bugGNU GRUB - Bugs: bug #56887, grub-PC check_signatures=enforce...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #56887: grub-PC check_signatures=enforce support (non-EFI)

Submitter:  adrelanos <adrelanos>
Submitted:  Fri 13 Sep 2019 06:09:43 AM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Feature Request
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  2.02~rc1
Release:  Reproducibility:  Every Time
Planned Release:  None

Fri 13 Sep 2019 06:09:43 AM UTC, original submission:  

Could you please make it possible to do signature verification with grub-pc too?

Rationale:

We, the maintainers of Linux distributions that primarily run inside VMs (Whonix; Kicksecure) would like to implement verified boot. Not necessarily Secure Boot.

At the moment, there are no tools that can create VM images (with Debian Linux) which support EFI booting. Also, support by virtualizers such as KVM, Xen, VirtualBox for Secure Boot is either non-existing or undocumented.

Another reason is, that inside VMs we don’t necessarily need the
complexity of EFI.

Instead we could boot unverified (usual virtual BIOS legacy boot) from a virtual, read-only (write protected) boot medium (such as ISO). That boot loader on the initial boot disk (grub2) could then verify and chainload the boot loader (grub2) on the main disk. Which then would go on to verify the kernel. In result, we would have a verified boot sequence.

 adrelanos <adrelanos>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by adrelanos (Submitted the item)
  • -email is unavailable- added by adrelanos

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-09-13 adrelanos Carbon-Copy- Added adrelanos

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-3b9d.
    Corresponding source code