Linux and Windows 8 Secure Boot
Will it mean that Linux users can't use Windows 8 PCs at all?
Will users be able to disable secure boot in the Unified Extensible Firmware Interface (UEFI) protocol, effectively removing the problem?
Those and many related questions have been voiced repeatedly in the blogosphere over the past week or so, even as Linux Australia reportedly announced it's considering petitioning the Australian Competition and Consumer Commission (ACCC) with a claim that Microsoft's behavior is anti-competitive.
We probably won't know for some time still exactly how this is going to unfold, since Windows 8 is still on the distant horizon. In the meantime, though, it looks like “Windows 8 certified systems will make it either more difficult or impossible to install alternative operating systems,” in the words of Red Hat developer Matthew Garrett.
Of course, there's a big difference between “difficult” and “impossible,” and further comments have been made by both Garrett and Microsoft since my original coverage.
Wondering where things stand? Here's a rundown of what appears to be the case so far.
Enabled by Default
Microsoft's Windows Certification program will require that all certified Windows 8 systems have secure boot enabled by default, according to a blog post published late last week by Steven Sinofsky, president of Microsoft's Windows division. To prevent malware from disabling the firmware's security policies, Microsoft's program will also require that firmware not allow "programmatic," or software-level, control of secure boot, as well as stipulating that OEMs prevent any unauthorized attempts at changing the firmware in ways "that could compromise system integrity,” the blog post explained.
At the heart of Microsoft's approach is the UEFI secure boot protocol, a BIOS alternative that “permits one or more signing keys to be installed into a system firmware,” Red Hat's Garrett explained. “Once enabled, secure boot prevents executables or drivers from being loaded unless they're signed by one of these keys.”
The problem for Linux, as I noted last week, is that it won't have any such signature by default, meaning that it wouldn't naturally be allowed to run on a Windows 8 certified machine.
Further, as Garrett says, “Windows 8 certification does not require that the system ship with any keys other than Microsoft's. A system that ships with UEFI secure boot enabled and only includes Microsoft's signing keys will only securely boot Microsoft operating systems.”
Linux currently doesn't support UEFI secure booting, though that could change once hardware that uses it becomes available. “Adding support is probably about a week's worth of effort at most,” Garrett added.
Disabling Secure Boot
UEFI can be modified to disable secure boot, at least in theory, and the Windows 8 tablet Microsoft demonstrated at its BUILD conference earlier this month did include the ability to do that.
However, “doing so comes at your own risk,” Sinofsky's post asserted. Even more significant, his post noted that it's up to OEMs to choose how to enable such capabilities.
Whatever method vendors choose to make it possible to disable secure boot, users will still have choices as a result, Sinofsky added, such as the option to run older operating systems if they want.
Depends on Hardware Makers
Microsoft's overall message was to assuage concerns by asserting as Microsoft program manager Tony Mangefeste did, that "At the end of the day, the customer is in control of their PC." This has been echoed by some in the tech press. The reality, though, is that it sounds like it will ultimately be up to PC makers to decide whether or not they give users the ability to disable secure boot.
In fact, there is no requirement that certified PC makers give users the capability to disable UEFI secure boot, Garrett notes. And not only that, but "we've already been informed by hardware vendors that some hardware will not have this option."
The result, he wrote, is that "the end user is not guaranteed the ability to install extra signing keys in order to securely boot the operating system of their choice. The end user is not guaranteed the ability to disable this functionality. The end user is not guaranteed that their system will include the signing keys that would be required for them to swap their graphics card for one from another vendor, or replace their network card and still be able to netboot, or install a newer SATA controller and have it recognise their hard drive in the firmware. The end user is no longer in control of their PC.”
Options for Linux
So what are Linux users' prospects, given all of this? Once again, it's important to remember that this is all very preliminary, since Windows 8 won't be out for a long time still.
Working with what we've seen so far, though, not buying a Windows 8 certified PC is certainly one obvious option for avoiding any potential problems, as is simply upgrading from Windows 7 on an existing dual-boot machine. Building your own machine is always an option as well.
Assuming Microsoft does allow hardware vendors to give users the option of disabling secure boot, it may also end up being a matter of shopping carefully to ensure that the Windows 8 machine you buy includes that capability.
Signed versions of Linux don't sound likely, as I noted last week, due to licensing issues with the Grub and Grub 2 bootloaders and the fact that self-signed Linux keys would then have to be included by every PC maker--a logistical nightmare if ever there was one.
Of course, Linux fans tend to be pretty savvy users. If things do indeed continue on this path, I'm betting a variety of other workarounds will soon emerge.
- Posts: 759
- Location: UK, Wales
- Uploads: 50
- Kudos: 39
- Motherboard: Asus Z87K
- CPU: Intel quad core i7
- GPU: GeForce GTX 660
- RAM: 8gig
- Storage Space: 1.5 terabytes
- Sound Card: Fatal1ty pro
- Case: corsair 500d
Re: Linux and Windows 8 Secure Boot
By design, the feature is intended to keep unwanted and potentially malicious software off a system by preventing unauthorized binaries to load during the boot process. However, the FSF believes that this technology could be abused and simply be used to not allow users to load certain free software.
"We are concerned that Microsoft and hardware manufacturers will implement these boot restrictions in a way that will prevent users from booting anything other than Windows," wrote Matt Lee in a post on the FSF website. "In this case, a better name for the technology might be Restricted Boot, since such a requirement would be a disastrous restriction on computer users and not a security feature at all."
Lee suggests that users should keep their ability to decide whether they want to enable or disable boot restrictions and there should be a way that will allow users to install a free OS.
"Computer owners must not be required to seek external authorization to exercise their freedoms," Lee wrote. If Windows 8 will prevent users from installing a free OS, Lee believes the result may be "complicated and risky measures to circumvent the restrictions", and the " popular trend of reviving old hardware with GNU/Linux would come to an end."
It's a good idea to keep an eye on such new features, but I would think that it is rather unlikely that Microsoft will shut out other OS from its Windows 8 platform. If Microsoft was almost broken up over the integration of IE in Windows, it's fairly easy to imagine the potential antitrust effects if it were to shut out other operating systems.
- Posts: 19
- Location: The Jungle
- Uploads: 6
- Kudos: 4
- RAM: 4 GB
- Storage Space: 4 TB
Re: Linux and Windows 8 Secure Boot
There is no such thing as a stupid question, but there are a lot of inquisitive idiots.
- Site Admin
- Posts: 457
- Location: In my head looking out
- Uploads: 5
- Kudos: 17
- Motherboard: Gigabyte MA-785GT-UD3H
- CPU: AMD Phenom 2 black
- RAM: 4 gig
- Storage Space: 3 Tb