Linux Security Summit North America 2017

Adversaries mount attacks at all layers of the system stack including — to an increasing extent — firmware and kernel. Platform-level intrusion is a threat that academic papers have extensively described, researchers have demonstrated is real, and recent Wikileaks revelations have documented is pervasive. Technologies such as Trusted Computing and code signing are able to detect bootkits and rootkits and help prevent systems from executing these persistent and often invisible exploits. This talk discusses the motivation, design, and implementation of new Trusted Boot and Secure Boot features that bring strong firmware based protections to OpenPOWER systems.