Using Unified Kernel Images (UKIs) and systemd-boot for Enhanced Security
Unified Kernel Images (UKIs) and systemd-boot are two powerful tools that can help take advantage of the hardware security features provided by measured boot and secure boot. In this article, we will explore the key concepts of UKIs and systemd-boot, and how they can be used together to enhance the security of your system.
What are Unified Kernel Images (UKIs)?
Unified Kernel Images (UKIs) are a way to package and distribute the Linux kernel and its modules as a single, self-contained image. This image can then be loaded directly by the bootloader, without the need for a separate initramfs or initrd. By combining the kernel and its modules into a single image, UKIs make it easier to manage and distribute kernel updates, and can also improve boot times.
What is systemd-boot?
systemd-boot is a simple, lightweight bootloader for EFI systems. It is designed to be easy to use and manage, and does not require any configuration files or manual editing. systemd-boot can be used to boot both Linux and Windows systems, and supports the use of signed bootloaders and kernels for secure boot.
Using UKIs and systemd-boot for Enhanced Security
When used together, UKIs and systemd-boot can provide enhanced security for your system through the use of measured boot and secure boot. Measured boot is a feature of the UEFI firmware that allows the system to measure and record the components that are loaded during the boot process. This information can then be used to verify that the system has booted in a secure and trusted state. Secure boot is a feature of the UEFI firmware that uses digital signatures to verify that the bootloader and kernel have not been tampered with. By using UKIs and systemd-boot with measured boot and secure boot, you can ensure that your system is booting in a secure and trusted state, and that the kernel and bootloader have not been tampered with.
How to Use UKIs and systemd-boot
Using UKIs and systemd-boot is relatively straightforward. First, you will need to build a UBI image using the ubimkimage tool. This image can then be loaded directly by systemd-boot, without the need for a separate initramfs or initrd. To sign the UBI image for secure boot, you can use the sbsign tool. Once the UBI image is signed, it can be loaded by systemd-boot, and the system will be booted using the measured boot and secure boot features of the UEFI firmware.
Unified Kernel Images (UKIs) and systemd-boot are two powerful tools that can help take advantage of the hardware security features provided by measured boot and secure boot. By using UKIs and systemd-boot together, you can ensure that your system is booting in a secure and trusted state, and that the kernel and bootloader have not been tampered with. With their ease of use and management, UKIs and systemd-boot are an excellent choice for enhancing the security of your system.
References
# Example of building a UBI image
ubimkimage --format raw \
--image /boot/vmlinuz-5.10.0-kali3-amd64 \
--key /etc/kernel-signing.key \
--digest sha256 \
/boot/ubi-5.10.0-kali3-amd64.img
# Example of signing a UBI image
sbsign --key /etc/kernel-signing.key \
--cert /etc/kernel-signing.crt \
--output /boot/ubi-5.10.0-kali3-amd64-signed.img \
/boot/ubi-5.10.0-kali3-amd64.img