9 ms·
PureBoot, the High Security Boot Process
- Boulth 8y agoI must say I am impressed by their level of professionalism and I did setup my own GPG decrypted (with Yubikey) and TPM decrypted LUKS scripts on Arch.
- techntoke 8y agoVery cool. Can you please help add any information to the Arch Wiki about your setup and methods? The information surrounding TPM 2.0 and Secure Boot is lacking, but an area that I hope will be greatly improved an automated.
- transpute 8y agoHere's a 2017 article on Fedora setup with TPM2, https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-unlocking-using-a-tpm2-chip/ https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-...
- tejado 8y ago+1, please share your setup
- Boulth 8y agoSorry for the late reply but check out https://github.com/electrickite/luks-tpm2 https://github.com/electrickite/luks-tpm2 and scencrypt in AUR.
- techntoke 8y agoThat is freaking cool. Thanks!
- Boulth 8y agoNo problem. If I may suggest something if you have TPM version 2 use sha256 everywhere. And you can expand the PCRs list to cover more stuff. I'm using PCRs 0 to 8 (or 9? Can't check now) so any hardware configuration change is apparent during boot. Another useful package is sbupdate [0] that not only signs kernel for SecureBoot but additionally makes it possible to boot the kernel directly from UEFI firmware bypassing the need for bootloader (be it grub or systemd boot). Once setup it just works! [0]: https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate
- bri3d 8y agoMy knee-jerk reaction to this project is that it would be overall inferior to simply allowing coreboot to measure and boot the user's desired Linux distribution directly, and vastly inferior to a small first-stage bootloader written in a safer language than C. I still think that's mostly true - at the end of the day, you're introducing a second Linux distribution to maintain and audit into your bootchain. However, the 33c3 presentation about Heads at least presents a few decent arguments for using Linux : https://trmm.net/Heads_33c3#Philosophy_of_Heads https://trmm.net/Heads_33c3#Philosophy_of_Heads . Fundamentally I'm not sure I agree with the concept that Linux could be more robust, secure, audited, or hardened than an open-source miniaturized early stage bootloader audited by a good security research firm. I think the dated "more eyes makes more more secure software" concept has been fairly debunked at this stage and the path towards security will revolve around smaller trusted components written in a memory-safe language (i.e. not C).
- bubblethink 8y agoThe other downside I see is that it rules out booting other operating systems (at least right now). Other than linux itself (and maybe freebsd?) you can't kexec from a running linux kernel to another OS.
- jacobush 8y agoBut why couldn't you?
- nickik 8y agoYou actually can.
- bubblethink 8y agoHow does one boot windows from a running linux kernel ?
- Iolaum 8y agoI don't know the details but I recall that using linux as a bootloader was a potential threat the ChromeOS people wanted to block with some patches to the Linux kernel that tied it somehow to secure boot that the kernel maintainers (Linus himself commented on the issue as it was controversial) rejected at the form the patches had at the time. Here's a post, with some technical details, from one of the developers that were involved in the issue: https://mjg59.dreamwidth.org/50577.html https://mjg59.dreamwidth.org/50577.html
- elagost 8y agoIt's great that they're putting so much care and attention something that's usually overlooked - motherboards/laptops are released and often shortly abandoned by manufacturers if they're not flagship models, leading to security holes, missing features, or poor performance. Is there any way to tell, prior to purchase, if a system is going to have good support? I have a Dell Latitude from 2012 (Ivy Bridge CPU) and it's still getting BIOS updates, which is great. Seems like similar-year Thinkpads have been abandoned for 4 or 5 years now. (edit: this is incorrect, thanks ac29. Bad comparison. The complaint still stands; many devices are released that see two or less updates, but they tend to be consumer-facing, not business-oriented, like Dell's Latitude line or Lenovo's Thinkpad line.)
- ac29 8y ago> Seems like similar-year Thinkpads have been abandoned for 4 or 5 years now. Hmm? The X230 and T430 (Ivy Bridge era Thinkpads) both had BIOS updates in the past 6 months [0][1]. Lenovo is far from perfect as a vendor, but they are good about firmware updates for Thinkpads. [0] https://support.lenovo.com/us/en/downloads/ds029187 https://support.lenovo.com/us/en/downloads/ds029187 [1] https://support.lenovo.com/us/en/downloads/ds029252 https://support.lenovo.com/us/en/downloads/ds029252
- elagost 8y agoInteresting. Since I last checked, my X220 hadn't received any updates in more than a year, and I run coreboot now, so I've stopped checking. Looking now, it seems they released one in January. Seems like my impressions were wrong.
- joewee 8y agoWhat is amazing is that despite updates, Lenovo still hasn’t fixed the gaping security flaw affecting almost all Thinkpads. https://github.com/Cr4sh/ThinkPwn https://github.com/Cr4sh/ThinkPwn You can’t trust thinkpads for security.
- mehrdadn 8y ago
- SlipperySlope 8y agoLooks to me like a Docker style business model by packaging stuff that exists.
- pizzazzaro 8y agoI dont know about anyone else, but Im a little scared by the fact that I've never owned a coreboot-compatible device. Look around on their website, and you may notice that the compatible hardware selection is rather... limiting. Oh, dont get me wrong. I've flashed the old skylake SOC with a HAP-mode / ME-cleaner variant. But I dont consider that very helpful when compared to an audit-able boot process. How do I go about fixing this? I want coreboot, how do I get in and get it?
- pa7ch 8y agoMaybe not the answer your looking for but any Chromebook has a fork of coreboot that I think follows upstream closely. Chromebooks have been far ahead for awhile in boot security and chromeOS is becoming quite usable with its Linux container support.
- comtn 8y agoThinkpad
- AlexCoventry 8y agoIs there a better Linux option than crouton?
- paraxisi 8y agoI cannot vouch for "better" but there's also croustini.
- jasonvorhe 8y agoYes, Crostini is awesome since it doesn't compromise on security and still offers close to native performance. Integration into Chrome OS is ongoing though. Some features like graphics acceleration and sound are still incomplete.
- akvadrako 8y agoThe thing is it doesn't matter that much anymore, so people aren't working on it. Both AMD and Intel modern CPUs require proprietary embedded firmwares to even get to the boot stage (as you know). And logically it makes sense - there is no real distinction between hardware and software - it should be an implementation detail.
- mr_puzzled 8y agoFirst off, I'm rooting for Purism since they focus on hardware for running linux distros. But, what concerns me is that they don't seem to acknowledge that parts of the system contain proprietary software. - Coreboot iirc requires binary blobs. Libreboot is truly FOSS, but only works on ancient cpus - ME can't actually be disabled completely according to Qubes OS founder Joanna. I think it's crucial to also talk about the limitations of the system.
- codemusings 8y ago> - ME can't actually be disabled completely according to Qubes OS founder Joanna. In case you're referring to her article titled "Intel x86 considered harmful"[1] it's worth noting that she only speculated the following: > A large part of the ME firmware is stored on an SPI flash chip, which admittedly could be reprogrammed using a standard EEPROM programming device to wipe all the ME partition from the flash. But this approach does not have a good chance of succeeding. This is because the processor itself contains an internal boot ROM [37] which is tasked with loading and verifying the rest of the ME code. In case the bootloader is not able to find or verify the signature on the ME firmware, the platform will shutdown. However, if I understand correctly, that's exactly what Youness Alaoui[1] at Purism did. [1] https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf [2] https://puri.sm/posts/deep-dive-into-intel-me-disablement/ https://puri.sm/posts/deep-dive-into-intel-me-disablement/
- pjc50 8y agoBy my reading of this, it's hilarious: they turned on a feature that was provided for the NSA, the "HAP" bit. This put the ME into a special high assurance mode. But because it can't find the rest of the HAP software, it goes into "disabled" mode - without disabling the rest of the platform.
- markjenkinswpg 8y agoA perfect example of getting lucky. How long until subsequent Intel releases lack this.
- ncmncm 8y agoPreviously I have been put off by the greater expense of specialty solutions, vs mass market products: generally, because despite the higher prices, the gains were illusory. A bit of tweaking gave the same (limited!) degree of security on stock hardware. Purism is unique in their defense-in-depth approach. They earn every penny of the higher price, and the price is remarkably little higher. I ordered a Librem 5 phone last year, for more than I had ever paid for a phone, and don't mind waiting while they get it right. The spook agencies should be their biggest customers -- alongside every legislative staff office and flagship-newspaper office.