4 ms·
Is it possible to use secure boot to boot e.g a Linux environment with something like AppArmor enabled in a way that can’t be disabled without resigning a new b
by madjam002 6y ago
Is it possible to use secure boot to boot e.g a Linux environment with something like AppArmor enabled in a way that can’t be disabled without resigning a new bootloader?
- lathiat 6y agoThat’s generally the idea of “lockdown” mode but I’m not sure if it specifically applies to Apparmor. https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html
- gruez 6y agoSecureboot alone can't do it, you'll need a TPM so the disk stays encrypted (and therefore protected from unwanted modifications) and to ensure the keys only get released if the bootloader is verified (to prevent the bootloader/kernel, which must remain unencrypted from being modified).