Hacker News Reader

If the attacker can modify the kernel then I think you have already lost the battle. This script, as it says in README, checks that the files in /boot have not been altered between reboots.

View on HN

Here is a great talk by mjg59 about using the TPM, and why it's required https://www.youtube.com/watch?v=rML5DfYUh_k

> If the attacker can modify the kernel then I think you have already lost the battle.

By that argument, if the attacker can modify the contents of /boot then you've lost and this doesn't buy you anything.

My understanding is (I may be wrong) that this script protects from physical attacks when the attacker covertly modifies your /boot partition (where the kernel resides along with the initramfs) while your computer is turned off. The attacker can not modify the other partitions because they are encrypted.

The attacker modifies the on-disk copy of the kernel such that when userspace tries to read the kernel it gets given a backed up copy of the unmodified kernel. Chkboot says everything is fine, but in reality the system is backdoored.

I agree then, sorry I failed to see your point in your first comment.

Reply on news.ycombinator.com