Shared publicly  - 
 
Booting a self-signed Linux kernel in UEFI secure boot mode. Details on how you can do this are at: http://www.kroah.com/log/blog/2013/09/02/booting-a-self-signed-linux-kernel/
120
28
Yuri Shishenko's profile photoGabriel Francisco's profile photoTed Chien's profile photoKrzysztof Wierzbicki's profile photo
19 comments
 
Very good video thank you greg 
 
Nice video ... I just wish I could stop the animation ...
my eyes :o
 
Nit: The link in "lather, rinse, repeat" should credit Matthew Garrett, not Gerrit. 
 
I'm still curious as to what would happen if you did this and had devices in your system with UEFI Option ROMs, particularly if you omit Microsoft's key from the database.
 
+Will Marone have you ever seen a system with a Option ROM?  They seem just as "mythical" as an ARM64 server....

Anyway, if you have one in the system, odds are you don't ever want to run it, option roms are horrible stuff.  If you really need to run it, just keep the Microsoft db key in the system.
 
Micron's P320h ships with one in some OEM solutions and I write it. And hopefully all future devices will as well, so it's of particular concern to me. I'll probably be the one to answer my question though.
 
+Will Marone I wouldn't use an option rom for a device like that, I'd stick with a "normal" ahci device to boot from, and then use the flash disk through the Linux driver.  The odds of wanting to boot of a flash PCI card is pretty low.
 
Agreed (it's rather expensive to use for effectively static data,) but even outside boot there are other facilities provided by the driver (firmware update, secure erase, etc.) that will need to be present at boot. Possibly more, if they keep cramming features into UEFI.
 
+Will Marone hey, UEFI is larger than the Linux kernel, they have to keep going, there's no turning back now...
 
Any plug-in card with a bootable device has an option ROM. These days most OROMs are still BIOS only, but at least some network card vendors are shipping with EFI OROMs.
 
I tried to boot openSUSE 12.3 livecd on Acer netbook with UEFI and SB mode on and that error message appears. I thought it should be signed. Or i should do some additional work to boot it?
 
Is that gatewau laptop?
 
So can it still boot win8?
 
So what happens when your distro updates the kernel?
Add a comment...