Linux Security Summit Europe 2018

When Linux is used as a secure boot loader, the Integrity Management Architecture (IMA) subsystem provides most of the functionality needed, but has limitations that we identified and addressed. For example, the builtin "secure_boot" command line option and the new build time policies are not flexible enough to support run time decisions based on the firmware's secure boot settings. These policies and settings interact to enable or disable the enforcement of signature verification of a kexec'ed kernel image. IMA-appraisal is also limited to verifying file signatures stored as extended attributes, yet the kernel image often comes from places without extended attribute support. This talk addresses these and other limitations, and describes patch sets that provide a complete solution for Linux as a secure boot loader.