4

Are boot.img, initrd, and vmlinuz adequate or should the entire contents be hashed? I am not familiar enough with the Linux boot process to answer this with confidence myself.

1
  • 2
    I'm not qualified to answer, but I'd imagine that you would additionally need to validate the boot sector to prevent an alternative boot sequence being used. I expect that you would ideally want to hash and check everything except the LUKS encrypted partition. Of-course, this won't help if someone can plant a hardware key logger.
    – davidgo
    Aug 4, 2013 at 1:53

1 Answer 1

1

The safe bet would be to hash all files on /boot (the kernel, system map, MBR and the boot loader configuration) - however who is to say the evil maid won't simply just replace the hashes? So now you need to implement GPG so you can sign & verify the hash file. But what if the evil maid subverts GPG?? Arghhh ...

So, I suggest if you're really worried about that evil maid, a better solution is to keep /boot on a removable keychain type USB device on your belt. It's only needed to boot after all. I use a nifty one on an elastic tether thingy.

2
  • One should consider using UEFI with SecureBoot or TPM. Because once the system has executed an untrusted bootloader or kernel, it's too late. Mar 28, 2015 at 13:22
  • UEFI has several Ring0 exploits that safety is no longer a safety net :( I personally keep /boot backed up on a usb AND have the system fully shutdown on non use and build my kernel images to be HOST only without hardlinks (so the crypt is not gonna boot without the boot mounted (which without a usb in is not happening) Jun 12, 2015 at 1:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .