3 ms·

Isn’t the idea that the kernel will verify anything beneath it. Secure boot verifies the kernel and then it’s in the hands of the kernel to keep verifying or no

• Nextgrid 9mo ago
  > the kernel will verify anything beneath it Yes that's the case - my argument is that Linux currently doesn't have anything standardized to do that. Your best bet for now is to use a read-only dm-verity-protected volume as the root partition, encode its hash in the initrd, combine kernel + initrd into a UKI and sign that. I would welcome a standardized approach.
  • jcgl 9mo ago
    Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together. ParticleOS[0] gives a look at how this can all fit together, in case you want to see some of it in action. [0] https://github.com/systemd/particleos https://github.com/systemd/particleos