veyepar: Securing the Linux boot process

Author(s):	Matthew Garrett
Location	Great Hall CB01.05.009
Date	jan Wed 24	Days Raw Files
Start	15:50	First Raw Start	15:42
Duration	0:45:0	Offset	0:07:13
End	16:35	Last Raw End	16:42
Chapters	00:00 0:22:39
Total cuts_time	45 min.

http://lca2018.linux.org.au/schedule/presentation/74/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive public tweet mp4 svg png

assets release.pdf Securing_the_Linux_boot_process.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Linux has had support for UEFI Secure Boot for some time, which helps secure part of the boot process - you can be reasonably sure that nobody's replaced your bootloader or kernel, and that's sufficient to cover a bunch of cases. But for various technical reasons there's still a number of security critical components that are entirely unverified and which can be replaced by an attacker, and that means anyone with access to your system can configure it to steal (say) your hard drive encryption password. That's suboptimal.

There are various solutions to this involving TPMs, but so far they've all involved a lot of manual configuration and run the risk of being locked out of your machine for upgrading your kernel at the wrong time. Surely we can do better?

Unsurprisingly, yes. This presentation will describe some light modifications to the way distributions ship components that will make it possible to ensure that systems boot without running the risk of sensitive credentials being stolen but also without compromising the flexibility of the existing Linux boot process.

Comment:

production notes

2018-01-24/16_12_47.ts Apply: 16:35:48 - 16:42:46 ( 00:06:58 ) S: 16:12:47 - E: 16:42:46 D: 00:29:59 (Start: 1381.0) show more...

vlc ~/Videos/veyepar/lca/lca2018/dv/greathall/2018-01-24/16_12_47.ts :start-time=01381.0 --audio-desync=0

	Raw File	Cut List
	16:12:47		seconds: 1381.0 Wall: 16:35:48
Duration	00:29:59
	16:42:46		seconds: 0.0 Wall: 16:12:47
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete