2

I was thinking about encrypting my ssd(just out of curiosity, mostly) and was wondering the possible security threats an unencrypted /boot partition can pose(if any). I know that I can encrypt the root and home partition without any problem. Also, I read something about encrypting the swap partition using a random generated key on each session(making hibernation impossible). But what about the /boot partition? I mean, if an attacker gets physical access to the disk, and accesses this partition, can that pose a security threat? As far as I know, you can't simply encrypt the /boot partition, since that you wouln't be able to boot at all anymore, right?

Thanks in advance!

2

The key here is privacy vs integrity.

If your data volume (/home, /var/log and anything else with sensitive data) is encrypted then you're primarily just assuring privacy, whereas for /boot you want to make sure no malicious code is placed (integrity). Note this does not imply that it needs to be encrypted. /boot almost never requires actual encryption, since it does not store private/privileged data. I'm going to presume you have locked down booting from external devices (USB).

After the UEFI/BIOS code, the first piece of code executed on your system that you control is the bootloader (e.g. grub), which reads configuration files (that may have security parameters such as disallowing boot option editing), and then your kernel+initrd, also stored on /boot. It will take a determined adversary to:

  • Gain physical access to your laptop
  • Remove the hard drive without you noticing it's been removed and replaced
  • Replace Grub/Grub's config/kernel/initrd with a malicious version (e.g. that captures keypresses, loads hidden daemons, or even starts a hypervisor to encapsulate your entire OS)
  • And deliver it back to you with no sign of tampering, performance loss, random bugs or noticing it's been missing.

It is feasible though. If you're at this level of paranoia as opposed to simply keeping your data volume hidden from random search and seizure, then you need to look into a full trusted boot setup. That's a lot of work.

A simple mitigation would be, once your system is started, check that the hashes of all files on /boot are as you expect by comparing it with a previous baseline of hashes stored in your encrypted volume. This is an after-the-fact measure though if /boot has been compromised, but at least you will know about it, and you will need to update the baseline each time you update files on /boot (e.g. new kernel version/new grub security options).

Any more assurance will require a lot more work. Trusted Boot on Linux/*nix is notoriously tricky.

  • 1
    I don't think I need that level of security, I was just curious if it was a terrible idea to leave that partition unencrypted. There's no way someone will try such a sophisicated attack. Thanks! – twkmz Jul 24 '17 at 17:03
  • It's still a useful exercise. Right now, run find /boot -type f -exec sha256sum {} \; > ~/.boothash, and when you want to check run find /boot -type f -exec sha256sum {} \; | diff ~/.boothash - which will compare the current state to the captured baseline, and will spit out exactly which files have changed. – Liam Dennehy Jul 25 '17 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.