From: Niels Thykier <niels-g5vtf2JUtkjR7s880joybQ@public.gmane.org>
To: Matthew Garrett <mjg59-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
Cc: initramfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: Producing verifiable initramfs images
Date: Thu, 6 Feb 2020 08:31:07 +0100 [thread overview]
Message-ID: <4ceef357-7b59-e4ed-52c2-1843013c8439@thykier.net> (raw)
In-Reply-To: <CACdnJutwsCPERLR=tF65O=2tCgf+BHbWmsC6bpVrhwyOXcKCxA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Matthew Garrett:
> [...]
>
> The second is a different problem, but still seems achievable. Each
> package that potentially adds content to the initramfs could provide a
> pre-build CPIO containing its code, and based on local configuration
> we can ask grub to load those as well.
>
> This would result in something that's roughly equivalent to our
> current situation, but would allow us to verify that the initramfs
> images containing code hadn't been tampered with. [...]
>
> A minimal proof of concept here would presumably be a patch to the
> kernel package to build an initramfs binary package, and then some
> additional tooling to copy appropriate config to the boot partition
> and have grub pick that up. Does anybody have any strong feelings on
> the topic? If not, I'll try to mock this up.
>
Hi Matthew,
Thanks for working on making initramfs verifiable. :)
Let me know if/when there are any changes need to dh_installinitramfs
and I will happy to review them. At the moment, it is just an easy way
to inject "update-initramfs -u" in the relevant maintscripts if the
package has a /usr/share/initramfs-tools/hooks.
If we can solve this without using maintscripts, I would be even happier
and am ready to do my part in that if you need any help there! I know
it is not the main goal of what you are trying to here and nor should it
be a blocker for it - this is just me hoping for the best! :)
~Niels
prev parent reply other threads:[~2020-02-06 7:31 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-06 0:37 Producing verifiable initramfs images Matthew Garrett
[not found] ` <CACdnJutwsCPERLR=tF65O=2tCgf+BHbWmsC6bpVrhwyOXcKCxA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2020-02-06 1:53 ` Sam Hartman
2020-02-06 7:31 ` Niels Thykier [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ceef357-7b59-e4ed-52c2-1843013c8439@thykier.net \
--to=niels-g5vtf2jutkjr7s880joybq@public.gmane.org \
--cc=initramfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mjg59-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).