2

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key?

I know I can sign the binary itself with my personal key, but that doesn't prevent malware with a different key from booting my binary.

If this is impossible, I can still sign the Windows binary with my own key and get rid of Microsoft's keys, right?

2

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with my personal key?

No. You misunderstand the chain of trust. Earlier things need to verify later things. Later things can't meaningfully verify earlier things.

I know I can sign the binary itself with my personal key, but that doesn't prevent malware with a different key from booting my binary.

Correct.

If this is impossible, I can still sign the Windows binary with my own key and get rid of Microsoft's keys, right?

Yes, and this is what you have to do if you don't want code signed by Microsoft's keys to run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.