What is the advantage of a signed kernel?

Question

I was looking through APT packages for Quantal and I found one called linux-signed-image-generic, which only says that it's "Signed with the Ubuntu EFI key." The kernel package that it currently depends on says pretty much the same thing.

So if your hardware supports EFI (I think I'm running the signed kernel now) then what benefits does the signed kernel have? Is it just a security thing?

Signed kernel supports EFI secure boot. – cscarney Mar 05 '13 at 02:12 — cscarney, Mar 05 '13 at 02:12

score 20 · Accepted Answer · edited Feb 16 '17 at 13:42

20

It is a security thing but there is no performance benefit for your system.

New hardware will have secure boot. The problem is, that this hardware won't boot an OS that is not signed. The hardware is checking the software at startup to see if it is signed. If it isn't, the hardware will prevent the software from booting.

This is a security thing, because in theory it will prevent e.g. malware to start on your hardware.

There was a lot of discussion about this feature because an open source OS must get signed to run on future computers and that must be paid. And this is not the Open Source way.

This is a short explanation, but there is a lot of stuff on the web about it.

edited Feb 16 '17 at 13:42

Zanna

70,465

answered Mar 05 '13 at 15:10

prophecy201

2,690
16
21

1

Thanks for the answer. Could you, please, point to one piece of 'stuff on the web about it'. I'm interested to learn more. – JW. Apr 17 '15 at 20:06
3

@JW. this might be a useful starting point – Zanna May 23 '16 at 06:01

What is the advantage of a signed kernel?

1 Answers1

Linked