Comment by Gigachad

Comment by Gigachad 5 days ago

2 replies

Isn’t the idea that the kernel will verify anything beneath it. Secure boot verifies the kernel and then it’s in the hands of the kernel to keep verifying or not.

Nextgrid 5 days ago

> the kernel will verify anything beneath it

Yes that's the case - my argument is that Linux currently doesn't have anything standardized to do that.

Your best bet for now is to use a read-only dm-verity-protected volume as the root partition, encode its hash in the initrd, combine kernel + initrd into a UKI and sign that.

I would welcome a standardized approach.

  • jcgl 5 days ago

    Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together.

    ParticleOS[0] gives a look at how this can all fit together, in case you want to see some of it in action.

    [0] https://github.com/systemd/particleos