5 ms·
Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'
by TacticalCoder 3y ago
Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'ish (and it does work: I tried modifying a single bit from my kernel and the UEFI refused to boot it) but it's not that great if the attacker can still modify the initrd etc.
- rubicks 3y agoI thought "unified image" solved this? https://wiki.archlinux.org/title/Unified_kernel_image#Preparing_a_unified_kernel_image https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...
- DHowett 3y agoIndeed, that is what the parent is referring to when they say this: > Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense (It's much more useful to have a link to it, so thank you!)