From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1Ld9XU-0003qX-EA for mharc-grub-devel@gnu.org; Fri, 27 Feb 2009 15:42:32 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Ld9XT-0003qM-0r for grub-devel@gnu.org; Fri, 27 Feb 2009 15:42:31 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Ld9XR-0003py-Tf for grub-devel@gnu.org; Fri, 27 Feb 2009 15:42:30 -0500 Received: from [199.232.76.173] (port=57787 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Ld9XR-0003pv-Om for grub-devel@gnu.org; Fri, 27 Feb 2009 15:42:29 -0500 Received: from aybabtu.com ([69.60.117.155]:39288) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Ld9XR-0005YW-9o for grub-devel@gnu.org; Fri, 27 Feb 2009 15:42:29 -0500 Received: from [192.168.10.10] (helo=thorin) by aybabtu.com with esmtp (Exim 4.69) (envelope-from ) id 1Ld9QJ-0006fv-RL for grub-devel@gnu.org; Fri, 27 Feb 2009 21:35:08 +0100 Received: from rmh by thorin with local (Exim 4.69) (envelope-from ) id 1Ld9XO-0008Me-Rn for grub-devel@gnu.org; Fri, 27 Feb 2009 21:42:26 +0100 Date: Fri, 27 Feb 2009 21:42:26 +0100 From: Robert Millan To: The development of GRUB 2 Message-ID: <20090227204226.GI31629@thorin> References: <49A152BD.6010907@student.ethz.ch> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <49A152BD.6010907@student.ethz.ch> Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.18 (2008-05-17) X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: GRUB trusted boot framework X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Feb 2009 20:42:31 -0000 On Sun, Feb 22, 2009 at 02:27:25PM +0100, Jan Alsenz wrote: > > If we could agree on this, then I think we could find a way to extend the GRUB > module system to fully allow this. > > From my point of view the minimal needed features for these systems are: > - easy exchange of the MBR binary to be installed > - easy exchange of the core.img loader binary > - hooks for any disk read (not sure if write is necessary) > > (I didn't check if any of these is already implemented) > > Last part to agree on would then be, that these infrastructure features should > be in the mainline code. Hi, The last stage is much simpler. Just put /boot/ in a crypted filesystem (we have a patch liing around which is pending to merge). That only leaves MBR and core.img. You can either check both from firmware (does any BIOS allow this?) or do some funny gimmicks in MBR ;-) > That way it would be easy to develop various trusted boot solutions (and > probably some other systems too), but keep all the controversial code out of > mainline. I appreciate your interest in avoiding controversy. If you want that, then please don't refer to this as "trusted". It is implied that all the code in GRUB is already trusted by its user. The difference here is that our system would be hardened against physical attack, it doesn't change anything about who is able to "trust" your computer and who isn't. -- Robert Millan The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and how) you may access your data; but nobody's threatening your freedom: we still allow you to remove your data and not access it at all."