1

I have searched and I have found this link explaining Trusted Boot quite detailed, but for Windows:

https://software.intel.com/en-us/forums/intel-trusted-execution-technology-intel-txt/topic/391211

I see there is a kernel with trusted boot feature and it worked on my laptop enabled with this technology;

  • What are the advantages of running a trusted boot kernel on Linux?
  • What are the potential disadvantages of running a trusted boot kernel?

Thanks

3 Answers 3

2

The trusted boot is explained for windows because it is fully implemented by Microsoft.

If you'd like to read about trusted boot on Ubuntu here there is an Ubuntu official wiki page that explains pretty good the steps.

About your questions advantages/disadvantages, it is a dilemma in my personal opinion....

Trusted boot is about enabling security at hardware/firmware level and not software level, which is a security countermeasure to avoid malware load before the operating system(s).

Said that, in the other end, by enabling security boot you are basically putting your system in the hand of Microsoft. Today Microsoft supports trusted boot for a number of Linux distros and it doesn't include custom Linux distros but Linux Foundation has implemented a generic loader signed by Microsoft that will allow any Linux to load, read this link from Linux foundation.

The problem is, this is always signed by Microsoft, in simple words there are two disadvantages:

  1. Microsoft is not a community such as Linux, it is a capital gain company and if it loses its interest towards Linux it can cut it out at any time.
  2. You are losing your freedom

The history will tell by itself that there will be never a good relationship between companies like Microsoft and communities such as Free Open Source Software.

I hope this will help you understand.

Thanks

1

"Trusted Boot" is another name for what we'd call Secure Boot. I can't explain the sequence of components better than the wiki :

In order to boot on the widest range of systems, Ubuntu uses the following chain of trust:

  1. Microsoft signs Canonical's 'shim' 1st stage bootloader with their 'Microsoft Corporation UEFI CA'. When the system boots and Secure Boot is enabled, firmware verifies that this 1st stage bootloader (from the 'shim-signed' package) is signed with a key in DB (in this case 'Microsoft Corporation UEFI CA')

  2. The second stage bootloader (grub-efi-amd64-signed) is signed with Canonical's 'Canonical Ltd. Secure Boot Signing' key. The shim 1st stage bootloader verifies that the 2nd stage grub2 bootloader is properly signed.

  3. The 2nd stage grub2 bootloader boots an Ubuntu kernel (as of 2012/11, if the kernel (linux-signed) is signed with the 'Canonical Ltd. Secure Boot Signing' key, then grub2 will boot the kernel which will in turn apply quirks and call ExitBootServices. If the kernel is unsigned, grub2 will call ExitBootServices before booting the unsigned kernel)

  4. If signed kernel modules are supported, the signed kernel will verify them during kernel boot

It works too (speaking from experience).

Is it any better? On paper, yes, but I'm not sure. There still seem to be plenty of stories around of Windows users getting bootloader-level infections even with Secure Boot. It's supposed to be a faster boot too, but again, this isn't something I've really noticed.

If you have the option to disable it, you have an option if it doesn't work (or you want unsigned kernel images, or whatever). If you need it turned on all the time it probably will work because Microsoft (essentially) vouches for us.

1

Unlike other answers suggest: Secure Boot != Trusted Boot.

Trusted Boot takes over where Secure Boot leaves off.

Secure Boot protects the bootloader, requires UEFI. (You should disable CSM.)
Trusted Boot protects the OS kernel, requires a security chip, like Intel TXT.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .