I am running an Arch Linux installation on my laptop with the following partition scheme:

  • /dev/sda1 is my /boot partition, which is also my ESP
  • /dev/sda2 is my LUKS encrypted root partition

I use systemd-boot as my bootloader.

As I was thinking about the security of this setup, I became paranoid, because the vmlinuz and initramfs images could be modified, as they are stored on an unencrypted partition. My concern is, that the images could be replaced with modified and malicious images from an attacker. Other than locking down the UEFI and disallowing boot from USB drives I don't have an idea to prevent booting modified images.

My questions are:

  1. Is this a real problem or is there already a security measure against this?
  2. If not, is there anything I can do to detect unauthorized changes when booting (something like signed images)?
  3. Are there any other security considerations when using this kind of a setup?


  1. I have a TPM in my laptop. Is there anything I can do with that?
  • If an atacker is able to compromise you at that level, the game is over. You can always umount /boot after booting, however I think you are just bringing complexity to the table. An alternate solution instead is encryption by hw, then you can encrypt everything. – Rui F Ribeiro Aug 16 '18 at 21:50
  • @RuiFRibeiro it does not have to be game over necessarily. If I can for example sign my own images and check for that on boot I could abort the boot process and show a warning. But I am unsure on how to do that. – Scrumplex Aug 16 '18 at 22:00

My concern is, that the images could be replaced with modified and malicious images from an attacker.

Yep, they could. To prevent that, you could boot from a removable drive yourself (which you remove when leaving the computer), or have the firmware securely check the boot binaries (like UEFI Secure Boot tries to do).

That still wouldn't prevent the attacker from installing a keylogger, or modifying the firmware of your system. With the signed boot approach, you'd also need to be sure that the attacker would not be able to modify the signing keys the computer accepts.

Are there any other security considerations when using this kind of a setup?

Cold boot attacks are pretty bad. Don't let your laptop get stolen when it's powered on.

Also, strictly speaking, encryption doesn't mean authentication in itself, and full-disk encryption usually doesn't authenticate the data since that would require changing the data size (the addition of authentication tags). The lack of authentication leads to malleability, the degree of which depends on the encryption algorithm (CTR and CBC modes are bad, and there's mentions of practical attacks against CBC-based disk encryption).

So, if you're paranoid enough, you probably shouldn't use the laptop after an attacker has had their time with it. But all of this depends on your threat model, the value of your data, and how advanced you expect your attackers to be.

|improve this answer|||||
  • Using an external drive as my boot partition is actually a very good idea. I was already thinking about Secure Boot but I don't like the Microsoftiness of that. My security concerns are quick attacks anyway. If an attacker has enough time to solder some chip on my motherboard then there is a much larger problem than my Linux root partition. – Scrumplex Aug 16 '18 at 23:07
  • I have edited my post. I have a TPM. Can I do something with that? – Scrumplex Aug 16 '18 at 23:15
  • @Scrumplex Have you looked at using yiur TPM for Measured Boot? Secure Boot and Measured Boot are not the same thing. With Measured Boot, before launching the next object, the currently-running object “measures” or computes the hash of, the next object(s) in the chain, and stores the hashes in a way that they can be securely retrieved later (think TPM) to find out what objects were encountered. – fpmurphy Aug 17 '18 at 4:42

There is no defence against physical access!

You can do whatever you want but even full disk encryption can be circumvented by a hardware key logger installed on one of your internal USB ports (on a laptop: soldered straight onto your motherboard)


|improve this answer|||||
  • If someone has enough time to open my laptop, solder some wires and chips to my motherboard, close my laptop and test his setup there is a much larger problem than my small little Linux root partition. I am concernes about quick attacks. Like some UEFI exploit which could allow booting from USB. – Scrumplex Aug 16 '18 at 23:10
  • Quick attack: insert a hardware USB keylogger in one of your USB ports externally... – Fabby Aug 16 '18 at 23:16
  • how could it read the internal keyboard of my laptop? – Scrumplex Aug 16 '18 at 23:20
  • That would be a new question. It's not like we charge more for more questions... ;-) – Fabby Aug 17 '18 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.