Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Are boot.img, initrd, and vmlinuz adequate or should the entire contents be hashed? I am not familiar enough with the Linux boot process to answer this with confidence myself.

share|improve this question
I'm not qualified to answer, but I'd imagine that you would additionally need to validate the boot sector to prevent an alternative boot sequence being used. I expect that you would ideally want to hash and check everything except the LUKS encrypted partition. Of-course, this won't help if someone can plant a hardware key logger. –  davidgo Aug 4 '13 at 1:53

1 Answer 1

The safe bet would be to hash all files on /boot (the kernel, system map, MBR and the boot loader configuration) - however who is to say the evil maid won't simply just replace the hashes? So now you need to implement GPG so you can sign & verify the hash file. But what if the evil maid subverts GPG?? Arghhh ...

So, I suggest if you're really worried about that evil maid, a better solution is to keep /boot on a removable keychain type USB device on your belt. It's only needed to boot after all. I use a nifty one on an elastic tether thingy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.