[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug #56887] grub-PC check_signatures=enforce support (non-EFI)

From: adrelanos
Subject: [bug #56887] grub-PC check_signatures=enforce support (non-EFI)
Date: Fri, 13 Sep 2019 02:09:45 -0400 (EDT)
User-agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0


                 Summary: grub-PC check_signatures=enforce support (non-EFI)
                 Project: GNU GRUB
            Submitted by: adrelanos
            Submitted on: Fri 13 Sep 2019 06:09:43 AM UTC
                Category: Security
                Severity: Major
                Priority: 5 - Normal
              Item Group: Feature Request
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
                 Release: 2.02~rc1
         Reproducibility: Every Time
         Planned Release: None



Could you please make it possible to do signature verification with grub-pc


We, the maintainers of Linux distributions that primarily run inside VMs
(Whonix; Kicksecure) would like to implement verified boot. Not necessarily
Secure Boot.

At the moment, there are no tools that can create VM images (with Debian
Linux) which support EFI booting. Also, support by virtualizers such as KVM,
Xen, VirtualBox for Secure Boot is either non-existing or undocumented.

Another reason is, that inside VMs we don’t necessarily need the
complexity of EFI.

Instead we could boot unverified (usual virtual BIOS legacy boot) from a
virtual, read-only (write protected) boot medium (such as ISO). That boot
loader on the initial boot disk (grub2) could then verify and chainload the
boot loader (grub2) on the main disk. Which then would go on to verify the
kernel. In result, we would have a verified boot sequence.


Reply to this item at:


  Message sent via Savannah

reply via email to

[Prev in Thread] Current Thread [Next in Thread]