Bootloader/SquashFS Security Questions?

Support
1

So before I begin I apologize if I’m mixing different things up here.

  1. Besides setting a GRUB password is there anything else that can protect the bootloader?

  2. What can be used to protect the integrity of the SquashFS or detect any malicious changes to it? GrapheneOS has “Auditor” options (auditee, auditor, remote verification). Any equivalent here worth deploying?

Besides Sovereign Boot and Secure Boot has anything like DM-Verity or Integrity Measurement Architecture (IMA) been discussed?

2

Enabling Secure Boot is probably the only good option here at the moment.

This isn’t available yet. Verified Boot on a Sovereign Boot-capable machine is meant to provide something along these lines, and will likely be implemented using dm-verify, fs-verity, IMA, or something like that, but it’s still a concept and not implemented yet. See:

2 Likes
3

Thoughts on this Secure Boot/GRUB - Gentoo wiki

4

From a very brief glimpse, it looks like those instructions can protect, at most, the bootloader, kernel, and optionally the initramfs if you use a UKI. Verified Boot needs to also protect everything else that is part of the OS, i.e. all the programs, configs, etc. Working Secure Boot is a necessary but not sufficient part of that.

1 Like
5

All mentioned on the Full Disk Encryption (FDE) wiki page.