Re: GRUB trusted boot framework

[Jan Alsenz]

phcoder wrote:
>> Ok, but your already talking of a specific solution here. My
>> conclusion would
>> be: The hooks need to be able to determine the filename, that is
>> currently read.
>>
> And then also where it comes from but some files may have different
> filenames. IMO the solution work independently of the order of files and
> where they come from. TPM checking is too limited for grub2 architecture.

I agree and I'm not talking TPM here.
Do you know if it is possible to determine where the files come from?

>> The reason why I want generic read hooks, is that I want it to inter
>> operate
>> with everything else. So I should not need to figure out what files
>> e.g. the
>> linux loader is going to read, or change it's code to do so.
> You can do anything secure without collaboration from upper layers.
> Consider a huge loopback image from which you load only kernel. In you
> solution it will unnecessary check the whole image

Hmm, to be precise we're interested in file reads. So if the loopback image is
implemented as disk driver, it should work.

Greets,

Jan

signature.asc
Description: OpenPGP digital signature