Lennart Poettering is Attacking Linux Freedom... on Microsoft's Payroll
-
Lennart Poettering: Linux Boot Partitions
-
Microsoft's Lennart Poettering proposes tightening up Linux boot process
Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images.
Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix.
-
Version 252 of systemd, as expected, locks down the Linux boot process [Ed: Microsoft now attacks Linux freedom via systemd]
The fall version of systemd is here, with support for increased boot security, including tightened full-disk encryption.
The 113th version has the usual long feature list of very specific, targeted elements outlined in the release announcement. However, as one might expect following recent events, several of the headline features relate to the new UKI fully signed boot process.
UKI is short for "Unified Kernel Image" and combines the Linux kernel and initrd into a single file, along with some other smaller components, allowing the whole thing to be cryptographically signed. The purpose is to tighten up security on the Linux boot process.
This version also has new functions and modules concerned with manipulating the Platform Configuration Registers (PCRs) of Trusted Platform Module 2.0 chips – as also favored by VMware as well as Windows Server and Windows 11, unless you use Rufus or other tools to turn this off.
The enhanced TPM2 support will enable linking a drive's encryption keys to the keys held in compatible firmware so that an encrypted disk can be unlocked automatically during boot – but can't be unlocked by other distros. The result will be improved security for users, especially corporate users, but we foresee this hindering data-recovery efforts.