I am running an Arch Linux installation on my laptop with the following partition scheme:
/bootpartition, which is also my ESP
/dev/sda2is my LUKS encrypted root partition
I use systemd-boot as my bootloader.
As I was thinking about the security of this setup, I became paranoid, because the vmlinuz and initramfs images could be modified, as they are stored on an unencrypted partition. My concern is, that the images could be replaced with modified and malicious images from an attacker. Other than locking down the UEFI and disallowing boot from USB drives I don't have an idea to prevent booting modified images.
My questions are:
- Is this a real problem or is there already a security measure against this?
- If not, is there anything I can do to detect unauthorized changes when booting (something like signed images)?
- Are there any other security considerations when using this kind of a setup?
- I have a TPM in my laptop. Is there anything I can do with that?