4 ms·
As for secure boot, assuming plan9 can boot from a read-only volume, that shouldn't be hard to implement. The (simplified) way it works on most systems is that
by eschneider 3y ago
As for secure boot, assuming plan9 can boot from a read-only volume, that shouldn't be hard to implement. The (simplified) way it works on most systems is that secure boot is implement in the SOC and that's used to verify the installed bootloader and then the verified bootloader verifies that the boot volume is unmodified (think checksum, but a bit more complicated to make it boot faster. :) There isn't anything about that that couldn't be incorporated into almost any boot process.
- hollerith 3y agoIf it isn't hard to implement why does no Linux distro besides bottlerocket (specialized for use on AWS and other cloud services) Android and ChromeOS do it?
- stonogo 3y agoDebian, Ubuntu, Red Hat, Fedora, Suse, Arch, Gentoo, and Slackware all support secureboot. After that I got tired of looking up linux distributions, so there are likely more.
- hollerith 3y agoRight but none of those verify /usr like Android, iOS, Windows, MacOS and ChromeOS do.
- stonogo 3y agoThat's not part of secureboot's remit, but distros who do it are generally referred to as 'immutable distros'. Fedora Silverblue, CarbonOS, NixOS, GUIX, Endless OS, and Vanilla OS are a few.
- hollerith 3y agoNone of the distros you list verifies the software installed by the package manager (except sometimes the kernel and the initrd) at boot time and refuses to finish the boot process if the verification fails. I guess an argument can be made that immutability would make it easier to achieve such a "verified boot process", but none of the distros you list has done the work. Also, Silverblue's home page does not even list "secure" or "security" as one of the benefits of Silverblue. (They list reliable, atomic, the ability to revert the system, containerized, developer-friendly, no ads, "all your data belongs to you", and open-source.)