2

I was thinking about encrypting my ssd(just out of curiosity, mostly) and was wondering the possible security threats an unencrypted /boot partition can pose(if any). I know that I can encrypt the root and home partition without any problem. Also, I read something about encrypting the swap partition using a random generated key on each session(making hibernation impossible). But what about the /boot partition? I mean, if an attacker gets physical access to the disk, and accesses this partition, can that pose a security threat? As far as I know, you can't simply encrypt the /boot partition, since that you wouln't be able to boot at all anymore, right?

Thanks in advance!

Improve this question

2 Answers 2

Reset to default
3

The key here is privacy vs integrity.

If your data volume (/home, /var/log and anything else with sensitive data) is encrypted then you're primarily just assuring privacy, whereas for /boot you want to make sure no malicious code is placed (integrity). Note this does not imply that it needs to be encrypted. /boot almost never requires actual encryption, since it does not store private/privileged data. I'm going to presume you have locked down booting from external devices (USB).

After the UEFI/BIOS code, the first piece of code executed on your system that you control is the bootloader (e.g. grub), which reads configuration files (that may have security parameters such as disallowing boot option editing), and then your kernel+initrd, also stored on /boot. It will take a determined adversary to:

  • Gain physical access to your laptop
  • Remove the hard drive without you noticing it's been removed and replaced
  • Replace Grub/Grub's config/kernel/initrd with a malicious version (e.g. that captures keypresses, loads hidden daemons, or even starts a hypervisor to encapsulate your entire OS)
  • And deliver it back to you with no sign of tampering, performance loss, random bugs or noticing it's been missing.

It is feasible though. If you're at this level of paranoia as opposed to simply keeping your data volume hidden from random search and seizure, then you need to look into a full trusted boot setup. That's a lot of work.

A simple mitigation would be, once your system is started, check that the hashes of all files on /boot are as you expect by comparing it with a previous baseline of hashes stored in your encrypted volume. This is an after-the-fact measure though if /boot has been compromised, but at least you will know about it, and you will need to update the baseline each time you update files on /boot (e.g. new kernel version/new grub security options).

Any more assurance will require a lot more work. Trusted Boot on Linux/*nix is notoriously tricky.

Improve this answer
2
  • 1
    I don't think I need that level of security, I was just curious if it was a terrible idea to leave that partition unencrypted. There's no way someone will try such a sophisicated attack. Thanks!
    – twkmz
    Commented Jul 24, 2017 at 17:03
  • It's still a useful exercise. Right now, run find /boot -type f -exec sha256sum {} \; > ~/.boothash, and when you want to check run find /boot -type f -exec sha256sum {} \; | diff ~/.boothash - which will compare the current state to the captured baseline, and will spit out exactly which files have changed.
    – Liam Dennehy
    Commented Jul 25, 2017 at 10:16
0

Encrypting the boot partition (I used to do that) would make it substantially harder for an attacker to compromise your system after gaining physical access. Replacing init or linux image is trivial compared to hacking a boot loader. The case of init image is basically unpacking the image, modifying some shell scripts in it and creating a new archive. And your system is compromised like a piece of cake. Your 15yo neighbor could do that as a prank.

Unfortunately, I haven't found a way to achieve the full disk encryption with UEFI boot (that could also protect from boot loader interference). I figure I would have to give up boot/EFI encryption and replace it with verified signatures - trusted (secure) boot. As Liam pointed out, this is a bit tedious if you want to be fully in control as you'd have to provision a signing machine owner key and burn the public part into the firmware. Sign the EFI images with it. Keep the key safe and secure... Or rely on the shim. I think this is what he implies with trusted boot being hard. I'd just call it tedious, but it may well be justified for targeted individuals at risk such as journalists, activists or politicians. I'd rather not down-play such situations as paranoia. It's real.

I find a good compromise to this trouble in booting from a removable media that is secure even if the laptop is left unattended, such as keeping it on you at all times or locked. I would in that case maintain a functional boot/EFI partition to fool the wannabe, but actually not use it and verify it's integrity from the removable boot disk to detect any attempts (honeypot). It would need a little automation to keep the boot solutions up to date with kernel and init changes... Which would be reasonable for people at risk.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .