Lokhu kungukuhumusha kokuthunyelwe okubili okuthathwe nguJames Bottomley kubhulogi lakhe. Okuthunyelwe kokuqala kwenziwa ngoFebhuwari 1 futhi kubizwa nge- "LCA2013 kanye noKwakha kabusha iBoot Ephephile"
Bengithule isikhathi eside, ngakho sekuyisikhathi sokubuyekezwa ngalokho okwenzekayo nge-Secure Boot Loader ye-Linux Foundation (ikakhulukazi njengoba yethulwe ku-LCA2013). ( Isixhumanisi samaslayidi )
Ingqikithi yenkinga ukuthi uGregKH (uGreg Kroah-Hartman, umthuthukisi we-kernel) wathola ekuqaleni kukaDisemba ukuthi i-Pre-BootLoader ehlongozwayo ngeke isebenze ngesimo sayo samanje ne-Gummiboot. Lokhu kwakudumaza ngoba kwakusho ukuthi ayifezi umgomo we-Linux Foundation wokuvumela wonke ama-bootloader. Isizathu, ngemva kophenyo, sasilula: I-Gummiboot yadalelwa ukukhombisa ukuthi ungenza i-bootloader encane, elula esebenzisa zonke izinsizakalo ezitholakalayo epulatifomu ye-UEFI esikhundleni sokuba yi-link loader enkulu njenge-GRUB. Ngeshwa, lokhu kusho ukuthi i-kernel iqala ukusebenzisa umsebenzi we-BootServices->LoadImage(), okusho ukuthi i-kernel ezoqalwa kufanele idlule ekuhlolweni kwe-boot okuphephile epulatifomu ye-UEFI. Ekuqaleni, i-Pre-BootLoader, njenge- shim (i-bootloader kaMathew Garrett), yabhalwa ukuze kusetshenziswe ukulayishwa kwesixhumanisi se-PE/Coff ukuze kudlule ukuhlolwa kwe-boot okuphephile. Ngeshwa, lokhu kusho ukuthi noma yini eyenziwa yi-Pre-BootLoader kumele futhi isebenzise ukulayisha izixhumanisi ukuze inqobe ukuhlolwa okuvikelekile kwe-boot kunoma yini efuna ukuyilayisha, ngakho-ke i-Gummiboot, engeyona ngamabomu i-link loader, ngeke isebenze ngaphansi kwalolu hlelo.
Ngakho-ke bekufanele ngiphinde ngihlele kabusha futhi ngibhale kabusha: Inkinga manje isuke kokuthi "ungakha kanjani i-link loader esayinwe yiMicrosoft elalela izinqubomgomo zayo" iye "ekutheni ungazisebenzisa kanjani zonke izingane ze-boot loader ukuze zisebenzise umsebenzi weBootServices-> LoadImage () yokulalela izinqubomgomo zabo. ' Ngenhlanhla, kunendlela yokunqanda ingqalasizinda yokusayina yesikhulumi se-UEFI ngokufaka eyakho inqubo yokuphepha yokwakha. Ngeshwa, ukucaciswa kokuqalwa kwepulatifomu akuyona ingxenye yesicaciso se-UEFI, kepha ngokuthokozisayo kwenziwa yilo lonke uhlelo lweWindows 8 ongaluthola. Ubungcweti obusha bunqamula leyo protocol futhi bengeza ukuhlolwa kwayo kokuphepha. Kodwa-ke, kunenkinga yesibili: Ngenkathi sisekuphindaphindelweni kokubuyiswa kweprothokholi yokwakha, akusho ukuthi sinabanikazi besikrini sohlelo lwe-UEFI, okwenza kube nzima ukwenza isivivinyo somsebenzisi sokugunyaza ukwenziwa kanambambili. Ngenhlanhla, kunendlela engasebenzi yokwenza lokhu futhi leyo yindlela ye-SUSE Machine Owner Key (MOK). Ngakho-ke, iLinux Foundation Pre-BootLoader manje iguqukile ukusebenzisa ukuguquguquka okujwayelekile kwe-MOK ukugcina ama-hashes agunyaziwe kanambambili.
Okuqhamuka kukho konke lokhu ukuthi manje usungasebenzisa i-Pre-BootLoader nge-Gummiboot (njengoba nje yenziwa kudemo ku-LCA2013). Ukuqalisa, kufanele ungeze ama-hashes ama-2: elilodwa leGummiboot uqobo kanye nelinye le-kernel ofuna ukuyivula, kepha empeleni kuyinto enhle ngoba manje unenqubomgomo eyodwa yokuphepha elawula konke ukulandelana kwama-boot. IGummiboot uqobo lwayo ibinamaphepha okubona ukuphahlazeka ngenxa yebhuthi ephephile futhi ibonisa umyalezo okutshela ukuthi iyiphi i-hash ongayibhalisa.
Ngizokwenza okuthunyelwe okuhlukile ngichaze ukuthi izakhiwo ezintsha zisebenza kanjani, kepha ngicabange ukuthi kungcono ngichaze ngokwenzeka ngenyanga edlule.
Futhi lokhu okuthunyelwe kwesibili ukwenze izolo futhi ubizwa "Kuthulwe i-Linux Foundation Secure Boot System"
Njengoba kuthenjisiwe, nansi i-Linux Foundation Secure Boot System. Empeleni sikhishwe yiMicrosoft ngoFebhuwari 6, kepha ngohambo, izingqungquthela nemihlangano angibanga nesikhathi sokuqinisekisa konke kuze kube namuhla. Amafayela lawa:
I-PreLoader.efi (md5sum 4f7a4f566781869d252a09dc84923a82)
I-HashTool.efi (md5sum 45639d23aa5f2a394b03a65fc732acf2)
Futhi dala isithombe esincane se-miniable USB; (Kuzofanela usifake ku-USB usebenzisa i-dd; isithombe sinezingxenye ze-GPT, ngakho-ke sisebenzisa i-disk yonke). Inegobolondo le-EFI lapho i-kernel kufanele ibe khona futhi isebenzisa i-gummiboot ukuyilayisha. Ungayithola lapha (md5sum 7971231d133e41dd667a184c255b599f).Ukuze usebenzise isithombe esincane se-USB, kufanele ufake ama-hashes we-loader.efi (kufolda ye- \ EFI \ BOOT) kanye ne- shell.efi (kufolda yezimpande). Iphinde ifake ikhophi yeKeyTool.efi okufanele ufake i-hash ukuze usebenze.
Kwenzekeni kuKeyTool.efi? Ekuqaleni bekuzoba yingxenye yekithi yethu esayiniwe. Kodwa-ke, ngesikhathi sokuhlola iMicrosoft ithole ukuthi ngenxa yesiphazamiso kwelinye lamapulatifomu e-UEFI, ingasetshenziswa ukukhipha ngokhiye ukhiye endaweni yesikhulumi, okungonakalisa uhlelo lokuphepha lwe-UEFI. Kuze kube yilapho sikwazi ukukuxazulula lokhu (sinomthengisi wangasese ku-loop), benqabile ukusayina i-KeyTool.efi yize ungayigunyaza ngokungeza okuguquguqukayo kwe-MOK uma ufuna ukukusebenzisa.
Ngazise ukuthi lokhu kuhamba kanjani ngoba nginentshisekelo yokuqoqa impendulo kulokho okusebenzayo nokuthi yini okungasebenzi. Ikakhulu, ngikhathazekile ngokuthi ukubhala ngaphezulu kweprotocol yezokuphepha ngeke kusebenze kwamanye amapulatifomu, ngakho-ke ngifuna ikakhulukazi ukwazi ukuthi akubasebenzeli yini.
Fuentes:
http://blog.hansenpartnership.com/lca2013-and-rearchitecting-secure-boot/
http://blog.hansenpartnership.com/linux-foundation-secure-boot-system-released/
Nquma ukuthi izindaba ezinhle noma ezimbi yini.