{"id":105384,"date":"2022-10-26T15:36:38","date_gmt":"2022-10-26T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/lennart-pottering-predlozhil-novuyu-arhitekturu-verificzirovannoj-zagruzki-linux"},"modified":"2022-10-26T15:36:38","modified_gmt":"2022-10-26T13:36:38","slug":"lennart-pottering-predlozhil-novuyu-arhitekturu-verificzirovannoj-zagruzki-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/lennart-pottering-predlozhil-novuyu-arhitekturu-verificzirovannoj-zagruzki-linux","title":{"rendered":"Lennart Poettering proposed a new architecture for verified Linux boot.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Lennart Poettering published a proposal to modernize the boot process of Linux distributions, aimed at addressing existing problems and simplifying the organization of full verified boot, which confirms the integrity of the kernel and the base system environment. The necessary changes for implementing the new architecture are already included in the systemd codebase and affect components such as systemd-stub, systemd-measure, systemd-cryptenroll, systemd-cryptsetup, systemd-pcrphase, and systemd-creds. <\/p>\n

The proposed changes involve the creation of a single unified UKI (Unified Kernel Image) that combines the Linux kernel image, a handler for booting the kernel from UEFI (UEFI boot stub), and a memory-loaded initrd system environment used for initialization prior to mounting the root filesystem. Instead of the initrd RAM disk image, the UKI can package the entire system, allowing for the creation of fully verified system environments that boot into memory. The UKI image is formatted as an executable file in PE format, which can be loaded not only using traditional bootloaders but can also be directly invoked from UEFI firmware. <\/p>\n

The ability to invoke from UEFI allows for integrity verification and authenticity through digital signatures, covering not only the kernel but also the contents of the initrd. Meanwhile, support for invocation from traditional bootloaders preserves features such as delivering multiple kernel versions and automatic fallback to a working kernel in case issues arise with the new kernel after an update. <\/p>\n

Currently, most Linux distributions use the chain in the initialization process: firmware \u2192 Microsoft-signed shim layer \u2192 distribution-signed GRUB bootloader \u2192 distribution-signed Linux kernel \u2192 unsigned initrd environment \u2192 root filesystem. The lack of verification for initrd in traditional distributions creates security issues, as this environment is responsible for extracting keys to decrypt the root filesystem. <\/p>\n

Verification of the initrd image is not supported as this file is formed on the user's local system and cannot be verified with the digital signature of the distribution, which complicates the organization of verification when using SecureBoot mode (the user must generate their own keys and upload them to the UEFI firmware to sign initrd). Additionally, the existing boot organization does not allow the use of information from the TPM PCR (Platform Configuration Register) registers to control the integrity of user-space components, aside from shim, grub, and the kernel. Also mentioned are the complications of updating the bootloader and the lack of the ability to restrict access to TPM keys for older OS versions, which have become outdated after applying updates. <\/p>\n

The main goals of implementing the new boot architecture: <\/p>\n