An interesting comment which I don’t agree fully with but it raises and interesting point about initrd making this a kinda pointless exercise:
Lets say it would help to secure a system with enabled encryption. This might help when there is no way to get a custom signed binary. Then maybe bitkeeper would be a tiny bit more secure. I doubt that for Linux solutions as the logic is in the initrd. You could still modify that even if you could not load a modified kernel module (i still want to see that working). It is very unlikely that you can sign your initrd or you have to store the public key for that unencrypted somewhere. So what did you gain this time? Maybe a tiny bit in the case that you could not sign your own binaries. If you can do and use an initrd, that will be the weak point (and it was the weak point before as well).
So what can you do? Rely on hardware encryption if you need full security. Forget secure boot, it will not be more secure. All you can use it for is that you can not boot other systems that easyly (just like on the arm plattform).
Date: 2012-07-25 02:50 pm (UTC) From: ![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
mjg59
You’re completely right, secure boot does not prevent attacks that it is not intended to prevent.