Secure boot (UKI)

Lightspeed currently builds a mininal signed Unified Kernel Image (UKI) as proof of concept.

The UKI image contains:

• systemd-boot

• UEFI stub

• kernel

• initramfs

• secure boot signatures

This UKI image will be launched by UEFI Secure Boot based on meta-arm, Trusted Firmware-A (TF-A).

UEFI Secure Boot firmware is built using meta-ts

UEFI Secure Boot is a verification mechanism to ensure that code launched by a computer’s UEFI firmware is trusted. It is designed to protect a system against malicious code being loaded and executed early in the boot process, before the operating system has been loaded.

The UKI Image has to be signed with same UEFI cerificates, which are built into meta-ts firmware, so that it can verify the UKI image during the boot process.

Secure boot (meta-ledge-secure)

Secure boot feature, which uses meta-ts and meta-ledge-secure

meta-ledge-secure is the layer that implements additional security level for Open Embedded based builds.

List of integrated security features:

• UEFI secure boot

• Measured boot

• LUKS with passphrase sealed to TPM PCRs

• fTPM support

• Parsec TPM integration

• SELinux support

meta-ledge-secure is commonly used in conjunction with the Trusted Substrate project to build secure OS. More information can be found Trusted Substrade and meta-ts

More details will be updated later as meta-ledge-secure is being upgraded to provide UKI support.

UEFI secure boot

Unified Extensible Firmware Interface(UEFI) Secure Boot is a security feature that ensures only trusted and authenticated software is loaded during the boot process. It uses cryptographic signatures to verify the integrity and authenticity of boot components, such as the ARM Trusted Firmware-A (TF-A), bootloader (grub_efi, systemd-boot), and OS kernel. Secure Boot relies on a key management system with Platform Key (PK), Key Exchange Key (KEK), and signature databases (db and dbx) to control whether software is allowed or not the during boot. It is protecting the device against boot-time malwares and unauthorized modifications.

Measured boot and firmware TPM support

Measured boot is supported With firmware TPM (fTPM). This is a method where each of the software layers in the boot sequence of the device, measures the next layer in the execution order, and extends the value in a designated TPM PCR. Measured boot further validates the boot process beyond Secure Boot.

LUKS with passphrase sealed to TPM PCRs

LUKS (Linux Unified Key Setup) with a passphrase sealed to TPM PCRs (Platform Configuration Registers) is a security feature that binds the disk encryption key to specific system states. This will ensure that the disk can only be decrypted when the system is in the expected and trusted configuration. During boot, the TPM compares the current PCR values with the ones used when the key was sealed. If the system state matches (i.e., no tampering or unauthorized changes), the TPM releases the decryption key, allowing LUKS to unlock the disk automatically. If the system state is different (e.g., due to a modified bootloader or kernel), the TPM refuses to release the key, preventing disk decryption. This setup enhances security by ensuring that the disk can only be decrypted when the system is in a trusted, untampered state.

fTPM (firmware TPM) support

fTPM (firmware TPM) is a software-based implementation of the Trusted Platform Module (TPM) specification, embedded into the system firmware.

SELinux

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides mandatory access control (MAC) to enhance the system. security by controlling access to the resources based on policies. It not just the user ownership. It enforces least-privilege access by defining what each process can and cannot do.