Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key?
I know I can sign the binary itself with my personal key, but that doesn't prevent malware with a different key from booting my binary.
If this is impossible, I can still sign the Windows binary with my own key and get rid of Microsoft's keys, right?
If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key?
No. You misunderstand the chain of trust. Earlier things need to verify later things. Later things can't meaningfully verify earlier things.
I know I can sign the binary itself with my personal key, but that doesn't prevent malware with a different key from booting my binary.
Correct.
If this is impossible, I can still sign the Windows binary with my own key and get rid of Microsoft's keys, right?
Yes, and this is what you have to do if you don't want code signed by Microsoft's keys to run.
