Using Linux as a Secure Boot Loader for OpenPOWER Servers
summary
Linux IMA is extended to act as a secure boot loader for OpenPOWER by adding three concrete features: appended PKCS7 signatures on kernel images so network/USB boots can be verified, a platform keyring (immutable firmware keys) to isolate and lock firmware-supplied certs, and architecture-specific IMA policies loaded at boot and preserved across kexec. Patches add a D-sig measurement template, TPM PCR/measurement list handoff across kexec, and are partly posted/upstream; prototypes run under petitboot on OpenPOWER and are awaiting review or acceptance.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:25Requirements
- 7:19Using IMA for Kernel image Verification
- 8:05Integrity Measurement Architecture Basics
- 9:35Three Main Problems
- 9:56Extended Attribute and Cons
- 15:27Measurements with Signatures
- 31:23Summary
related talks
21m(Ab)using Linux as a Trusted Bootloader
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
19mSubsystem Update: Linux Integrity Status Update
20mExtending OpenPOWER Boot Security to Guests
21mReconcilable Differences: Booting Linux on IBM PowerVM LPARs
41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER Systems
26mIntegrity
27mSecuring Arm Servers