3 ms·
If the attacker can modify the kernel then I think you have already lost the battle. This script, as it says in README, checks that the files in /boot have not
by jakobdabo 11y ago
If the attacker can modify the kernel then I think you have already lost the battle. This script, as it says in README, checks that the files in /boot have not been altered between reboots.
- mjg59 11y ago> If the attacker can modify the kernel then I think you have already lost the battle. By that argument, if the attacker can modify the contents of /boot then you've lost and this doesn't buy you anything.
- jakobdabo 11y agoMy understanding is (I may be wrong) that this script protects from physical attacks when the attacker covertly modifies your /boot partition (where the kernel resides along with the initramfs) while your computer is turned off. The attacker can not modify the other partitions because they are encrypted.
- mjg59 11y agoThe attacker modifies the on-disk copy of the kernel such that when userspace tries to read the kernel it gets given a backed up copy of the unmodified kernel. Chkboot says everything is fine, but in reality the system is backdoored.
- jakobdabo 11y agoI agree then, sorry I failed to see your point in your first comment.
- keeperofdakeys 11y agoHere is a great talk by mjg59 about using the TPM, and why it's required https://www.youtube.com/watch?v=rML5DfYUh_k https://www.youtube.com/watch?v=rML5DfYUh_k