Brave New Trusted Boot World

https://0pointer.de/blog/brave-new-trusted-boot-world.html

by freedomben • 4 years ago

63 31 4 years ago

yyyk3• 4 years ago

The post is excellent.

However, if one uses a UKI, is initrd as useful as it was? After all, you could ditch modules and compile directly to kernel, and there'd be no space difference whatsoever. Perhaps we could make things simpler if initrd wasn't needed for most systems.

I've been booting initrd-less systems for a long time. It's quite doable but requires a different setup than the default.

lmm• 4 years ago

Can you do e.g. full disk encryption that way? (And, crucially, do you get a semi-graceful failure mode if the disk encryption fails somehow? Similarly for e.g. network filesystem as root). I can certainly see the value of simplification, but being able to run some kind of userland before you've got your main filesystem up and running has a lot of use cases.

yyyk3• 4 years ago

I use fscrypt, my typical threat case won't be able to break it, and I think the failure mode is more graceful (you can set up alternate methods for decryption, I use a backup password). FDE should be possible with the right kernel support, but not sure this exists today.

mixmastamyk2• 4 years ago

Would like to hear more.

yyyk3• 4 years ago

Booting uses PARTUUID to find the right boot partition (there's a systemd standard for finding the right partition automatically if the right UUID is set, but nothing seems to actually use it? I did set up the right UUID from the standard just to document things).

Encryption is via fscrypt, which isn't as good as FDE - not sure if FDE is impossible here, but I think this is enough security for the typical adversary. If a three-letter agency was a threat, I'd be toast anyway.

Custom kernels: Module loading is disabled - I've enabled everything that a normal install would load and added some netfilter things. Firmware is compiled into kernel too. Of course custom key is used for secure boot.

mjg59• 4 years ago

Yes - the idea is that modules can be pre-built into a set of add-on images that can be independently signed, and the UKI can pick those up. That way you still only install the module images that are required into the boot partition, rather than having to include all modules in the initramfs.

goombacloud• 4 years ago

Building into the kernel instead of using modules is not perfect because it increases RAM usage when you don't use certain modules compared to having them loaded on demand.

patrakov• 4 years ago

Initrd is as useful as it was before. It is just combined with the kernel image. You can still ignore the bits of advice from that blog post, and generate the initrd using whatever tool that you want, exactly as before. What is added is just one objcopy command to combine the kernel, the initrd, and the command line into one blob (UKI) that you can boot. You can even sign it with your own Secure Boot key, and it will still work, and be more useful than its components, because now your initrd (reminder: built according to whatever method you want) is cryptographically verified.

wmf• 4 years ago

Previously: https://news.ycombinator.com/item?id=33340866

I'm not dang, but let's see if we can not turn this thread into yet another referendum on systemd.

jokabrink2• 4 years ago

Boot chain is typically Firmware → shim → grub ...

Is this really true? Or just when using Red Hat systems? I don't know too much about the boot chain, but I always thought that after the ROM stage, usually GRUB would take over directly from the UEFI.

josteink• 4 years ago

When using UEFI secure boot you typically boot into the shim (signed with a certificate OOB-trusted on almost all PCs), which verifies the integrity of grub and then passes on control to that.

Without secure boot, I don’t think there is any need for the shim, but if it’s still used or not in those cases, I do not know.

vetinari• 4 years ago

Shim is there for Secure Boot. Microsoft refused to sign grub (GPL-3), but signed the shim (BSD-2), so shim has its own key store and verifies grub signed by respective distros.

If you don't use Secure Boot, UEFI firmware can boot directly to grub.

jokabrink2• 4 years ago

I see, thank you and the others.

vladvasiliu• 4 years ago

You can technically do away with GRUB or similar, too, and have the UEFI boot directly the kernel+initrd image via efistub.

This will, of course, not be signed by MS, so if you use SecureBoot, you need to handle your own signing. Set up is not automatic AFAIK, but once you've created your keys, signed MS's boot key (if you need dual boot), replaced the UEFI's key with yours and set up your package manager to sign every kernel update, everything works well enough. Haven't had a single issue with this in 4 years of running on "enterprise" HP laptops.

userbinator• 4 years ago

Starting off by directly referencing a dystopian novel and then outlining a plan towards such a dystopia? They're not even trying to hide it now and have already infected Linux.

If you truly value your computing freedom, stuff like this should seem deeply unsettling and scary. The only way out is to fight strongly against this growing wave of techno-authoritarianism.

Embrace, extend, enslave.

selfhoster11• 4 years ago

We already have remote attestation in Android, and it basically killed a range of reasons why one would ever decide to unlock their bootloader or root the device. Yes, doing this to PCs should be scary.

hulitu2• 4 years ago

So that's why i cannot uninstal spyware on my child's computer ?

pabs3• 4 years ago

This comment mentions some non-dystopian uses of remote attestation:

https://lwn.net/Articles/914323/

The one about leaving your laptop in the hotel and then the laptop being able to prove to your phone that the laptop hasn't been tampered with, is pretty compelling.

mindslight2• 4 years ago

Of course one can envision many handy uses for remote attestation that would benefit individual users! Web 2.0 also had many technical advantages over local software - there are certainly reasons why it got adopted.

But focusing on positive uses is naive and fallacious - the criticism is based on the downside of the inevitable negative uses when the device keys are recorded by manufacturers to create a root of trust that arbitrary third parties can abuse. The problem is that the technical capability also puts those end users at the mercy of large commercial actors specifying that the user's computer is "secure" from their centralized-corporate perspectives. Over time, that will inevitably ratchet into ever-more locked down computing forced onto end users. You can already see this dynamic with "SafetyNet" on Android, which destroys users' ability to exercise the purported Freedom of Android regardless of the source code being available.

chousuke• 4 years ago

The problem is that a secure, verifiable computing environment is also important for your privacy.

If you use this system with free software components, the dystopia won't materialize. It's the lack of transparency with proprietary components that causes problems.

bayindirh2• 4 years ago

The problem is not the secure boot itself, but how the designer, primary enforcer, primary CA and key control authority of said system is the worst imaginable candidate on the whole universe (and possibly beyond).

hulitu2• 4 years ago

Remote atestation? Why ?

josephcsible2• 4 years ago

Sure, it's important that I can verify what my computer is running. But it's also important that the MAFIAA et al. cannot. If there were some way of guaranteeing that attestation could only work for the owner, then I'd support it, but if that's not possible, then I'd rather it not exist at all.

doopk• 4 years ago

Or just copy Microsoft's design for BitLocker, and adapt it to Linux. They solved all these problems a long time ago.

stanzawork• 4 years ago

How much does it affect playing on your own hardware? I worry that we are increasingly entering a world where it becomes impractical to install a niche hobbyist OS directly onto a hard drive.

kasabali• 4 years ago

They are not going to forbid installing niche OSes because it'd look bad and they can do better.

Today you can't use banking app in a rooted Android, you can't watch high resolution licensed content in your linux PC, you're at the whims of rootkits disguised as anti-cheat frameworks if you wanna do online gaming.

Tomorrow you'll be required to use signed browser binaries by selected vendors running on a signed OS unlocked by TPM loaded with your ID card for joining a video call for a job interview or something.

Did you say your niche OS? Sure, you can view their support forums or wherever other hobos are hanging out for leisure without any of that.

josephcsible2• 4 years ago

Isn't this exactly the tivoization that RMS warned us about?

Brave New Trusted Boot World

Related Stories