4 ms·

I’ve seen this on Twitter a couple times today. Is it even possible to involve GRUB in a secure boot setup in a way that’s actually secure? I’ve never encounter

I’ve seen this on Twitter a couple times today. Is it even possible to involve GRUB in a secure boot setup in a way that’s actually secure? I’ve never encountered a Linux (other than gentoo, but that’s not exactly normal) where the initramfs wasn’t in plaintext, and unsigned. You can get whatever arbitrary code you want running as PID 1 from there. If you want secure boot, the way that makes sense is to use your own keys and combine the initramfs and command line with the kernel, and sign that with your secure boot keys. I don’t know why there isn’t a super slick way of doing that, but it is definitely smooth and more secure. Wasn’t EFI supposed to free us from things like GRUB anyway?

drvdevd 6y ago
This is along the lines of what I’ve been wondering as well. Secure boot is really the only line of defense here and it seems to be highly underutilized, to the point of making this grub issue look less worthy of press releases. And even if we did have a nice UI or workflow to get more people using secure boot, securely, there will certainly be bugs in the EFI implementations to compromise the boot chain there as well.
vladvasiliu 6y ago
This is how my arch box is setup. I've done it by following some page on the arch wiki [0]. There is only one binary containing the kernel itself, the kernel command line and initrd that is signed and booted directly by the EFI. There's no bootloader in the grub sense. That being said, I can see how one could argue that that's "not exactly normal", in the same sense that gentoo isn't. I'm surprised this isn't more widespread, especially since most UEFI PC's I've seen have a very practical way of choosing which OS to boot. [0] https://wiki.archlinux.org/index.php/EFISTUB https://wiki.archlinux.org/index.php/EFISTUB
tomatocracy 6y ago
You can create a version of grub which requires gpg signatures for everything it loads, including any modules, the initramfs and grub.cfg, then sign that version of grub with a secure boot key. You'll possibly need to then sign your kernel twice (once with sbsigntool and once with gpg). I don't know if this meets your definition of "actually secure" but it does mitigate the issues around initramfs etc.

drvdevd 6y ago

This is along the lines of what I’ve been wondering as well. Secure boot is really the only line of defense here and it seems to be highly underutilized, to the point of making this grub issue look less worthy of press releases. And even if we did have a nice UI or workflow to get more people using secure boot, securely, there will certainly be bugs in the EFI implementations to compromise the boot chain there as well.

vladvasiliu 6y ago

This is how my arch box is setup. I've done it by following some page on the arch wiki [0]. There is only one binary containing the kernel itself, the kernel command line and initrd that is signed and booted directly by the EFI. There's no bootloader in the grub sense. That being said, I can see how one could argue that that's "not exactly normal", in the same sense that gentoo isn't. I'm surprised this isn't more widespread, especially since most UEFI PC's I've seen have a very practical way of choosing which OS to boot. [0] https://wiki.archlinux.org/index.php/EFISTUB https://wiki.archlinux.org/index.php/EFISTUB

tomatocracy 6y ago

You can create a version of grub which requires gpg signatures for everything it loads, including any modules, the initramfs and grub.cfg, then sign that version of grub with a secure boot key. You'll possibly need to then sign your kernel twice (once with sbsigntool and once with gpg). I don't know if this meets your definition of "actually secure" but it does mitigate the issues around initramfs etc.