Towards Secure Unified Kernel Images for Generic Linux Distributions and Every...
summary
Proposal builds a pre-built, vendor-signed unified kernel image (unified kernel image (UKI)) that packs the ELF kernel, a vendor-built initrd, fixed kernel cmdline and a signed TPM2 policy; objcopy + PE signing make it a single UEFI-executable file. A small UEFI stub measures kernel/initrd into PCR 11 measurement, loads encrypted credentials (.cred) files* from the ESP (AES-256-GCM bound to TPM), and supports GPT+dm-verity extension images overlaid into /usr via systemd-sysupdate. Most pieces are merged and working (~93%), with some verification and policy gaps left to resolve.
AI-written summary · about
chapters (11)
- 0:00Introduction to secure kernel images
- 1:03Current initrd security flaws
- 7:01Proposed secure initrd goals
- 10:13Unified kernel image concept
- 12:22Systemd-stub and UKI details
- 18:22System extensions for initrd
- 26:28TPM measurement and PCR policies
- 33:03Secure parameterization with credentials
- 37:14Bootloader compatibility
- 40:24Kernel command line flexibility
- 41:48Vendor control over extensions
related talks
46mVerifiable End To End Secure OCI Native Machines
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
19mSubsystem Update: Linux Integrity Status Update
01h 05mImmutable and Stateless Systems with systemd
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
26mIntegrity
38mUEFI Secure Boot in U-Boot
53mSecure Embedded Linux Product - A Success Story