Conversation

Notices

1. Embed this notice
   Lennart Poettering (pid_eins@mastodon.social)'s status on Friday, 01-Nov-2024 06:33:24 JST Lennart Poettering

   2️⃣ Here's the 2nd installment of posts highlighting key new features of the upcoming v257 release of systemd.

   In the past year and a bit I spent a lot of time on boot integrity (i.e. boot-time TPM measurements and policies built on top of them) of Linux, covering the boot from the boot loader (systemd-boot), over the UKI EFI stub (systemd-stub) through the initrd into early regular userspace, and then locking disk encryption to it.

   • alcinnz repeated this.
   • Embed this notice
     Lennart Poettering (pid_eins@mastodon.social)'s status on Friday, 01-Nov-2024 06:33:24 JST Lennart Poettering

     in reply to

     If you ask me, it's a fundamental requirement for any modern Linux-based OS to provide boot time integrity and as baseline provide unattended disk encryption bound to it. To make this happen, we added two essential TPM policy concepts to systemd-cryptenroll/systemd-cryptsetup:

     1. Signed TPM PCR policies allow locking a disk to a public signing key of an OS vendor, ensuring that disks can only be unlocked if an OS signed by said vendor is booted.