1

Isn't unencrypted /boot partition a weakness for encrypted LVM setup? Attacker may install a malware to /boot partition so that it may sniff encryption password next time system boots. It may also be done by a malware installed to Windows on dual-boot system without any physical access.

Am I missing some protection scheme or at least I may verify that /boot contents didn't change since last system shutdown?

3 Answers 3

1

If you're concerned about file integrity, you could use UEFI secure boot. You can either use a signed kernel from your Linux distribution or use a self-signed one as is explained in http://kroah.com/log/blog/2013/09/02/booting-a-self-signed-linux-kernel/. Self-signing isn't very comfortable yet, as you either have to include the initrd in the kernel or work completely without one. And you have to specify the kernel comand line at compile time.

1
  • UEFI secure boot is just about that, thanks! Seems that major distros already support it and there's no need to self-sign a bootloader/kernel. As for hardware that doesn't support UEFI, things like tripwire are still better than nothing.
    – ml43
    Nov 2, 2013 at 20:11
0

With the current methods to implement encryption on LVM volumes, one can not encrypt /boot. If one did, it would be impossible to boot the operating system unless the hardware on your motherboard supports it. I have not seen or heard of hardware that can do this so far, but it might exist.

From the Archwiki: In most setups, a dedicated /boot partition is not necessary, but it is in a complex setup like this one, because GRUB needs to be able to read the kernel, initramfs, it's own configuration files, etc. from the /boot directory. Since GRUB does not itself know how to unlock a LUKS partition (that's the kernel's job), /boot must not be encrypted, and therefore must be a separate disk partition.

What this means is that in order for your operating system to boot, the bootloader has to be able to read its own configuration settings which it finds in /boot, and it can not do that if the volume is encrypted. This is true no matter which encryption routine/method you use.

Is this a weakness? Yes. It is possible to install some sort of password sniffer to /boot, but encrypted LVM was not designed to protect you against this. If you are this much paranoid, then someone getting physical access to your machine or root access to your system while it is running, will force you to assume you have been compromised.

This might be a wrong conclusion from me, but I think that encryption on LVM partitions are made in the case where you loose your computer or it get stolen. In this case they will have to somehow get your password before they can get access to the content of the drive or manually hack the key, which is, unless the person has unlimited access to resources, impossible.

1
  • Absolutely agree with your last conclusion. Disk encryption can't help with boot files integrity. Even if bootloader could read encrypted partitions, it would still be unencrypted itself and therefore it can be a target for malware injection.
    – ml43
    Nov 2, 2013 at 20:22
0

Yes, it is a weakness. As @Mogget writes, your system needs an unencrypted /boot partition, unless you have special hardware.

One possible protection scheme is to put this unencrypted /boot partition on a separate USB key that you always keep on your person. If there is a risk that someone has tampered with it, you should create a new one from your own signed and verified image.

Another idea is to let your unencrypted /boot be a partition on the disk as usual, but instead of unlocking the rest of your system, you unlock an encrypted /boot2 partition with Key A. On /boot2 you store a binary that verifies the integrity of /boot before you unlock the rest of your system using Key B.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .