[fedora-arm] Re: fedora with MS signed Secure Boot

On Friday, 12 September 2025 at 09:46, Peter Robinson via arm wrote:
> On Thu, 11 Sept 2025 at 21:24, Dominik 'Rathann' Mierzejewski via arm
> <arm@lists.fedoraproject.org> wrote:
> >
> > On Wednesday, 10 September 2025 at 11:26, Peter Robinson via arm wrote:
> > > On Wed, 10 Sept 2025 at 09:40, Dominik 'Rathann' Mierzejewski via arm
> > > <arm@lists.fedoraproject.org> wrote:
> > [...]
> > > > Fedora on PineBook Pro kind of requires U-Boot to be stored in the SPI.
> > > > As for easy modification, does SecureBoot block writes to /dev/mtd0?
> > >
> > > No, Secureboot doesn't write to anywhere, it reads the next phase in
> > > the boot process, checks it's signed by the right keys and hasn't been
> > > modified.
> >
> > I never said SecureBoot writes anywhere. I asked if the kernel prevents
> > the OS from writing to SPI if SecureBoot is active.
>
> Why would it? That's not what secure boot does, it purely verifies the
> next stage of the boot process.

I guess I confused myself when thinking about kernel_lockdown.

Regards,
Dominik
--
Fedora https://fedoraproject.org
Deep in the human unconscious is a pervasive need for a logical universe that
makes sense. But the real universe is always one step beyond logic.
-- from "The Sayings of Muad'Dib" by the Princess Irulan
--
_______________________________________________
arm mailing list -- arm@lists.fedoraproject.org
To unsubscribe send an email to arm-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/arm@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue