From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1LbGrP-0005ga-2L for mharc-grub-devel@gnu.org; Sun, 22 Feb 2009 11:07:19 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LbGrN-0005g9-Gp for grub-devel@gnu.org; Sun, 22 Feb 2009 11:07:17 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LbGrL-0005eK-AG for grub-devel@gnu.org; Sun, 22 Feb 2009 11:07:16 -0500 Received: from [199.232.76.173] (port=48012 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LbGrL-0005e9-73 for grub-devel@gnu.org; Sun, 22 Feb 2009 11:07:15 -0500 Received: from mta-out.inet.fi ([195.156.147.13]:48767 helo=kirsi2.inet.fi) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LbGrK-00081g-Kd for grub-devel@gnu.org; Sun, 22 Feb 2009 11:07:14 -0500 Received: from [192.168.1.102] (84.248.105.254) by kirsi2.inet.fi (8.5.014) id 48FC5B890562635B for grub-devel@gnu.org; Sun, 22 Feb 2009 18:07:14 +0200 Message-ID: <49A1782B.3010000@nic.fi> Date: Sun, 22 Feb 2009 18:07:07 +0200 From: =?ISO-8859-1?Q?Vesa_J=E4=E4skel=E4inen?= User-Agent: Thunderbird 2.0.0.19 (Windows/20081209) MIME-Version: 1.0 To: The development of GRUB 2 References: <49A152BD.6010907@student.ethz.ch> In-Reply-To: <49A152BD.6010907@student.ethz.ch> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 3) Subject: Re: GRUB trusted boot framework X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Feb 2009 16:07:17 -0000 Hi All, Ok. Please keep the fighting of TPM out of this thread ;). Lets keep it to the topic first... (I am already waiting for summary of that other discussion at some point ;)) Jan Alsenz wrote: > Next I think we can agree, that some sort of trusted boot chain can be useful. > > Also there should be more than one implementation for this (or at least the > possibility to have them). I like the idea of modularity in here. However. It should work with different schemes but same generic interfaces if that is what is planned. > If we could agree on this, then I think we could find a way to extend the GRUB > module system to fully allow this. > > From my point of view the minimal needed features for these systems are: > - easy exchange of the MBR binary to be installed > - easy exchange of the core.img loader binary > - hooks for any disk read (not sure if write is necessary) Note: I will skip MBR+core.img validation for a reason here now. I do like the idea what some protected systems use, they sign the binary (in our case .mod file and kernels of loaded OSes). Now in that scenario it is responsibility of the kernel module loader to first verify the signature for correctness. This way the signature checking would be somewhat transparent to the rest of the system. I do not see a need to add any hooks to disk read. It should be responsibility of the code needing signature checking to handle that. And please try to share some code with password/authentication features :) > Last part to agree on would then be, that these infrastructure features should > be in the mainline code. > That way it would be easy to develop various trusted boot solutions (and > probably some other systems too), but keep all the controversial code out of > mainline. Yes.