Ubuntu supports Secure Boot, an UEFI feature.
On Windows, Trusted Boot takes over where Secure Boot leaves off: the bootloader verifies the digital signature of the Windows kernel before loading it. So, Secure Boot protects the bootloader and Trusted Boot protects the Windows kernel.
From my understanding, when an Ubuntu PC boots,
the firmware starts looking in the ESP (EFI System Partition) and loads:
shim, a 1st-stage bootloader, which loads:
GRUB, a 2nd-stage bootloader, which in turn loads:
- Linux kernel.
The firmware contains a set of signatures (which in practice come from Microsoft, because most new PCs ship with Windows) and refuses to run any EFI executable which is not signed with one of those signatures.
shim is signed by Microsoft and supports its own user-modifiable key database, so an end user can install their own key.
GRUB will call into
shim to verify the Ubuntu kernel against that database, so you get a fully signed root of trust.
Does this chain of trust make the Intel TXT security chip unnecessary for Ubuntu?