Linux and Open Source

Steven J. Vaughan-Nichols & Paula Rooney

Microsoft tries to block Linux off Windows 8 PCs

By | September 21, 2011, 1:24pm PDT

Summary: Microsoft may say that Linux isn’t enemy number one anymore, but they sure still act like it is.

If this wasn’t so sad, it would be funny. After Microsoft recently declared victory over Linux, it turns out that Microsoft appears is still trying to arrange it so that Linux won’t even boot on the next generation of PCs that come with Windows 8. Yeah, Linux isn’t on your enemy list anymore right Microsoft? Sure.

Matthew Garrett, a Red Hat engineer, gets the credit for spotting Microsoft’s latest anti-Linux move. In a blog posting, Garrett explains that Windows 8 logo guidelines require that systems have Unified Extensible Firmware Interface (UEFI) secure boot enabled. This, in turn, would block Linux, or any other operating system, from booting on it.

There’s nothing in UEFI that’s wrong. Indeed there’s a lot of good in UEFI. It’s a 21st century replacement for your PC’s basic input/output system (BIOS). Its job is to initialize your hardware and then hand over control over to the operating system.

Where the Microsoft sneak attack comes in, Garret writes, is with the UEFI secure boot protocol:

UEFI secure boot protocol is part of recent UEFI specification releases. It permits one or more signing keys to be installed into a system firmware. Once enabled, secure boot prevents executables or drivers from being loaded unless they’re signed by one of these keys. Another set of keys (Pkek) permits communication between an OS and the firmware. An OS with a Pkek matching that installed in the firmware may add additional keys to the whitelist. Alternatively, it may add keys to a blacklist. Binaries signed with a blacklisted key will not load.

There is no centralized signing authority for these UEFI keys. If a vendor key is installed on a machine, the only way to get code signed with that key is to get the vendor to perform the signing. A machine may have several keys installed, but if you are unable to get any of them to sign your binary then it won’t be installable.

This impacts both software and hardware vendors. An OS vendor cannot boot their software on a system unless it’s signed with a key that’s included in the system firmware. A hardware vendor cannot run their hardware inside the EFI environment unless their drivers are signed with a key that’s included in the system firmware. If you install a new graphics card that either has unsigned drivers, or drivers that are signed with a key that’s not in your system firmware, you’ll get no graphics support in the firmware.

Microsoft requires (PowerPoint Link) that machines conforming to the Windows 8 logo program and running a client version of Windows 8 ship with secure boot enabled. The two alternatives here are for Windows to be signed with a Microsoft key and for the public part of that key to be included with all systems, or alternatively for each OEM to include their own key and sign the pre-installed versions of Windows. The second approach would make it impossible to run boxed copies of Windows on Windows logo hardware, and also impossible to install new versions of Windows unless your OEM provided a new signed copy. The former seems more likely.

To sum up: “a system that ships with only OEM and Microsoft keys will not boot a generic copy of Linux.”

What does Microsoft have to say about the subject? ZDNet’s own Mary Jo Foley asked them and they’ve got nothing to say about UEFI, Linux and Windows 8. That’s reassuring.

Personally, I don’t think it’s going to happen. I think Microsoft is going to have its hands full getting hardware vendors to buy into Windows 8 in the first place nevermind trying to shove a signed UEFI secure boot protocol down their throats as well. The OEMs know darn well that while not that many companies will switch out Windows for Linux, a lot of them will switch out Windows 8 for Windows 7 or even XP. Will Dell, Lenovo, et. al. Really want to tick off their corporate customers by locking them into Windows 8? I don’t think so.

In short, this is 2011, not 1998. Microsoft doesn’t get to call the shots to the OEMs anymore. If the OEMs and customers want freedom of operating system choice on their hardware-and they will-Microsoft can’t force Windows 8 on them.

Related Stories:

Will Windows 8 block users from dual-booting Linux? Microsoft won’t say

The Linux desktop is dead. Long live the Linux desktop.

Linux snickers at Microsoft’s victory declaration

Windows’ Endgame. Desktop Linux’s Failure

What’s coming in Ubuntu’s new Unity Linux desktop

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system

Disclosure

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols is a freelance writer. He does not own stocks or other investments in any technology company.

Biography

Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system; 300bps was a fast Internet connection; WordStar was the state of the art word processor; and we liked it!

His work has been published in everything from highly technical publications (IEEE Computer, ACM NetWorker, Byte) to business publications (eWEEK, InformationWeek, ZDNet) to popular technology (Computer Shopper, PC Magazine, PC World) to the mainstream press (Washington Post, San Francisco Chronicle, BusinessWeek).

209
Comments

Join the conversation!

Just In

RE: Microsoft tries to block Linux off Windows 8 PCs
Stan57 28th Sep
@alwynbalingit@... Whats keeping them? ill tell you, money! They will most certainly have to start to make linux users pay for there OS of choose. Certification will not be free
0 Votes
+ -
I would wager this is oversight
Michael Kelly 21st Sep
and not part of a master plan to bring down Linux. It's an issue that needs addressing, but let's not make it more than it is.
0 Votes
+ -
Linux is not a big enough threat to warrant such tactics.
0 Votes
+ -
@LBiege,

... PCs. If a user doesn't want the restrictions, he should not buy a Windows 8 logo PC. That is all. The measure is obviously for security, and OEMs appear to have the option to include signed Linux OSs with Windows 8 logo PCs.

The only way users are going to get secure Windows PCs, and great user experiences, are if things become buttoned down. There is no other way. So again, if users don't like the signed OS approach, do not buy a Windows 8 logo PC - instead buy a non-Windows logo PC.
@R. Douglas But this may be like saying "buy a PC without Windows pre-installed". Given Microsoft's monopoly status, it could turn out being near impossible without building one yourself.
0 Votes
+ -
THE SKY IS FALLING!!!
Rabid Howler Monkey 21st Sep
@jgm@ Uh, no ...

http://www.zdnet.com/blog/open-source/the-top-five-linux-desktop-vendors/9313

Maybe the desktop Linux vendors can look forward to some growth. And, maybe, their prices will drop a bit.
0 Votes
+ -
What's wrong with choice?
P. Douglas 21st Sep
jgm@...,

I don't understand the problem. If users have the option to buy Windows 8 logo, signed PCs, and also non-Windows 8 logo, unsigned PCs, what is the problem? MS will not be forcing OEMs to build only one type of PC. MS is merely providing a choice.
0 Votes
+ -
Linux is not a big enough threat to warrant such tactics.

But it's a big enough threat to gain a lot of attention around here.

It's the biggest '1%' in the whole wide western world.
0 Votes
+ -
The only way users are going to get secure Windows PCs, and great user experiences, are if things become buttoned down. There is no other way.

But again MS doesn't own the OEMs so things become anti-trust. There's no other way.

So again, if users don't like the signed OS approach, do not buy a Windows 8 logo PC - instead buy a non-Windows logo PC.

And then get held captive when there's proprietary software they can't use because they didn't get the logo.

I suspect "security" being used as an excuse for "captive audience".
@LBiege @Rabid Howler Monkey
Linux is free to download and install. How can the price be lower?
@P. Douglas "MS will not be forcing OEMs to build only one type of PC."
Yes. Yes they will. No one who wants Windows is going to buy a non-certified machine, so the vendors are all going to be cooperating with Microsoft. You know that, I know that. Why are you pretending otherwise?
"instead buy a non-Windows logo PC. "
Yes... all 5 of them sold from some guy working out of his garage. No, sorry, that's not acceptable, anymore than 99% of PCs being sold locked into running Linux would be. What is WRONG with people today praising their choices being taken away from them? It's not up to an OS vendor to decide where you can buy software from, and it's not up to an OS vendor or a hardware vendor to decide what OSes you can run on your PC.
@LBiege In the 90s, MS forbade (contractually and / or in back room threats), OEMs from installing BeOS. BeOS was nothing and no one had ever heard of it. There is no threat too small if MS thinks it's a threat.
0 Votes
+ -
@P. Douglas
have you ever tried to buy a computer that is NOT ms or mac logo pc?? let me tell you it's not an easy task short of building one yourself
@P Douglas

if users have the option to buy Windows 8 logo, signed PCs, and also non-Windows 8 logo, unsigned PCs

This is speculation. It's less profitable to manufacture more types of devices than only a few. It's more likely that an OEM will certify it's whole line than a portion of it, simplifying the process. MS doesn't have to force them. Basic math will suggest it.



happy
I don't get it anyway. I'm sure the anti-apple crowd will join us and condemn any hardware lock-in;-)
0 Votes
+ -
@Michael Kelly I don't even think this is an oversight but some Redhat employee shoveling FUD. Microsoft is ensuring that someone who buys a Windows 8 machine gets their full value and remember Vista with drivers that brought the system down or just didn't work over Microsoft's more stable universal drivers. Manufacturers of hardware are going to have to meet standards now as set out by Microsoft and if they don't there drivers won't install. As far as Linux goes, Windows 8 comes with a fully functional virtual machine capability available by default, so Linux can still be run on a Windows 8 machine. Windows 8 has another feature that SJVN has not mentioned is that the security software starts from the post and not the OS, therefore limiting the ability of bootkits and rootkits from being installed.
0 Votes
+ -
In other words...
ScorpioBlue 23rd Sep
Message to OEMs: Do this or we will cut you off and you will die.

That's really the end result, now isn't it @Rndmacts?

Nice corporate spin post, btw... wink
@Michael Kelly I agree, but don't think it needs addressing. This was done purely to secure the computer, not as part of some evil plot. The proof is that Windows 8 will be shipping with Hyper-V. This is a much better way to run Linux on a Windows machine than dual-booting. It's safer, simpler, and far more secure.
You make it sound like OEMs can't just...well, not sell it with a Windows logo. Because that's what this is: logo requirements. It's so they can put that Windows 8 sticker on the computers.
@Aerowind Microsoft controls 789% of the OS market. Who's going to sell their PCs without being Win8 certified?
@jgm@...

I thought Apple's market share has been growing 5 times faster than the rest of the market for years now. Sure, their usage share never seems to increase (on the desktop, OS X not IOS), but it's dead clear MS isn't a monopoly, and never was. Apple has always been a choice.
0 Votes
+ -
@jgm@...

I suspect that the average Linux user doesn't just pick up an OEM machine from the store -- and if they do, they most likely will buy an OEM machine with Linux pre-installed anyway.
0 Votes
+ -
@spdragoo@...

Well as an average dual Windows/Linux user, I can tell you that the others I have spoken with generally buy a desktop or laptop that either once had Windows on it, or they currently dual boot with Windows. This is because 98% of all OEM laptops and PCs already have Windows pre-installed on it.

There's very little out there with Linux pre-installed.
So MS has to go out of its way to make the 500 people who dual-boot linux happy?
@reklissrick MS has to not go out of its way to prohibit other OSes from running on any new PCs sold.
@jgm@...

but they should go out of the way to make the OS more secure which is the reason they are doing this. Linux and the OEMs will have to adapt to modern security methods. Oh Boo fricken hoo.
Linux and the OEMs will have to adapt to modern security methods. Oh Boo fricken hoo.

And that's why we'll see them in court if they go through with this.

They are not to be trusted.
0 Votes
+ -
@bobiroc

Linux and the OEMs will have to adapt to modern security methods.

Linux had EFI before Windows, dumba$$. That's not the issue. Is it willful denial on the part of many that Windows is the LAST to implement a technology??



happy
@reklissrick

Think that's an overestimate.

Why would anyone try and run Linux on a Win 8 computer? I'll take the security improvements over the needs of a few eccentric hobbyists wink
@ScorpioBlue@...
+1
@scorpioblue@... That may be, but there are legitimate security concerns relating to unsigned drivers/firmware/etc. being installed with low-level permissions. I'm assuming there will be a way to get around this for the serious hobbyists that this truly impacts. For the "commoner" this will have no impact on them whatsoever.
@ScorpioBlue@...

Aparently Tony's not the only proprietary tool, except that you gave up your soul willingly. Talk about anti-choice

That said, reading comprehension is critical when arguing with someone about something techncial so please, read and understand: Microsoft isn't dictating what your PC can run, Microsoft is requiring that for systems logo'd as "Windows 8 certified", that it have secure boot enabled.

It's up to the hardware OEMs to do the right thing to support Linux dual booting for these particular Windows 8 logo'd hardware sets.

Or is that nuance lost on you? I'm betting it is...
@Polly
"That said, reading comprehension is critical when arguing with someone about something techncial so please, read and understand: Microsoft isn't dictating what your PC can run, Microsoft is requiring that for systems logo'd as "Windows 8 certified", that it have secure boot enabled."

That's just semantic doublespeak, like "I didn't kill him... the bullet killed him. I just fired the gun."
Secure boot enabled means nothing non-Microsoft is booting on the machine.
"It's up to the hardware OEMs to do the right thing to support Linux dual booting for these particular Windows 8 logo'd hardware sets."
The only right thing to do is to not enable the feature in the first place or give the user the ability to disable it (which may or may not be permissible by Microsoft). How is an OEM supposed to stick keys for every Linux distro that's ever existed or will ever exist (much less a Hackintosh OSX install) in the BIOS?

Or is that nuance lost on you? I'm betting it is...
0 Votes
+ -
@tonymcs@...

If security is your big concern then I would advise you to switch to Linux.
0 Votes
+ -
Aparently Tony's not the only proprietary tool, except that you gave up your soul willingly. Talk about anti-choice

Yes, let's talk about that, shall we? Let's talk about how I'm supposed to be "anti-choice". Anti-choice about, what? Microsoft not getting it's own way?

Bunk.

That said, reading comprehension is critical when arguing with someone about something techncial so please, read and understand: Microsoft isn't dictating what your PC can run, Microsoft is requiring that for systems logo'd as "Windows 8 certified", that it have secure boot enabled.

That's just a ridiculous exercise in semantics since you damm well know what the end result will be. Microsoft leads the OEMs around by the noose and you know it.

It's up to the hardware OEMs to do the right thing to support Linux dual booting for these particular Windows 8 logo'd hardware sets.

No, it's up to the courts to force Microsoft not to put the OEMs in an untenable position that limits choice. I can also see the EC throwing this crap out the window as well, given their track record.
0 Votes
+ -
Why would anyone try and run Linux on a Win 8 computer? I'll take the security improvements over the needs of a few eccentric hobbyists

And post deletion aside, you're still a proprietary tool. Nobody's forcing you to dual boot with Linux but it's quite common among those who do for whatever reason.
  • Flagged
@tonymcs@...
"Why would anyone try and run Linux on a Win 8 computer?"

So that on that rare occasion when Win-8 refuses to give you access to your files, you can still access them from a small Linux installation.

Remember that sometimes you need that access NOW !
@reklissrick No they are going out their way to make sure you can only upgrade Windows if you buy a BIOS upgrade and a new Windows version from your OEM at whatever they want. Not so funny now, eh?
@ScorpioBlue Shame on you Scorpio! Bringing facts into the discussion....
0 Votes
+ -
'If the OEMs and customers want freedom of operating system choice on their hardware-and they will-Microsoft cant force Windows 8 on them'

But they don't have a choice if they want to keep their shareholders satisfied, what else will the OEM's put on their hardware that would actually sell? Hint, it's not Linux.
0 Votes
+ -
@johndow1 - OEMs and customers do have a choice: If they want a Windows 8 logo'd system, it comes with secure boot enabled for security.

Customers (aka consumers) choice: If they want a system that can dual/multiboot different operating systems, they can purchase a system that isn't Windows 8 logo'd if the Windows 8 logo'd system are only keyed for Windows 8.

OEMS choice: They can install keys that will allow Linux to dual boot on Windows 8 logo'd systems.
@PollyProteus Do you understand what a monopoly is? It's not "choice" if Microsoft's monopoly status will limit people who want to dual-boot or not boot Windows to building their own PC or buying a system from some guy who builds them in his garage. That's like saying a homosexual has the same right everyone else has to "marry someone of the opposite gender". That's not an acceptable choice.
What key is an OEM going to install to allow all distros of Linux in existence to run on their machines?

How about if all OEM machines are locked into Linux and you have to worry about getting a key to get your Windows OS to run instead? Would you be happy with that situation?
@jgm@

Do you understand what a Monopoly is? I do not think that you do. It is more than a board game.
@PollyProteus

they can purchase a system that isn't Windows 8 logo'd

You need to persuade me that OEMs will manufacture units they can't put the Windows logo on. If you can't, you're wasting my time with semantics.



happy
0 Votes
+ -
So you'll have an extra step for a Linux install - to install the required keys. It should still be possible.

Frankly, this has more to do with Microsoft setting up a new walled garden rather than trying to kill Linux. You have to use the app store to get Metro apps, and this crackdown on UEFI security indicates they're trying to establish their walled garden all the way down to the hardware level.

Linux troubles may simply be a side effect of this.
@CobraA1

SJVN and his trolls act like this is the first time an advancement in security has caused a bit a difficulty with less secure alternatives. Advancements in security may cause a bit of inconvenience but in the long run it will be better for all. I am confident that the OEMs that choose to offer Linux and the hardware manufacturers will be capable of stepping up to the plate and adding a bit of security to their offerings to accommodate this. It may require a flash of the UEFI or an update to the other operating systems.

SJVN just likes to take everything Microsoft and try and spin it into the end of the world. If a Linux flavor did this or something similar to secure the OS at the hardware level SJVN and the Linux trolls would be jumping for joy and continue to say how insecure Windows was. I find it all quite humorous.
@bobiroc You're kidding, right? This isn't an "inconvenience", it's the prohibiting of Linux from being installed on OEM machines forever more. We shouldn't have to flash our BIOSes or add keys (as I keep asking, WHAT keys? This is Microsoft's idea!) to run the OS of OUR choice on OUR PC that WE bought because ANOTHER OS vendor is using its MONOPOLY status to dictate terms to OEMs.
No, Linux people would not be happy about something like this because (99%) of the Linux people who post here actually have reasons for believing the things they do and adhere to principles rather than OSes. Linux DOES have the ability to do all Microsoft is doing (and more) already, as usual. Linux is quite capable of using a TPM. Unlike with Microsoft, it's OPTIONAL and not forced on the user, let alone an OEM. In Linux, the user ALWAYS has the ultimate authority, never the OS. Even during installs, most Linux installers will warn the user about an improper setup but the user has ultimate say. Everything the installer wants to do will be presented to the user first and anything can be overridden. Linux doesn't take the user out of the end user experience. Most Linux users would stop using any distro that did that.
Linux users are being consistent about complaining about Apple lock-in, Microsoft app store lock-in, and now hardware OEM/Microsoft lock-in. Most posters defending Microsoft can't say that their position regarding Apple is anywhere near that consistent.
0 Votes
+ -
RE: You're Kidding Right
bobiroc 22nd Sep
@jgm@..

See the problem here is you are believing SJVNs FUD. He has yet to prove that this is anything intentional being done by Microsoft to prohibit Linux. I can pretty much guarantee that the linux community will find a way and that this whole thing is being blown out of proportion as usual.
Reading the blog post Microsoft posted about this, and watching the session in which this was explained, it looks like it is being done to prevent malware from getting on the system...
I'd rather have a malware free system than they ability to dual boot Linux.. the fact that it keeps a secondary OS from booting is probably just a bonus, and probably to Microsoft, Linux is a form of Malware anyway happy
@steveymacjr1 -

-> "Linux is a form of Malware anyway :)"

That was funny...
@steveymacjr1

Yep, just a form of malware, or a hobbyist OS. Just ask the London Stock Exchange, or the New York Stock Exchange or the Chicago Board of Trade, or the American Stock Exchange, or the Nikki, or the Hong Kong, or Singapore exchanges, or NASA or any of the National Labs, or the NSA or CIA, or MI6, or Mossad, or China or Brazil (any government branch) or ...

Hmm, it seems that when there are Billions of Dollars or millions of lives on the line, then they run Linux. So do most of the most powerful computers in the world. That's of course just a hobbyist computer system you say? Real professionals like you don't run hobby simulations of the entire planet's wether, or track three billion trades a minute. They do what you do, what is that again? WOW? Sorry, but I am much more impressed with what Dow Jones or the World Bank is doing for their 'hobby' than I am with your online video game.

And Malware, most of it comes from compromised Windows systems. Yes, that includes Windows 7 systems.

As for this, it just means that there will be very poor sales of Windows 8 computers, as around 10% of the buyers DO dual boot. I would predict a lot of returns for faulty systems if this goes through.

I would also predict that like most of the improvements Microsoft has made in user security over the years, that it will take about a week to break it.

After 25 years, the old saw is still true. If you have Windows, you don't have security.
@alwynbalingit@... Whats keeping them? ill tell you, money! They will most certainly have to start to make linux users pay for there OS of choose. Certification will not be free

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix