12 ms·

Linux and TPMs with systemd measured boot [video]

124 points by transpute 3y ago

pzmarzly 3y ago
I am not a big fan of systemd, but I am impressed in how they put this security feature all across the boot process. I also used some of the tools shown in presentation and they are pretty well made, kudos to the devs. (Also, most of them work fine without systemd running, they just happen to be in the systemd monorepo???)
- andrewstuart 3y ago
  Systemd is packed with impressive things. The more you research it, the more you find to be impressed with.
  - keep_reading 3y ago
    I'll be impressed when they figure out how to not break bind mounts and NFS on boot
  - immibis 3y ago
    The problem with systemd isn't that it's not packed with impressive things, it's how inextricable the things are from each other. systemd distros are practically whole new distros on the inside, designed by committee. Every part of systemd really wants to integrate with every other part, so while you can technically compile and run just part of it, it really wants you to use the whole thing and throw away all the things those parts replace. In other words the complaints are political, not technical.
    - matheusmoreira 3y ago
      It's just user space though. As long as the kernel remains independent there's problem.
  - pzmarzly 3y ago
    I agree that there are some very cool components of systemd (or rather, very cool programs living in systemd repo) - networkd, resolved, repart, boot and stub come to my mind first, they have no alternatives that come even close to them. Also, systemd made writing service definitions easy, hats off to them. With cgroups, namespaces and capabilities support out of the box - great. However, every time I have to debug why some target wasn't reached (because some dependency of dependency failed), or why systemd mounted something wrongly, or just want to know how often and why some service restarted, I feel like the core part of systemd (which is, the systemd init and service runner) is working against me. And let's not get started on journald, I declare it my enemy.
  - zlg_codes 3y ago
    I've kept my eye on the project from afar. What's impressive about systemd aside from its ability to manifest conformity and avoid social accountability for how it gained influence? Boot charts and NIH syndrome for system level stuff ain't it for me. Binary journals ain't it, either. Services suck, you're never sure the difference between units, services, sockets, and other similar INI style files. Extra BS like $HOME management? Not necessary. In over ten years, I've not found a single good reason to lean into systemd or like it. It runs my current computer, but not by choice and I will remedy that when I build my custom distro.
- esjeon 3y ago
  This thing isn't really complicated, because all the hard-lifting is done by the design of TPM, not even TPM chips. Measurements and integrity checks are proven to be mundane tasks, and, for security, it's a good thing. Even without systemd, one can learn and integrate TPM in one or two months. But the systemd team has been working on this like 2 years now. I'm quite curious what they've been doing. Security audits, maybe? Preparations for other integrations? I'm not criticizing here - I've been away from that scene for an year, and I wonder if there have been some new interesting developments or ideas that I'm not aware of.
pzmarzly 3y ago
I wonder which of these tools Ubuntu is using - since they enabled TPM-backed encryption (Bitlocker-style) in 23.10. https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-coming-to-ubuntu https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-c... I am not a huge fan of relying on this, I cannot recall numer of times where I had to recover my files from live USB or by plugging my drive into another PC - both of which will get difficult to do when my true password sits in TPM on the (potentially bricked) motherboard. But I guess that if it can be used in addition to regular password (e.g. use regular password when TPM is missing, use PIN if it works) then it's fine
- Manfred 3y ago
  Do you prefer restoring from the original drive instead of a backup because it's faster?
  - magicalhippo 3y ago
    I use a daily full-disk backup on Windows[1], this has allowed me to be back up and running within the hour the few cases my disk died. What's a good alternative for Linux? [1]: Acronis TrueImage, but there are others.
    - jeroenhd 3y ago
      With modern file systems like BTRFS you could take a(n incremental) snapshot and send that over the network using btrfs send. Filesystems without snapshots can't be disk cloned that easily, but tools like Timeshift will try to replicate snapshot behaviour using hardlinks, so I assume backups of Timeshift snapshots should also suffice. Timeshift can be configured in various ways, including making daily snapshots. I mostly use it for periodic snapshots and snapshots taken before the package manager runs (as a poor man's System Restore alternative). I don't think Timeshift supports automatically sending snapshots just yet. For that, you'd need to set up a cronjob or systemd timer.
      - o11c 3y ago
wolf550e 3y ago
I want a review of this by mjg59.
harvie 3y ago
TPM chips are not opensource, end user cannot simply check them for backdoors. Manufacturers of these chips are under heavy scrutiny of intelligence agencies. Governments around the world try their best to prevent people from using strong cryptography (eg. limiting effective key lengths in various ways). Why should we trust such chips more than purely software based approach?
- _8j50 3y ago
  Because it isn't a silver bullet but rather a countermeasure against rootkits, bootkits and certain physical tampering by regular and insider threat actors.
- isilofi 3y ago
  We shouldn't. TPM-based security is only sufficient against unsophisticated attackers such as a common thief stealing your laptop from your backpack.
  - jon-wood 3y ago
    This is a massive overstatement of the situation. Sure, a TPM might not protect you against the NSA or the Chinese government stealing your computer. If configured correctly it probably will protect you against anything less than a major nation state stealing your computer.
    - justaj 3y ago
      But wouldn't a properly configured LUKS encryption protect against nation-state threats too? If so, then why still use TPM?
      - lostmsu 3y ago
        If machine is not attached to a terminal it is useful if it boots on its own.
        3y ago
mongol 3y ago
I think the topic of Lennart's talks usually is very interesting but his delivery assumes the audience knows much more about the subject than I do, at least. Most other talks I watch I have an easier time to follow.
- mqus 3y ago
  Do you have an example for stuff that the audience is expected to know? Or the other talks that do a better job? What kind of background do you have? Assuming an average full stack dev, of course he addresses a different audience, since this is a talk addressed to Linux OS developers at a conference with the description: "All Systems Go! is a conference focused on foundational user-space Linux technologies. Its goal is to provide a gathering place for both contributors and users of projects that make up the foundation of modern Linux systems." So, summing up: maybe you are not part of the target audience?
- esjeon 3y ago
  I think this one is especially worse, because TPM is a piece of hardware and is for security. The combination of the two alienates a lot of software engineers, like >90%. I've never met anyone in real-life who already knew how to use TPM, though many do know what it is and what it's for. So, it's really a bad (or s**ty) topic to talk about in front of an unsuspecting audience, but certainly there are people who would appreciate the work, especially in embedded/robotics fields (which have been rising slowly for a long time).
- Arnavion 3y ago
  The vidoes are mostly a condensed form of the blogposts he's been writing on these topics (filesystem layout / Boot Loader Specification / Secure Boot / Measured Boot / Unified Kernel Images) for a couple of years now, so you can read those if you prefer. https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-... https://0pointer.net/blog/the-wondrous-world-of-discoverable-gpt-disk-images.html https://0pointer.net/blog/the-wondrous-world-of-discoverable... https://0pointer.net/blog/authenticated-boot-and-disk-encryption-on-linux.html https://0pointer.net/blog/authenticated-boot-and-disk-encryp... https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/linux-boot-partitions.html https://0pointer.net/blog/linux-boot-partitions.html
shrubble 3y ago
Not just no, but heck no! TPM will never be auditable, and therefore can never be considered trustworthy.
ok123456 3y ago
[flagged]
chlorion 3y ago
Just a heads up for anyone using AMD CPUs fTPM, it is completely broken and cannot be used even for "someone stealing your laptop". A few hours time and a few tools can fully compromise the TPM's secrets. This can be performed by anyone who has a little experience tinkering with electronics, someone who can use a soldering iron for example can almost certainly pull this off. From my understanding all of the "zen" CPUs are effected except for maybe the very most recent models. https://arxiv.org/abs/2304.14717 https://arxiv.org/abs/2304.14717
- bootsmann 3y ago
  Note that this attack only works if you don’t enroll an additional password to unlock the TPM (see 5.3 of your linked paper).

124 points by transpute 3y ago

I am not a big fan of systemd, but I am impressed in how they put this security feature all across the boot process. I also used some of the tools shown in presentation and they are pretty well made, kudos to the devs. (Also, most of them work fine without systemd running, they just happen to be in the systemd monorepo???)

andrewstuart 3y ago
Systemd is packed with impressive things. The more you research it, the more you find to be impressed with.
- keep_reading 3y ago
  I'll be impressed when they figure out how to not break bind mounts and NFS on boot
- immibis 3y ago
  The problem with systemd isn't that it's not packed with impressive things, it's how inextricable the things are from each other. systemd distros are practically whole new distros on the inside, designed by committee. Every part of systemd really wants to integrate with every other part, so while you can technically compile and run just part of it, it really wants you to use the whole thing and throw away all the things those parts replace. In other words the complaints are political, not technical.
  - matheusmoreira 3y ago
    It's just user space though. As long as the kernel remains independent there's problem.
- pzmarzly 3y ago
  I agree that there are some very cool components of systemd (or rather, very cool programs living in systemd repo) - networkd, resolved, repart, boot and stub come to my mind first, they have no alternatives that come even close to them. Also, systemd made writing service definitions easy, hats off to them. With cgroups, namespaces and capabilities support out of the box - great. However, every time I have to debug why some target wasn't reached (because some dependency of dependency failed), or why systemd mounted something wrongly, or just want to know how often and why some service restarted, I feel like the core part of systemd (which is, the systemd init and service runner) is working against me. And let's not get started on journald, I declare it my enemy.
- zlg_codes 3y ago
  I've kept my eye on the project from afar. What's impressive about systemd aside from its ability to manifest conformity and avoid social accountability for how it gained influence? Boot charts and NIH syndrome for system level stuff ain't it for me. Binary journals ain't it, either. Services suck, you're never sure the difference between units, services, sockets, and other similar INI style files. Extra BS like $HOME management? Not necessary. In over ten years, I've not found a single good reason to lean into systemd or like it. It runs my current computer, but not by choice and I will remedy that when I build my custom distro.
esjeon 3y ago
This thing isn't really complicated, because all the hard-lifting is done by the design of TPM, not even TPM chips. Measurements and integrity checks are proven to be mundane tasks, and, for security, it's a good thing. Even without systemd, one can learn and integrate TPM in one or two months. But the systemd team has been working on this like 2 years now. I'm quite curious what they've been doing. Security audits, maybe? Preparations for other integrations? I'm not criticizing here - I've been away from that scene for an year, and I wonder if there have been some new interesting developments or ideas that I'm not aware of.

pzmarzly 3y ago

I wonder which of these tools Ubuntu is using - since they enabled TPM-backed encryption (Bitlocker-style) in 23.10. https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-coming-to-ubuntu https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-c... I am not a huge fan of relying on this, I cannot recall numer of times where I had to recover my files from live USB or by plugging my drive into another PC - both of which will get difficult to do when my true password sits in TPM on the (potentially bricked) motherboard. But I guess that if it can be used in addition to regular password (e.g. use regular password when TPM is missing, use PIN if it works) then it's fine

Manfred 3y ago
Do you prefer restoring from the original drive instead of a backup because it's faster?
- magicalhippo 3y ago
  I use a daily full-disk backup on Windows[1], this has allowed me to be back up and running within the hour the few cases my disk died. What's a good alternative for Linux? [1]: Acronis TrueImage, but there are others.
  - jeroenhd 3y ago
    With modern file systems like BTRFS you could take a(n incremental) snapshot and send that over the network using btrfs send. Filesystems without snapshots can't be disk cloned that easily, but tools like Timeshift will try to replicate snapshot behaviour using hardlinks, so I assume backups of Timeshift snapshots should also suffice. Timeshift can be configured in various ways, including making daily snapshots. I mostly use it for periodic snapshots and snapshots taken before the package manager runs (as a poor man's System Restore alternative). I don't think Timeshift supports automatically sending snapshots just yet. For that, you'd need to set up a cronjob or systemd timer.
    - o11c 3y ago

wolf550e 3y ago

I want a review of this by mjg59.

harvie 3y ago

TPM chips are not opensource, end user cannot simply check them for backdoors. Manufacturers of these chips are under heavy scrutiny of intelligence agencies. Governments around the world try their best to prevent people from using strong cryptography (eg. limiting effective key lengths in various ways). Why should we trust such chips more than purely software based approach?

_8j50 3y ago
Because it isn't a silver bullet but rather a countermeasure against rootkits, bootkits and certain physical tampering by regular and insider threat actors.
isilofi 3y ago
We shouldn't. TPM-based security is only sufficient against unsophisticated attackers such as a common thief stealing your laptop from your backpack.
- jon-wood 3y ago
  This is a massive overstatement of the situation. Sure, a TPM might not protect you against the NSA or the Chinese government stealing your computer. If configured correctly it probably will protect you against anything less than a major nation state stealing your computer.
  - justaj 3y ago
    But wouldn't a properly configured LUKS encryption protect against nation-state threats too? If so, then why still use TPM?
    - lostmsu 3y ago
      If machine is not attached to a terminal it is useful if it boots on its own.
      - 3y ago

mongol 3y ago

I think the topic of Lennart's talks usually is very interesting but his delivery assumes the audience knows much more about the subject than I do, at least. Most other talks I watch I have an easier time to follow.

mqus 3y ago
Do you have an example for stuff that the audience is expected to know? Or the other talks that do a better job? What kind of background do you have? Assuming an average full stack dev, of course he addresses a different audience, since this is a talk addressed to Linux OS developers at a conference with the description: "All Systems Go! is a conference focused on foundational user-space Linux technologies. Its goal is to provide a gathering place for both contributors and users of projects that make up the foundation of modern Linux systems." So, summing up: maybe you are not part of the target audience?
esjeon 3y ago
I think this one is especially worse, because TPM is a piece of hardware and is for security. The combination of the two alienates a lot of software engineers, like >90%. I've never met anyone in real-life who already knew how to use TPM, though many do know what it is and what it's for. So, it's really a bad (or s**ty) topic to talk about in front of an unsuspecting audience, but certainly there are people who would appreciate the work, especially in embedded/robotics fields (which have been rising slowly for a long time).
Arnavion 3y ago
The vidoes are mostly a condensed form of the blogposts he's been writing on these topics (filesystem layout / Boot Loader Specification / Secure Boot / Measured Boot / Unified Kernel Images) for a couple of years now, so you can read those if you prefer. https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-... https://0pointer.net/blog/the-wondrous-world-of-discoverable-gpt-disk-images.html https://0pointer.net/blog/the-wondrous-world-of-discoverable... https://0pointer.net/blog/authenticated-boot-and-disk-encryption-on-linux.html https://0pointer.net/blog/authenticated-boot-and-disk-encryp... https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/linux-boot-partitions.html https://0pointer.net/blog/linux-boot-partitions.html

shrubble 3y ago

Not just no, but heck no! TPM will never be auditable, and therefore can never be considered trustworthy.

ok123456 3y ago

[flagged]

chlorion 3y ago

Just a heads up for anyone using AMD CPUs fTPM, it is completely broken and cannot be used even for "someone stealing your laptop". A few hours time and a few tools can fully compromise the TPM's secrets. This can be performed by anyone who has a little experience tinkering with electronics, someone who can use a soldering iron for example can almost certainly pull this off. From my understanding all of the "zen" CPUs are effected except for maybe the very most recent models. https://arxiv.org/abs/2304.14717 https://arxiv.org/abs/2304.14717

bootsmann 3y ago
Note that this attack only works if you don’t enroll an additional password to unlock the TPM (see 5.3 of your linked paper).