1

I have my doubts on how secure is using Shim/PreLoader to allow booting Linux with Secure Boot enabled.

My doubt comes from the fact that it seems to me Shim's MokManager and PreLoader's HashTool can be run by anyone with physical access to the device. They are not password protected nor limit their execution in any other way. The attacker gaining acces to the machine can run the tool and whitelist his own binary, then Secure Boot will allow this binary to boot. How more secure is that than having Secure Boot disabled?

Even if I remove the MokManager/HashTool from ESP, the attacker could provide his own copy of that binary, as they are easily available in the internet. They are all signed by Microsoft certificates, so they will pass Secure Boot validation without problems.

Improve this question
3
  • In order to boot into MokManager and HashTool wouldn't you have to perform a configuration change that requires sudo? In any event, Secure Boot was never designed to protect against somebody with physical access to the machine, especially if that person has root or access to sudo. Seems like the simplest solution is to prevent any UEFI boot order configuration changes.
    – Ramhound
    Apr 13, 2021 at 15:33
  • 1
    @Ramhound Then what exactly does Secure Boot secure from? I was thinking it's to pevent booting binaries that maliciously install themselves on ESP. And to install itself on ESP you need root access.
    – Robert Kusznier
    Apr 13, 2021 at 15:50
  • It's to prevent loading unsigned binaries. Secure Boot prevents malicious software from making changes. Don't forget Secure Boot exist before the OS. Remote attack won't be able to change the UEFI boot order, that requires physical access, and that can be password protected.
    – Ramhound
    Apr 13, 2021 at 16:14

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.