additional support overhead. You can use it even if you're not using UEFI secure boot. We should have just called it securelevel."
The post in full can be read on Dreamwidth.org.
Linus Torvalds isn't against the kernel lockdown patches, he just is against it being explicitly enabled with UEFI SecureBoot and can't be easily turned off in that scenario. Matthew Garrett has written a blog post to lay out the case for UEFI SecureBoot with the lockdown functionality.
His argument is that what distributions wants, "The reason it's integrated with UEFI secure boot is because that's the policy most distributions want, since the alternative is to enable it everywhere even when it doesn't provide real benefits but does provide additional support overhead. You can use it even if you're not using UEFI secure boot. We should have just called it securelevel."
The post in full can be read on Dreamwidth.org.