Re: GRUB trusted boot framework

[Jan Alsenz]

Vesa Jääskeläinen write:
> Hi All,
> 
> Ok. Please keep the fighting of TPM out of this thread ;). Lets keep it
> to the topic first... (I am already waiting for summary of that other
> discussion at some point ;))
> 
> Jan Alsenz wrote:
>> Next I think we can agree, that some sort of trusted boot chain can be 
>> useful.
>>
>> Also there should be more than one implementation for this (or at least the
>> possibility to have them).
> 
> I like the idea of modularity in here. However. It should work with
> different schemes but same generic interfaces if that is what is planned.

That was what I had in mind.

>> If we could agree on this, then I think we could find a way to extend the 
>> GRUB
>> module system to fully allow this.
>>
>> From my point of view the minimal needed features for these systems are:
>> - easy exchange of the MBR binary to be installed
>> - easy exchange of the core.img loader binary
>> - hooks for any disk read (not sure if write is necessary)
> 
> Note: I will skip MBR+core.img validation for a reason here now.
> 
> I do like the idea what some protected systems use, they sign the binary
> (in our case .mod file and kernels of loaded OSes). Now in that scenario
> it is responsibility of the kernel module loader to first verify the
> signature for correctness. This way the signature checking would be
> somewhat transparent to the rest of the system.
> 
> I do not see a need to add any hooks to disk read. It should be
> responsibility of the code needing signature checking to handle that.

Well, since to trusted operation should be transparent (and in my opinion should
not need code changes in something like the loaders - so if someone writes a new
loader, it should work by default), that's where the hooks come in.
Maybe the "disk read" was misleading, what I meant where "file reads".

Greets,

Jan

signature.asc
Description: OpenPGP digital signature