Re: GRUB trusted boot framework

["Vesa Jääskeläinen" <chaac@nic.fi>]

Hi All,

Ok. Please keep the fighting of TPM out of this thread ;). Lets keep it
to the topic first... (I am already waiting for summary of that other
discussion at some point ;))

Jan Alsenz wrote:
> Next I think we can agree, that some sort of trusted boot chain can be useful.
> 
> Also there should be more than one implementation for this (or at least the
> possibility to have them).

I like the idea of modularity in here. However. It should work with
different schemes but same generic interfaces if that is what is planned.

> If we could agree on this, then I think we could find a way to extend the GRUB
> module system to fully allow this.
> 
> From my point of view the minimal needed features for these systems are:
> - easy exchange of the MBR binary to be installed
> - easy exchange of the core.img loader binary
> - hooks for any disk read (not sure if write is necessary)

Note: I will skip MBR+core.img validation for a reason here now.

I do like the idea what some protected systems use, they sign the binary
(in our case .mod file and kernels of loaded OSes). Now in that scenario
it is responsibility of the kernel module loader to first verify the
signature for correctness. This way the signature checking would be
somewhat transparent to the rest of the system.

I do not see a need to add any hooks to disk read. It should be
responsibility of the code needing signature checking to handle that.

And please try to share some code with password/authentication features :)

> Last part to agree on would then be, that these infrastructure features should
> be in the mainline code.
> That way it would be easy to develop various trusted boot solutions (and
> probably some other systems too), but keep all the controversial code out of
> mainline.

Yes.