[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Linux DRTM on UEFI platforms
From: |
Matthew Garrett |
Subject: |
Re: Linux DRTM on UEFI platforms |
Date: |
Wed, 30 Mar 2022 08:11:03 +0100 |
User-agent: |
Mutt/1.10.1 (2018-07-13) |
On Wed, Mar 30, 2022 at 09:02:18AM +0200, Ard Biesheuvel wrote:
> Wouldn't it be better for the secure launch kernel to boot the EFI
> entrypoint directly? As it happens, I just completed a PoC last week
> for a minimal implementation of EFI (in Rust) that only carries the
> pieces that the EFI stub needs to boot Linux. It is currently just a
> proof of concept that only works on QEMU/arm64, but it should not be
> too hard to adapt it for x86 and for booting a kernel that has already
> been loaded to memory.
The EFI stub carries out a bunch of actions that have meaningful
security impact, and that's material that should be measured. Having the
secure launch kernel execute the stub without awareness of what it does
means it would need to measure the code without measuring the state,
while the goal of DRTM solutions is to measure state rather than the
code.
- Linux DRTM on UEFI platforms, Matthew Garrett, 2022/03/29
- Re: Linux DRTM on UEFI platforms, Ard Biesheuvel, 2022/03/30
- Re: Linux DRTM on UEFI platforms,
Matthew Garrett <=
- Re: Linux DRTM on UEFI platforms, Ard Biesheuvel, 2022/03/30
- Re: Linux DRTM on UEFI platforms, Matthew Garrett, 2022/03/30
- Re: Linux DRTM on UEFI platforms, Ard Biesheuvel, 2022/03/30
- Re: Linux DRTM on UEFI platforms, Matthew Garrett, 2022/03/30
- Re: Linux DRTM on UEFI platforms, Ard Biesheuvel, 2022/03/30
- Re: Linux DRTM on UEFI platforms, James Bottomley, 2022/03/30
Re: Linux DRTM on UEFI platforms, Daniel P. Smith, 2022/03/30