I'm looking into hardening an embedded device using TPM2 with an encrypted root (
/) Linux partition. I've found various articles explaining how to embed LUKS keys into the TPM (eg this one). Unless otherwise informed, I assume this can be secured without encrypting
/boot and I believe it's impossible to boot a system with an encrypted EFI partition.
What I'm missing is any discussion of how tools such as
systemd-cryptenroll are using the TPM to prevent an attacker simply reading the keys. That is I can't find which information is being checked by the TPM to ensure the OS has not been tampered with in some way.
Just as a TPM cannot protect me if I leave my Linux root password as "root", so too I am concerned that if I make other configuration mistakes I might inadvertently allow an attacker to simply ready the keys from the TPM or otherwise login to the system without providing valid credentials.
What information is a TPM protecting from tampering with Linux?:
- The boot loader written in EFI (grub EFI stub)?
- The boot loader config written in EFI (grub.cfg in EFI)?
- The the boot loader modules and config written in /boot?
- The kernel parameters like
- The kernel itself?
Unfortunately too many blogs and how-to articles focus on getting the system to boot without user interaction and barely anything on the details of what makes it secure.