3 ms·
Agreed, but typically /boot isn't automounted when it's a separate partition, which means they would need a root-access compromise already.
by scott_karana 13y ago
Agreed, but typically /boot isn't automounted when it's a separate partition, which means they would need a root-access compromise already.
- claudius 13y agoThey can replace the booting kernel. Unless you use SecureBoot, TPM or some such thing, there is no way to protect against that (assuming that the attacker has access to the shut-down system at one point and you boot it later).
- mike_esspe 13y agoHetzner allows to netboot any server via admin panel. After booting into recovery os, you can modify unencrypted parts as you wish.