Windows 8 OEM specs may block Linux booting

Windows 8 OEM specs may block Linux booting
New secure boot process leaves unsigned Linux out in the cold

September 20, 2011, 9:45 PM —

After years of trying to cut off Linux growth as a desktop platform on x86 and x64 PCs, Microsoft may have actually figured out a way to stop Linux deployments on client PCs dead in their tracks.

At the very least, Linux deployment will be hindered on any Windows 8-certified machines to come, as new requirements for the Windows 8 logo come to light.

Red Hat's Matthew Garrett was one of the first to notice that according to the new logo rules, all Windows 8 machines will need to be have the Unified Extensible Firmware Interface (UEFI) instead of the venerable BIOS firmware layer. BIOS has been pretty much the sole firmware interface for PCs for a long time.

The EFI system has slowly been making headway in recent years, and right now EFI firmware is compatible with Windows supporting the GUID Partition Table (GPT), OS X/Intel, and Linux 2.6 and beyond machines. EFI is seen as a better hardware/software interface than BIOS, since it is platform-agnostic, runs in 32- or 64-bit mode, and GPT machines can handle boot partitions of up to 9.4 zettabytes. (That's 9.5 billion terabytes to you and me.)

EFI, and the later UEFI specification, is not the problem for Linux. The problem is Microsoft's other requirement for any Windows 8-certified client: the system must support secure booting. This hardened boot means that "all firmware and software in the boot process must be signed by a trusted Certificate Authority (CA)," according to slides from a recent presentation on the UEFI boot process made by Arie van der Hoeven, Microsoft Principal Lead Program Manager.

The slides, posted on Garrett's in a blog Tuesday afternoon, reveal Microsoft's plan to lock down the boot process, which Microsoft rightly points out has become a high-value target vector for injecting malware onto Windows PCs. To combat this, Microsoft is requiring all Windows 8 devices to have a hardened boot. Right now, even though there are EFI-ready Linux bootloaders and distros available, none of them are signed, Garrett reminded me.

It's not just a matter of replacing the UEFI system on the device with other, unencrypted, firmware. If all parts of the chain need to have a CA signature, then swapping out a machine's signed EFI layer with, say, an unsigned BIOS or EFI would not work. Garrett described the problem in more detail:

"Microsoft requires that machines conforming to the Windows 8 logo program and running a client version of Windows 8 ship with secure boot enabled. The two alternatives here are for Windows to be signed with a Microsoft key and for the public part of that key to be included with all systems, or alternatively for each OEM to include their own key and sign the pre-installed versions of Windows. The second approach would make it impossible to run boxed copies of Windows on Windows logo hardware, and also impossible to install new versions of Windows unless your OEM provided a new signed copy. The former seems more likely."

The upshot? Any device that ships with the manufacturer's keys and Microsoft's keys will not be able to boot a vanilla version of Linux.

The obvious solution--getting Linux distros signed so they can load on these machines--is clouded with uncertainty.

"Firstly, we'd need a non-GPL bootloader. Grub 2 is released under the GPLv3, which explicitly requires that we provide the signing keys. Grub is under GPLv2 which lacks the explicit requirement for keys, but it could be argued that the requirement for the scripts used to control compilation includes that. It's a grey area, and exploiting it would be a pretty good show of bad faith. Secondly, in the near future the design of the kernel will mean that the kernel itself is part of the bootloader. This means that kernels will also have to be signed. Making it impossible for users or developers to build their own kernels is not practical. Finally, if we self-sign, it's still necessary to get our keys included by ever OEM."

That's a whole lot of unsavory options to look forward to.

Garrett, for his part, is not panicking about the new requirement. He's hopeful that OEMs will be able to include an option in their UEFI firmware to disable the secure booting feature. Even if that is allowed by Microsoft, one thing is clear: dual-booting systems will be out of the picture if Windows 8 boots always require a hardened boot environment. It may very well be that once you turn off secure boot (if you can), you won't be able to run Windows 8 again on that machine, until you re-secure the boot process.

Microsoft is spinning this as a way to finally lock down the boot process, but I can't help but wonder if the side-benefit of blocking Linux boots was something expected as well.

Something to which we need to pay attention, that's for sure.

Source - Windows 8 OEM specs may block Linux booting | ITworld

Don't tell people will have to "jailbreak" (?) the so called "secure (?) booting" to install a damn distro in their machines... :/

Nothing to worry about though, would be cracked in a matter of days regardless of anything.

Good article covering "secure boot"
UEFI and "secure boot" [LWN.net]

A

once again a poor step by Microsoft.

Aren't they likely to be slapped with Anti-competitive penalty for this again?

Really, if this news is not a hoax, I would pity Microsoft!

You know what I like about Google? They let users choose between their and other's product.
Rather they make their product so good, that people automatically gets attracted to it.

Eg: When I install Chrome, it asks me to keep Google as their default search, rather than setting it by default!

It would really be a pity on M$ if this were to be true!

vineet369 said:
Really, if this news is not a hoax, I would pity Microsoft!

You know what I like about Google? They let users choose between their and other's product.
Rather they make their product so good, that people automatically gets attracted to it.

Eg: When I install Chrome, it asks me to keep Google as their default search, rather than setting it by default!

It would really be a pity on M$ if this were to be true!

IE latches on to your pc like a rabid leech and forces you to burn the afflicted pc to get rid of it.

anyway, lfc is right, it WILL be broken within days.
lets all learn low-level programming, so that we can help too

Don't worry, people will find some way out.

I wonder if it is true, didn't see in any of the major news portals.

Sarath said:
Aren't they likely to be slapped with Anti-competitive penalty for this again?

Thinking the same.

V

Well what I am thinking is, M$ is trying killing its Golden Goose..Enterprises which are relying on windows Xp and redhat linux may not upgraded, it 'll be a hard sell on the server side..
Hardware vendors may not agree to block additional revenues on non windows OS..chinese hardware vendors may sell millions without the features of UEFI, undercutting the likes of Dell,HP and acer etc.,
It is very ironic that the future of software freedom is depending on the likes of Iron curtain Nation's whim and fancies..

I am sounding like a pervert, but:

Microshaft just proved their name.

Translation:

They just admitted that they cant compete with Linux :lol:

If you want to know the relevance of the bit in the spoiler tags, PM me. This thread is an inappropriate place both in topic and language(meanings) to explain.
Sorry mods, I do not have finer and less offensive terms for the bit in spoiler tags.

Extreme Gamer said:
If you want to know the relevance of the bit in the spoiler tags, PM me.

T

Let us first get the clear picture. There is NO Official statement yet from Microsoft about any Hardware Lock for other platforms.

Tech&ME said:
Let us first get the clear picture. There is NO Official statement yet from Microsoft about any Hardware Lock for other platforms.

*video.ch9.ms/build/2011/slides/HW-457T_van_der_Hoeven.pptx

I don't see why this could be a big issue. Most Linux users build their own systems, which means all they will lack is a Windows 8 sticker and will not be mandated to have the secure boot enabled.

Also, most of the enterprise machines have 1 OS per system. I'm yet to see a dual-boot machine used for development in any company, unless of course it is a test bed system in some lab.

infra_red_dude said:
I don't see why this could be a big issue. Most Linux users build their own systems, which means all they will lack is a Windows 8 sticker and will not be mandated to have the secure boot enabled.

Laptops. A voided warranty would hurt here...

Secondly, Ubuntu among few others do target the masses, and certainly will be affected badly.

I still don't see this going through but whatever...

A

Extreme Gamer said:
I am sounding like a pervert, but:

Microshaft just proved their name.

Translation:

They just admitted that they cant compete with Linux

If you want to know the relevance of the bit in the spoiler tags, PM me. This thread is an inappropriate place both in topic and language(meanings) to explain.
Sorry mods, I do not have finer and less offensive terms for the bit in spoiler tags.

absolutely right dude!!
They just cant compete with OSS.

How can this even be legal. I just can't understand just how this can be allowed. You know what will be the biggest effect of this:
Linux will have fewer newer users. Everyone I have introduced to linux has begun by dual booting. That will end. Moreover as soon as Windows 8 releases we will only see preloaded laptops in the market like it is happening now. A normal guy can hardly buy a well specced laptop that doesn't come preloaded with Windows 7 since the preloaded are the ones which a more available.

T

^^
Microsoft seems to be moving toward the APPLE way of doing things now.

We will soon see Microsoft's own brand of Desktop Computer ( like iMac's ).... mPC !!!

Does this mean we won't be able to use bootable disks like hirens ?

I hope Windows 8 is a bigger failure than Vista.

V

Here how it is goes,

A unrewriteable loader checks the UEFI image, confirms it is unmodified. Starts UEFI.
UEFI checks the bootloader, confirms it is unmodified. Starts the bootloader.
Bootloader checks the kernel and system files, confirms they are unmodified. Starts the kernel.
Kernel boot process confirms an integrity checker is unmodified, which then scans the entire OS to ensure the state of the system and all drivers.

If at any point it fails, it either attempts recovery (overwriting files with a failed signature check) or halts boot

Leave out installing Linux,
so if I am installing some video cards,than rebooted .. the system may hang or break..because the integrity of the system failed (a la vista ?)
when the system come with single partition of 500GB hard disk, later I make three partition for my use with third party partition manager, than again rebooted the syste may refuse to boot or reset old system ..
third party antivirus system usually modified the windows firewall sytem, than reboot, and found the system' banal'
very interesting idea..
after windows-7 I am , like others, eagerly waiting for the famous. BSOD wall paper, it seem, m$ s obliging in this release..

(I have already installed windows developers preview, and it is a nice Wall paper OS, and their titles are 'elephant' sized icons. beneficial to peoples who have vision ailments..looking forward to complete OS)

T

Everyone wants to break apart their competitors. What Microsoft is trying to do is not NEW. Many companies like APPLE has already done so from the beginning itself.

Apple Mac OS is developed on Unix and Linux is also developed based on Unix, yet both are very different and you cannot install Linux apps directly in Mac.

Both use a very different kernel to boot. ( Mac = very restrictive )

So, if MS is trying to do anything similar to what Apple did decades ago, then this is not new.

And I feel Microsoft has its own justification for doing so. ( Fighting Piracy issue could be one of them )

V

Tech&ME said:
Everyone wants to break apart their competitors. What Microsoft is trying to do is not NEW. Many companies like APPLE has already done so from the beginning itself.

Apple Mac OS is developed on Unix and Linux is also developed based on Unix, yet both are very different and you cannot install Linux apps directly in Mac.

Both use a very different kernel to boot. ( Mac = very restrictive )

So, if MS is trying to do anything similar to what Apple did decades ago, then this is not new.

And I feel Microsoft has its own justification for doing so. ( Fighting Piracy issue could be one of them )

this is going to comparing it apples with oranges..apple is the sole manufacturer of Hardware along with the OS installed.. so no question of other OS..so there is no monopoly there..But Ms is OS vendor, and its hardware is manufactured by its partners (OEM)No fault there.. But M$ is forcing the the OEM to sell only windows installed PC and license it, with a rider that it sell no other OS installed PC. this sort of monopoly has been prohibited in many countries, and M$ itself convicted felony in the USA and escaped by bribing the congressmen,senators ..

If piracy is the sole reason then it should be welcome so FOSS will flourish !

T

vaithy said:
this is going to comparing it apples with oranges..apple is the sole manufacturer of Hardware along with the OS installed.. so no question of other OS..so there is no monopoly there..But Ms is OS vendor, and its hardware is manufactured by its partners (OEM)No fault there.. But M$ is forcing the the OEM to sell only windows installed PC and license it, with a rider that it sell no other OS installed PC. this sort of monopoly has been prohibited in many countries, and M$ itself convicted felony in the USA and escaped by bribing the congressmen,senators ..

If piracy is the sole reason then it should be welcome so FOSS will flourish !

YES !!

This were the problem: (read : Mistakes of Microsoft )

1. Microsoft released only the OS as its product. ( from the beginning )

2. Microsoft took a different root, they created OEMs , to run their OS.

3. Microsoft also released RETAIL version of their OS.

---

What Microsoft should have done from the beginning :

1. Microsoft should have gone the APPLE way of doing things.

2. Microsoft should have released hardware tied OS from the beginning.

Market impact of such move from Microsoft would had been :

1. NO Assembled Computer Parts floating in the market.

2. NO Assembled Computer Vendor shops, etc. which we see today.

3. So, credit Microsoft who actually created such a market in the first place.

So, What MICROSOFT gave us :

1. A flourishing ASSEMBLED Computer Parts Market.

Where DID this Mistake of Microsoft lead the company to ?

1. Today, Microsoft is faceing a lot of problems with regard to its OS being taken for a RIDE by every PC user.

2. Piracy bloomed like it was the ultimate thing to do...

NOW the CORRECTION time for Microsoft.

1. Microsoft is aggresively is trying to correct its past mistakes.

WHO will SUFFER in the END ?

1. The Assembled Computer Market will DIE.

Protecting the pre-OS environment with UEFI - Building Windows 8 - Site Home - MSDN Blogs

Interesting read. I would still say there's nothing major to worry about yet.

I would hope it is disabled by default in customer grade machines.
*blogs.msdn.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-29-43-metablogapi/0624.Figure_2D00_5_2D002D002D00_Samsung_2D00_PC_2D00_secured_2D00_boot_2D00_setting_5F00_thumb_5F00_02016A69.jpg

Tech&ME said:
...

Seriously? I'm afraid you are looking at the history of PCs in the reverse manner, and getting it all wrong.

T

^^
He He He................................................. :grin:

Where I am wrong ?? (History of computers !!!! Ha Ha Ha :grin:

I have used all the versions of Linux, Windows, Unix, from the day it all started..... !!!!!

No I mean you claimed that Microsoft allowing OEMs to ship their OS and only act as software vendor as a "mistake", when it is certainly not the case as this only brought them amazing level of success, with them owning like 90%+ of the market.
In fact doing the Apple way would have never bought any success, Apple themselves are the testimony if you look at the PC market only. Moreover you seem to be claiming that Assembled PC market got flourished by MSFT, when the case it's the reverse.

I still don't understand why people are becoming so furious over this. Are you missing "may" part of the news?

T

Liverpool_fan said:
No I mean you claimed that Microsoft allowing OEMs to ship their OS and only act as software vendor as a "mistake", when it is certainly not the case as this only brought them amazing level of success, with them owning like 90%+ of the market.
In fact doing the Apple way would have never bought any success, Apple themselves are the testimony if you look at the PC market only. Moreover you seem to be claiming that Assembled PC market got flourished by MSFT, when the case it's the reverse.

OK then, may I know for whom the equipment were actually manufactured before Microsoft made use of the Assembled Computer Parts ??

I mean to ask , who the hell was using the Assembled Computer Parts before Microsoft released its Windows OS ???

IBM ??? then why did it died out !!

Ponder over this, and you will get your answer!!

Er the assembled PCs/IBM clones which only got MSFT the market. Think for a moment, if their OS was not compatible with IBM PC and their clones would they have achieved the success they got?
I am pretty sure if Microsoft had gone the Apple way, then users would have had no choice but to look at the alternatives (there were next to none at that time). At worst the market would have been delayed but eventually an "open" platform would have won the game.

I am afraid we're going VERY off topic here let's keep it to Windows 8 secure boot and how it will affect other operating systems.

G

This will only increase the demand for linux.

Bad move by m$haft.

T

^^

There is NO POINT of compatibility between IBM OS and Microsoft OS. Since, both were the same........... ha ha ha........... if you know the history correctly.

Anyway, lets move back ourselves to the Original Context of this thread....

G

cute.bandar said:
Does this mean we won't be able to use bootable disks like hirens ?

Don worry ...if m$ does this...soon there will be some or other cra*k coming to avoid it... :twisted:

I thought I typed "IBM PC" not "IBM OS". Oh wait I did. Heh.

gopi_vbboy said:
Don worry ...if m$ does this...soon there will be some or other cra*k coming to avoid it...

But any crack (like jailbeaking) will void your warranty.

G

Liverpool_fan said:
Don't tell people will have to "jailbreak" (?) the so called "secure (?) booting" to install a damn distro in their machines... :/

Nothing to worry about though, would be cracked in a matter of days regardless of anything.

Good article covering "secure boot"
UEFI and "secure boot" [LWN.net]

Just askin as i know nothing of secure bootin...Cant grub or lilo be patched to allow boot to win8?

T

^^
that's exactly the problem, why Microsoft is doing all this.

if only people can think something different then CRACKING !!!

gopi_vbboy said:
Just askin as i know nothing of secure bootin...Cant grub or lilo be patched to allow boot to win8?

They can but practically Red Hat or Canonical will have to negotiate with hundreds or may be thousands of OEMs to get their keys approved, which is not a problem for Microsoft, but for any other competitor, it's something they will struggle big time.
Compounding the problems, GRUB2 is GPL3 licensed which will require any vendor using GPLv3 licensed software to publically release its key, and I am not sure whether a publically released key would be of comfort to any of the OEMs or whether they will really whitelist it. Mind you, there could be ways around this, the former is the most pressing concern anyway. Regardless of whether Canonical or Red Hat get themselves approved, community software like Linux Mint or your custom built distro will be locked out.

V

m$ IN 2011 IS NOT THE SAME m$ IN THE EARLY '80
shrinking volume of PC and Laptaps sales made hardware vendors use novell ways to remain in the game.. The rise of Tablets Pcs is another reason..
When Linux threaten with netbook invasion, immediately M$ responded , and force the hardware vendors to sales 'windows' only netbooks, thereby not only killing Linux in netbooks, even its own windows netbook sales.
"If my enemy lose one eye I am willing to lose my two eyes, " sort of Ballmer's ways showing his hatred kill both linux and Windows in the netbooks.
Acer , MSI who sided with Ballmer & CO is now scrabing for Android leftouts in the Tablets PC market..
Now the Market dynamics changed to mobility where Google and Apple is leading the way..
there is a news some where that 23" touch screen android is coming clearly this is the theater of War.
If the OEMs desire to side with M$ , than let them be buried in the deathmount of PC rubbles.

grab a lappy with Linux or no OS @ a lower price + 100% headache free computing.

"Windows: never works the way you want" should be the tagline of windows 8.

oh, also no Windows preloaded = no bloatware.

A

^^^ absolutely correct. Microsoft has always used Windows, to expand its other products like IE. And then they faced a lawsuit. Same should happen with them now!!

R

Windows 8 PCs with UEFI Secure Boot Wonâ€™t Lock Out Other Platforms - Softpedia

*blogs.msdn.com/cfs-filesystemfile.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-01-29-43-metablogapi/0624.Figure_2D00_5_2D002D002D00_Samsung_2D00_PC_2D00_secured_2D00_boot_2D00_setting_5F00_thumb_5F00_02016A69.jpg

The concern over whether or not the Windows 8 requirement for ‘Secure Boot’ will prevent users from installing other operating systems has been addressed by Microsoft‘s Steven Sinofsky in a blog post on the Microsoft Developers Network site.
Read full news here

Pre-built Windows 8 computers that want a “Windows Certified” sticker have to offer support for “Secure Boot” and enable it by default, but it remains up to the OEMs as to whether they provide an ‘off’ switch to allow users of other operating systems – including Microsoft’s own – the ability to install/boot into them.

the bold part says it all. OEM will get discount + other benefits for offering a locked secure boot.

Source: link provided in above post.

Plus imagine the reaction of newbies when told to disable something called "secure boot" to run Linux. I don't expect positive reactions. And most people being stubborn doesn't help either.

V

Sam said:
the bold part says it all. OEM will get discount + other benefits for offering a locked secure boot.

Source: link provided in above post.

Exactly! M$ contracted the OEM for the particular models and charging them(in their language'discount') for the actual manufacturing items,i.e say 1,00,000 factory products,.. even if the OEM acually preloaded,only 80,000 items, and leave the rest of the items for other os, DOS, etc.,they have to pay to M$ exactly 1,00,000 items, whether the remaining items are windows loaded or linux loaded, the laptop priced same level as windows, so the actual margin of profits are going to M$ for selling Linux so we are calling this 'Windows Tax'
When I went for my laptop to the local HP reseller, he reietrated the same point, when I requested the Linux loaded laptop, but to pay same charge as windows laptop..
with his tonque twisted like a lapdog you've already watched Ballmer's famous laugh," Linux is not free; you have to pay for it..."
I am not hating if Ballmer get billion by selling windows.. but he and his OEM cronies are feeding on the blood of million FOSS developers, who have sweated to million of codes to produce free software try to bring before masses.. that is what unpardonable...

Liverpool_fan said:
Plus imagine the reaction of newbies when told to disable something called "secure boot" to run Linux. I don't expect positive reactions. And most people being stubborn doesn't help either.

Four years ago I was a fedora uses, when I try to teach linux with it to my friends, they were less enthusiastic , to manually installing all the codecs through terminal etc., then i happened to get PCLINUX then ubuntu CDS (total 10 cds) First they refuse to install it but they try live cds.. then the landscape changed now they are connverted to PC LINUX and ubuntu (they still need windows so it is dual booting)
If I am again to tell them they should try modify something called UEFI like BIOS, they will certainly not pleased...
For twenty years Linux and FOSS movement thwarted all the attempts by M$ FUD campaign and stood strong..there are some good open source souls still living in the locked cellars of redmond which is called port25, they may give some idea to Ballmer & Co, "instead of destroying linux, let us make some money" .
the thought of money can change BALLMER's mad schemes,but concentrated on the development of windows-8...Perhaps Ballmer already throwing his towel on the mat, realising windows -8 is going to be his 'windows ME' or VISTA. so he is now actively preparing for Windows-8 services Pack (a la Windows-9).. If any shareholder asking him, he can smoothed them 'what can I do" the linux growd conspired against me !

Microsoft, Red Hat spar over secure boot-loading tech. Microsoft, Red Hat spar over secure boot-loading tech - Computerworld

mjg59 | UEFI secure booting (part 2)

From mjg59 | Supporting UEFI secure boot on Linux: the details

Supporting UEFI secure boot on Linux: the details

An obvious question is why Linux doesn't support UEFI secure booting. Let's ignore the issues of key distribution and the GPL and all of those things, and instead just focus on what would be required. There's two components - the signed binary and the authenticated variables.

The UEFI 2.3.1 spec describes the modification to the binary format required to produce a signed binary. It's not especially difficult - you add an extra entry to the image directory, generate a hash of the entire binary other than the checksum, the certificate directory entry and the signatures themselves, encrypt that hash with your key and embed the encrypted hash in the binary. The problem has been that there was a disagreement between Microsoft and Intel over whether this signature was supposed to include the PKCS header or not, and until earlier this week the only widely available developer firmware (Intel's) was incompatible with the only widely available signed OS (Microsoft's). There's further hilarity in that the specification lists six supported hash algorithms, but the implementations will only accept two. So pretty normal, really. Developing towards a poorly defined target is a pain. Now that there's more clarity we'll probably have a signing tool before too long.

Authenticated variables are the other part of the puzzle. If a variable requires authentication, the operating system's attempt to write it will fail unless the new data is appropriately signed. The key databases (white and blacklists) are examples of authenticated variables. The signing actually takes place in userspace, and the handoff between the kernel and firmware is identical for both this case and the unauthenticated case. The only problem in Linux's support here is that our EFI variable support was written to a pre-1.0 version of the EFI specification which stated that variables had a maximum size of 1024 bytes, and this limitation ended up exposed to userspace. So all we really need to do there is add a new interface to let arbitrary sized variables be written.

Summary: We don't really support secure boot right now, but that's ok because you can't buy any hardware that supports it yet. Adding support is probably about a week's worth of effort at most.

Will Windows 8 block Linux installs?

If it is, then it will be a very bad thing.

So, finally Microsoft Denies Locking out Linux Stories

There have been rumors that the secure boot of MS Windows 8 would replace BIOS with UEFI, thereby locking out Linux. This would even lock out the earlier linux-logoWindows versions from new computers. This rumor was disturbing for people who wanted both Windows and Linux on their systems. And since it wouldn’t allow other Windows versions, you couldn’t install other operating systems on the same computer. A real bummer indeed.

yup, a real bummer. and when laptops are out with locked boot-loader, simply blame the manufacturers. sweet :grin:

of course, M$ will deny.... you dont plead guilty anyway.

Windows 8 will take time to grow on me. Anyway, I'll jailbreak the bootloader for linux installs.