blog/content/post/2024-11-26-measured-boot-improvements.md: Add post #613
Conversation
Signed-off-by: Michał Żygowski <[email protected]>
miczyg1
force-pushed
the
mesured_boot_improvements
branch
from
c34bf80 to
0b2f57e
Compare
| code. It may not be a big deal for modern platforms with big caches, but | ||
| rather for the old ones. | ||
| - coreboot supports only one algorithm in a single event log entry. | ||
| Support for an agile format would have to be implemented. |
There was a problem hiding this comment.
What would be the current mitigation for that?
Can't we just set up an admin password so a change of PCR banks would not be possible for someone who doesn't know the password?
There was a problem hiding this comment.
In general even if an admin changes PCR banks, the change won't be applied or it will break measured boot.
The mitigation is like I described: be agile and calculate hashes for all currently enabled banks. Of course coreboot changes to event logging must follow.
Simply subject to future improvement. It is not about preventing the change of PCR banks
There was a problem hiding this comment.
In general even if an admin changes PCR banks, the change won't be applied or it will break measured boot.
So why are we not saying what mitigates that? Dear admin, do not change banks because it will break the system's trustworthiness. The admin must comply with that policy and should be informed about it. If the admin doesn't want users to change that policy, even accidentally, then prevent that by protecting the option with a password. That is the current mitigation. There should be a better one with the correct implementation, but that still needs to be implemented. We may be working on that. Or could you have a reference point to follow up?
… HSI results Signed-off-by: Michał Żygowski <[email protected]>
Signed-off-by: Michał Żygowski <[email protected]>
…iness Signed-off-by: Michał Żygowski <[email protected]>
Signed-off-by: Michał Żygowski <[email protected]>
…heads Signed-off-by: Michał Żygowski <[email protected]>
Signed-off-by: Michał Żygowski <[email protected]>
|
@pietrushnic addressed all of the comments except #613 (comment) (treating it more like an open question) |
No description provided.