Ubuntu supports Secure Boot, an UEFI feature.

On Windows, Trusted Boot takes over where Secure Boot leaves off: the bootloader verifies the digital signature of the Windows kernel before loading it. So, Secure Boot protects the bootloader and Trusted Boot protects the Windows kernel.

From my understanding, when an Ubuntu PC boots,
the firmware starts looking in the ESP (EFI System Partition) and loads:

  • shim, a 1st-stage bootloader, which loads:
  • GRUB, a 2nd-stage bootloader, which in turn loads:
  • Linux kernel.

The firmware contains a set of signatures (which in practice come from Microsoft, because most new PCs ship with Windows) and refuses to run any EFI executable which is not signed with one of those signatures. shim is signed by Microsoft and supports its own user-modifiable key database, so an end user can install their own key. GRUB will call into shim to verify the Ubuntu kernel against that database, so you get a fully signed root of trust.

Does this chain of trust make the Intel TXT security chip unnecessary for Ubuntu?

  • Ubuntu supports both TXT and non-TXT hardware securely. To use TXT, the admin must install the tboot package. If you discover a vulnerability in either method of kernel security, please let the Ubuntu Security Team know by filing a bug report. – user535733 Oct 11 '18 at 18:52
  • @user535733 What is the use-case for tboot? Intel TXT measures the bootpath, which is already validated (by Secure Boot) at the time Trusted Boot kicks in, right? – FPU Oct 11 '18 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.