Messages in this thread | | | From | Matthew Garrett <> | Subject | Re: Trusted kernel patchset for Secure Boot lockdown | Date | Fri, 14 Mar 2014 21:56:33 +0000 |
| |
On Fri, 2014-03-14 at 21:48 +0000, One Thousand Gnomes wrote:
> In your particularly implementation maybe you've got a weak setup where > you don't measure down to your initrd. That's a *flaw* in your > implementation. Don't inflict your limitations on others or on the > future. EFI is only one (and not a very strong one at that) implementation > of a 'secure' boot chain. A lot of other systems can not only propogate > measurement and security assertions into their initrd they can propogate > them into their rootfs (yes upgrades are .. exciting, but these kinds of > users will live with that pain).
Signed userspace is not a requirement, and therefore any solution that relies on a signed initrd is inadequate. There are use cases that require verification of the initrd and other levels. This isn't one of them.
> Even in EFI you can make your kernel or loader check the initrd signature > and the rootfs signature if you want.
Except the initramfs gets built at kernel install time. > > The fact that you keep saying measured really does make me suspect that > > you misunderstand the problem. There's no measurement involved, there's > > simply an assertion that the firmware (which you're forced to trust) > > chose, via some policy you may be unaware of, to trust the booted > > kernel. > > You are currently using some of those interfaces for measuring to produce > a notionally 'trusted' initial loaded environment. > > Correct me if I am wrong but your starting point is "I have a chain of > measurement as far as the kernel I load". Without that I can just go into > grub and 0wn you.
In my use case. But not all implementations will be measuring things - they can assert that the kernel is trustworthy through some other mechanism. This genuinely is about trust, not measurement.
-- Matthew Garrett <matthew.garrett@nebula.com>
| |