Ignore Hash Mismatches with Secure Boot Disabled #58

New issue

Closed

opened 2023-01-11 12:15:29 +00:00 by blitz · 2 comments

blitz commented

2023-01-11 12:15:29 +00:00

(Migrated from github.com)

Lanzaboot should ignore hashes when Secure Boot is not enabled to give users a good recovery path that doesn't involve booting into a recovery system.

When lanzaboote doesn't find kernels/initrds that match its hashes, it will decline to boot them regardless of the Secure Boot setup. In combination with #56 and manually signing of initrds/kernels this can easily result in an unbootable system. Lanzaboot should ignore hashes when Secure Boot is not enabled to give users a good recovery path that doesn't involve booting into a recovery system.

RaitoBezarius commented

2023-01-14 16:43:41 +00:00

(Migrated from github.com)

Implementation idea: try to LoadImage a dummy and catch the security violation?

blitz commented

2023-01-28 09:51:44 +00:00

(Migrated from github.com)

I think this can be very elegantly implemented by using LoadImage on the Linux kernel. We will not sign it after the PE loading PR (#75) goes through. So we can use it to detect Secure Boot.