Securing the Linux Boot Process: From Start to Finish

Abstract

The security of the operating system is a prominent feature in today’s Linux distributions. A common security practice is to encrypt the hard drive, to protect the data at rest. The UEFI Forum released the secure boot specification, an optional boot process protocol that improves security during boot up on secure boot enabled hardware. A combination of secure boot with the Linux operating system, along with full disk encryption in an effort to implement maximum security is non-trivial. This paper explores the challenges of this undertaking and reports on a practical evaluation with five major Linux distributions, how far they support these security features by default and what can be improved manually.