Is Linux able to perform any kind of Measured Boot?
1
Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.)
Is Linux (without any additional modules) able or is there any Linux-distro out there that is able to also perform any kind of Measured Boot using a TPM alongside Secure Boot?
boot-loader malware tpm
asked Oct 20 '18 at 20:04
FPUFPU
62
|
show 2 more comments
1
Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.)
Is Linux (without any additional modules) able or is there any Linux-distro out there that is able to also perform any kind of Measured Boot using a TPM alongside Secure Boot?
boot-loader malware tpm
asked Oct 20 '18 at 20:04
FPUFPU
62
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot optionima_tcbto the/etc/default/grubconfiguration file."
– FPU
Oct 21 '18 at 20:26
|
show 2 more comments
1
1
1
Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.)
Is Linux (without any additional modules) able or is there any Linux-distro out there that is able to also perform any kind of Measured Boot using a TPM alongside Secure Boot?
boot-loader malware tpm
asked Oct 20 '18 at 20:04
FPUFPU
62
Some Linux-distro's support Secure Boot. (These distro's use a 1st-stage bootloader signed by Microsoft.)
Is Linux (without any additional modules) able or is there any Linux-distro out there that is able to also perform any kind of Measured Boot using a TPM alongside Secure Boot?
boot-loader malware tpm
boot-loader malware tpm
asked Oct 20 '18 at 20:04
FPUFPU
62
asked Oct 20 '18 at 20:04
FPUFPU
62
edited Oct 21 '18 at 11:25
FPU
asked Oct 20 '18 at 20:04
FPUFPU
62
asked Oct 20 '18 at 20:04
FPUFPU
62
asked Oct 20 '18 at 20:04
FPUFPU
62
62
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot optionima_tcbto the/etc/default/grubconfiguration file."
– FPU
Oct 21 '18 at 20:26
|
show 2 more comments
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot optionima_tcbto the/etc/default/grubconfiguration file."
– FPU
Oct 21 '18 at 20:26
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot option
ima_tcb to the /etc/default/grub configuration file."– FPU
Oct 21 '18 at 20:26
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot option
ima_tcb to the /etc/default/grub configuration file."– FPU
Oct 21 '18 at 20:26
|
show 2 more comments
1 Answer
1
active
oldest
votes
0
I hope this article helps you
http://www.linux-magazine.com/Issues/2018/206/Trusted-Platform-Module
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f476790%2fis-linux-able-to-perform-any-kind-of-measured-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
I hope this article helps you
http://www.linux-magazine.com/Issues/2018/206/Trusted-Platform-Module
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
0
I hope this article helps you
http://www.linux-magazine.com/Issues/2018/206/Trusted-Platform-Module
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
0
0
0
I hope this article helps you
http://www.linux-magazine.com/Issues/2018/206/Trusted-Platform-Module
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I hope this article helps you
http://www.linux-magazine.com/Issues/2018/206/Trusted-Platform-Module
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
answered 13 mins ago
Uddhav GautamUddhav Gautam
1034
1034
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Uddhav Gautam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f476790%2fis-linux-able-to-perform-any-kind-of-measured-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
From what i've been reading: Trusted Boot != Measured Boot. Trusted Boot extends the chain of trust started by Secure Boot. Trusted Boot does not need a TPM. Measured Boot requires a TPM (Trusted Platform Module) to store the measurements.
– FPU
Oct 20 '18 at 20:04
Measured boot is a microsoft term. The Linux equivalent is IMA Integrity Measurement Architecture developed by IBM, which has been around since kernel 2.6.30, or about 2004.
– meuh
Oct 21 '18 at 7:30
@meuh Thanks! IMA requires a TPM. Let's say i enter UEFI setup and clear the TPM before doing a clean install of Linux, then what happens? Will TrouSerS initialize the TPM automagically (during installation) such that IMA can make use of it?
– FPU
Oct 21 '18 at 11:14
This is a complex subject about which I know little, and it has moved on since I last looked at it. You need to study a whole lot of documentation to understand the security implications of each step and even know what questions to ask. Installation is not necessarily the most important part, as each bootup to the kernel and application has to verifiable, independently of how you got there. Ubuntu was the distribution that talked most about secure boot, so perhaps you can start there; eg strongswan says 14.04 LTS has an IMA kernel.
– meuh
Oct 21 '18 at 13:57
"Ubuntu 14.04 LTS is one of the few Linux distributions which have IMA capability already compiled into their Linux kernel (CONFIG_IMA=y). This has the advantage that no special kernel must be built which can become quite involved if you intend to use IMA in conjunction with Secure Boot requiring a signed kernel. With Ubuntu 14.04 LTS, activating IMA in the kernel is a piece of cake; just add the boot option
ima_tcbto the/etc/default/grubconfiguration file."– FPU
Oct 21 '18 at 20:26