[conspire] (forw) Re: [Felton LUG] Oh boy, this doesn't look good...

[Rick Moen]

Quoting Michael Paoli (Michael.Paoli at cal.berkeley.edu):

> Also, this bit caught my eye:
> "With the sole exception of one bootable tool vendor who added
> custom code to perform a signature verification of the grub.cfg
> config file in addition to the signature verification performed on
> the GRUB2 executable, all versions of GRUB2 that load commands from
> an external grub.cfg configuration file are vulnerable."
> https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/
> So ... I wonder which vendor did it that way, and if that bit
> is Open Source ... and might be usefully leveraged by others.

SuSE Linux.
https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/

GRUB2 is GPLv3, so yes.

-- 
Cheers,                          Date: "What do you do?"
Rick Moen                        Me: *holds up menu* "You just choose a meal 
rick at linuxmafia.com              from this book of food."
McQ! (4x80)                                 -- Matt Watson (@biorhythmist)