We already know that it is possible for us to build a signed Linux boot loader that will load unsigned boot images and we’ve tested this already. But a boot loader that loads unsigned boot images can have other consequences in terms of security.

Here are the technical basics:

    It should be possible to enable or disable entering UEFI settings/UEFI shell at boot-up through a key combo – in there you can supposedly set up your own UEFI PK/db/dbx etc. keys
    It is possible to reboot into UEFI settings from Sailfish OS
    efilinux is used and has to be signed by something in UEFI PK/db/dbx and it can check signatures of the Linux kernel+initrd (boot images)
    We don’t currently use UEFI shim loader so no MOK functionality
    Kernel uses/can use CONFIG_MODULE_SIG kernel option
    There’s no ‘fastboot oem unlock’ functionality currently, but flashed images need to be appropriately signed towards SecureBoot configured keys in order to boot, but efilinux can be modified

This is an invitation to discuss how we should make a device security configuration that has appropriate balance between hackability and privacy/security. Nothing is set in stone but there might be hardware or technology imposed limitations