Misc. BSD/UNIX Microsoft's Lennart Poettering proposes tightening up Linux boot process

[J65nko]

From https://www.theregister.com/2022/10/...ft_poettering/

Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images.

Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix.

[Head_on_a_Stick]

That article is unnecessarily sensationalist IMO. "Agent P", really?

As a counterpoint I would observe that I've been booting using unified kernel images signed with my own SecureBoot key for a while now. I've removed the Microsoft SecureBoot keys so the machine will not boot Windows with SecureBoot enabled.

Guide here for any Linux users: https://www.rodsbooks.com/efi-bootlo...olling-sb.html

And here's an overview of unified kernel images: https://uapi-group.org/specification..._kernel_image/

[Carpetsmoker]

Originally Posted by Head_on_a_Stick

That article is unnecessarily sensationalist IMO. "Agent P", really?

It's The Register; they've always had a snarky style like this about pretty much anything and anyone. You can love or hate it.

[blackhole]

"First they came for the init system,
And I did not speak out
Because I did not care about the init system
Then they came for the device manager,
And I did not speak out
Because I did not care about the device manager
Then they came for the initrd..."

[bhyeti]

Lennart Poettering :

Mister SystemD works for Microsoft? Really....?

[hitest]

Originally Posted by bhyeti

Lennart Poettering :

Mister SystemD works for Microsoft? Really....?

Yep. After messing up Red Hat and Linux in general his work is done. Onto M$. Heh.