Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot in the Era of the T2

duo.com

Post reply on HN
Print view View original

21–30 of 97 posts

Re: Secure Boot in the Era of the T2

#21

Post by saagarjha »

nneonneo wrote: post #15
MrBingley wrote: post #8

Earlier quoted context omitted.

Even with secure boot disabled you can't install Linux on the internal SSD. Installing Linux on a Mac has already been very flaky for the last few years, but now is impossible. https://unix.stackexchange.com/questions/463422/how-can-you-...

The likely problem is a lack of driver support for using the T2 as an SSD controller. I don’t think, based on Apple’s white paper, that they did anything to explicitly block Linux from accessing the internal SSD - it just needs to go through the T2 for that. Hopefully someone is working on the necessary driver support - these laptops are still very new so maybe nobody has gotten around to it yet.

Yes, the issue is that Linux doesn’t know how to talk to the SSD, not Apple stopping Linux from accessing the SSD.

Re: Secure Boot in the Era of the T2

#22

Post by josteink »

sudo-i wrote: post #2

Does this have any bearing on running linux on macbooks?

> Does this have any bearing on running linux on macbooks

Unlike on PCs, on T2 Macs Linux will only be bootable with Secure boot disabled making the system much less secure.

To make matters worse, the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything.

When Apple stops supporting this machine, you won’t be able to keep it chugging by loading another OS.

I could say Apple is trying to terminate the only remaining computing platform which respects end-user freedom and ownership, but I’m not sure if it would be a joke or not...

Re: Secure Boot in the Era of the T2

#23

Post by saagarjha »

cmurf wrote: post #19
nneonneo wrote: post #14

Earlier quoted context omitted.

Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram…

Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim boo…

> And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks.

No way. The typical user will leave it enabled because they will only use macOS.

Re: Secure Boot in the Era of the T2

#24

Post by josteink »

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot capabilities to the mass market.

So the vast PC-market with UEFI secure boot which predates this by 6 year was somehow not the “mass market”, but the relatively tiny MacBook market is?

With factual errors like this present already in the introduction, it’s hard to take anything which follows it seriously.

This just comes off like fanboy-fluff.

Re: Secure Boot in the Era of the T2

#25

Post by LeoNatan25 »

scarface74 wrote: post #10
userbinator wrote: post #6

Earlier quoted context omitted.

which is great for data privacy. ...and absolutely horrible for freedom. It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. Now companies are turning the security against users, lest they also be attackers. From the point of view of the DRM-advocating media corporations, the user is an attacker. Locking down the…

Tell that to the million of Windows users that have 10 toolbars on their browser, ransomware, etc....

2001 called, it wants its outdated Windows memes back.

Re: Secure Boot in the Era of the T2

#26

Post by saagarjha »

grecy wrote: post #16
MrBingley wrote: post #8

Earlier quoted context omitted.

Even with secure boot disabled you can't install Linux on the internal SSD. Installing Linux on a Mac has already been very flaky for the last few years, but now is impossible. https://unix.stackexchange.com/questions/463422/how-can-you-...

Interesting that Windows 10 installed via Boot Camp is an allowable exception, but Linux is not. I wonder if Apple have an official stance on that.. i.e. "we're working on it", or "never".

This is because Apple has included the keys for Windows, but has not added the Microsoft UEFI key for Linux.

Re: Secure Boot in the Era of the T2

#27

Post by geofft »

cmurf wrote: post #19
nneonneo wrote: post #14

Earlier quoted context omitted.

Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram…

Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim boo…

> Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks.

I see this said a lot, and I find it baffling because so many Linux users demanded no secure boot at all - which is exactly the thing being called unacceptable now. (It's not just you; The Register, for instance, complained about how "malware or malicious users that gets onto your Mac can potentially alter the operating system to hide spyware right from startup" when secure boot is off, in an article otherwise complaining about how Apple must hate Linux users because secure boot is now on.) There is no increased risk of bootkit attacks to Linux users as a result of this change. There is simply a reduced risk to macOS users.

I do agree that a model (as MS implemented) where you can enroll your own keys would be better - but that would be a new feature. In the meantime, if every Macintosh from the 128K until today was acceptable, what changed?

Re: Secure Boot in the Era of the T2

#28

Post by saagarjha »

josteink wrote: post #22
sudo-i wrote: post #2

Does this have any bearing on running linux on macbooks?

> Does this have any bearing on running linux on macbooks Unlike on PCs, on T2 Macs Linux will only be bootable with Secure boot disabled making the system much less secure. To make matters worse, the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything. When Apple stops supporting this machine, you won’t be able to keep it chugging by loading another OS.…

> the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything.

This isn’t true. You can install Linux on this, providing you disable Secure Boot. You can’t currently access the SSD, but that’s more the result of a driver not existing than it being inherently disallowed.

Re: Secure Boot in the Era of the T2

#29

Post by nneonneo »

HankB99 wrote: post #17
nneonneo wrote: post #14

Earlier quoted context omitted.

Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram…

I've read that the T2 chip also provides the mass storage interface and without documentation or drivers, Linux cannot be run from the internal drive. Devices with the T2 chip can be booted and run from USB connections with the security disabled but not an internal drive.

Yes, that's unfortunate - the lack of drivers means that Linux devs will once again have to reverse someone's proprietary software to develop their own drivers. It's not a fun state of affairs. Unfortunately, Apple is not likely to start fully supporting Linux on Mac hardware by providing drivers and documentation. But the point here is that they haven't done anything technically to prevent you from running Linux.

Re: Secure Boot in the Era of the T2

#30

Post by nneonneo »

cmurf wrote: post #19
nneonneo wrote: post #14

Earlier quoted context omitted.

Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram…

Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim boo…

The white paper addresses this - the UEFI CA is not included in the secure enclave's trust store. This is intentional - the UEFI CA is used to sign bootloaders that don't perform chain-of-trust validation, meaning that if the secure enclave trusted the UEFI CA by default, then secure boot could be pretty trivially bypassed.

Sure, they could make things more secure by allowing you to add your own keys. You could go ahead and add the public key for your secure bootloader that does chain-of-trust validation, but the "typical scenario" would be a user adding a generic UEFI CA that leaves them open to a modified or malicious OS.

Post reply on HN