Updating Linux with TUX: Trust Update for Linux Kernel
summary
TUX integrates Intel Open CIT, TPM 2.0, shim and GRUB to sign kernels with expected PCR values and push updated whitelists to the remote attestation server; a modified bootloader (TSP) measures every boot stage into PCR12 and compares the embedded PCR value in the kernel signature (PCR-embedded kernel). Prototype detects hardware, kernel, kernel-command and module tampering, halts boot on mismatch, supports remote re-imported whitelists and kernel rollback, and demonstrates successful attestation after update.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:18Intel Trusted Execution Technology (TXT)
- 3:12Open Cloud Integrity Technology (CIT) Intel's remote attestation solution
- 3:58UEFI secure boot UEFI BIOS's Verified boot component
- 5:18Threats!
- 8:15Goals! To maintain integrity properly
- 9:12Trusted Platform Module (TPM)
- 10:18Shim and Grub Shim
- 11:25Assumptions
- 12:30TUX Architecture
- 13:06Integrity Manager
- 13:54Kernel update using TUX
- 14:47Remote attestation with TUX
- 16:42Trusted Secure boot (TS-Boot) Combination of UEFI secure boot, Shim, and Cores Grub
- 17:15PCR-Verification
- 20:39TPM measurements
- 21:11Experiment
- 22:03Demo
- 24:47Discussion
- 26:37Conclusion Integrity changes when update is conducted and thus it should be property managed along with updates
related talks
26mIntegrity
19mSubsystem Update: Linux Integrity Status Update
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
32mTrenchBoot Update
42mRecent TPM Security Enhancements to the Linux Kernel
33mSecuring TPM Secrets with TXT and Kernel Signatures
27mSecuring TPM Secrets with TXT and Kernel Signatures
42mTPMs and the Linux Kernel: unlocking a better path to hardware security