The Linux 7.3 kernel includes Trusted Platform Module (TPM) changes designed to lay the groundwork for potential integration of the TrenchBoot security project. TrenchBoot, an open-source effort to enhance boot security, utilizes hardware-backed features for a Dynamic Root of Trust for Measurement (DRTM).
Jarkko Sakkinen explained that the TPM changes, while not including TrenchBoot in the 7.3 kernel cycle itself, expose necessary constants and improve the robustness of the `tpm_buf` component. This preparation is intended to facilitate the future upstreaming of TrenchBoot patches. The project leverages security technologies from both AMD and Intel and requires modifications to the GRUB bootloader and the Linux kernel.
According to Sakkinen, “The bulk of this is Ross Philipson’s TPM enablement for Trenchboot. That exposes TPM constants, and decouple and improve robustness of tpm_buf a bit in order to implement a minimal early TPM driver.” Early boot code will initialize TPM PCRs before the kernel’s entry point, measuring initrd, boot parameters, and TrenchBoot metadata. Sakkinen also stated, “even if Trenchboot turned out to be empty lottery the worst possible outcome for TPM driver is that things get cleaned up a bit.”
Oracle has been a significant supporter of the TrenchBoot project, which has been in development for several years. Those interested in learning more about TrenchBoot can find information at TrenchBoot.org.
Read the original coverage
💬 Comments
📜 Comment Policy