3 ms·
The solution for that is Secure Boot. As far as I know TPM is aware of Secure Boot status being changed and will disable/wipe secrets when it happens.
by Kubuxu 6y ago
The solution for that is Secure Boot. As far as I know TPM is aware of Secure Boot status being changed and will disable/wipe secrets when it happens.
- Kubuxu 6y agoDowngrade is an issue as previously signed kernels (before this patch) would be happy with userspace using that TPM config to decrypt the hibernation imagine. As the previous kernels are already signed, downgrading to them is allowed under the Secure Boot, but booting a new version of unsigned kernel on that machine is not.