Comment by Arnavion | Hacker News Reader

Comment by Arnavion | Hacker News Reader

Parent Full thread

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel.

UEFI can be emulated on top of BIOS using something like Clover. But for your BIOS-only mobo, just keep using it with a BIOS-only bootloader, ie GPT disk with grub or whatever written to the MBR + BIOS Boot partition. There's no reason to involve any UEFI, emulated or otherwise.

You will obviously not have as good protection from evil maid attacks as you would've gotten from Secure Boot. But presumably you're okay with that, and emulated UEFI will not help in that regard anyway.

UEFI Secure Boot doesn't completely protect against physical attacks. If a person can turn off and turn on the computer, they can replace the currently active UEFI bootloader with a shim app, enroll their own key. They can then run any UEFI binary, that binary can then do whatever, and at the end remove the SHIM NVRAM variable that it used, finally loading the original OS bootloader and removing all traces.

>UEFI Secure Boot doesn't completely protect against physical attacks.

I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite message.

>they can replace the currently active UEFI bootloader with a shim app, enroll their own key.

UEFI can be protected by a password if the implementation supports it. How secure that is is of course up to the implementation.

Presumably the point is to run something that assumes/relies on UEFI (an OS or application) without having to run and trust the giant blob of low-quality code that is a typical hardware UEFI implementation.

Sure, but we know that the OS they're asking about is Linux, and none of the major Linux distros require UEFI to boot.

I understood them to be talking about using Linux as the hypervisor that would emulate a UEFI environment, the guest OS might be something different.

Yup.

Nope.

Reply on news.ycombinator.com