2

I know you can deduce which kernel image is currently running by checking /proc/cmdline and assume its the same one on the /boot mount point. But this isn't guaranteed.

So is there a way to know what image off of what partition with certainty?

Is the image file available for inspection by initramfs at a well-known path?

2

Getting the kernel image to the system RAM is the bootloader's job; only the bootloader knows for certain where the kernel image came from. If the system is booted from network, the kernel image might not be present as a file on the system at all.

The version number and compilation timestamp reported by uname -amight be helpful in identifying the kernel image file. The same information can be read from a kernel image file by using the file command:

$ uname -a
Linux hostname 4.9.80-atom #1 SMP Mon Feb 5 13:26:54 EET 2018 x86_64 GNU/Linux

$ file /boot/vmlinuz-4.9.80-atom 
/boot/vmlinuz-4.9.80-atom: Linux kernel x86 boot executable bzImage, version 4.9.80-atom (user@hostname) #1 SMP Mon Feb 5 13:26:54 EET 2018, RO-rootFS, swap_dev 0x3, Normal VGA

On UEFI systems, you can view the UEFI boot variable BootCurrent to see which of the NVRAM boot options was chosen. But this is not very strong proof, as the boot option may have been edited after the boot happened, and if it points to a bootloader which can offer multiple boot options, it'll be ambiguous anyway.

The only strong proof I know of would be using a system with a TPM chip and a TPM-aware bootloader: it will store a cryptographically strong hash of the kernel originally loaded into the appropriate PCR register of the TPM. You would then be able to follow the same rules, recalculate the hash and see if it matches; if not, someone has tampered with either the kernel or the PCR register value. And the firmware will always fill another PCR register with a hash of the boot code actually used, so you can see any tampering of the bootloader too.

(The PCR registers are implemented in such a way that you cannot just set them into a value of your choosing: the new value will always be a cryptographically strong hash of the old value + any new data entered, so setting a PCR register to a specific known value when it already has some other non-zero value will be extremely hard.)

TrustedGRUB is a TPM-aware version of the GRUB bootloader. I once experimented with [an old version of it, based on GRUB Legacy](https://sourceforge.net/p/trustedgrub/wiki/Home/]. Currently there seems to be a new implementation based on GRUB 2 but it seems to support legacy-style boot only so far. I haven't tested it, because all TPM-capable systems available to me for testing are now UEFI-based.

|improve this answer|||||
  • Version number isn't a concern. I was trying to think of a way to verify kernel integrity; to ensure you're running on a trusted kernel. – patrick h Feb 25 '18 at 16:19
  • That's an even more difficult problem, but TPM might help there; updated my answer. – telcoM Feb 26 '18 at 6:43
  • Thanks for the update! TPM is one of the paths I've been investigating. So even initramfs doesn't know about where the kernel came from? – patrick h Feb 26 '18 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.