[BACK]Return to cgdroot.mdwn CVS log [TXT] [DIR] Up to [NetBSD Developer Wiki] / wikisrc / security

Diff for /wikisrc/security/cgdroot.mdwn between versions 1.17 and 1.18

version 1.17, 2018/04/14 21:48:34 version 1.18, 2018/04/14 21:50:47
Line 71  Caveats Line 71  Caveats
   
 The biggest (known) issue with this setup occurs when firmware needs to be loaded early in the boot process (such as graphics drivers for the console). At the moment they need to be provided as part of the memory disk. Some network interfaces, of which some wireless devices in particular, also require loading firmware to work properly.  The biggest (known) issue with this setup occurs when firmware needs to be loaded early in the boot process (such as graphics drivers for the console). At the moment they need to be provided as part of the memory disk. Some network interfaces, of which some wireless devices in particular, also require loading firmware to work properly.
   
 Firmware that can be loaded later (e.g. microcode in `sysutils/intel-microcode-netbsd`) can be found only if the corresponding paths in the `hw.firmware` sysctl variable are adjusted to start with `/altroot`.   Firmware that can be loaded later (e.g. microcode in `sysutils/intel-microcode-netbsd` package) can be found only if the corresponding paths in the `hw.firmware.path` sysctl variable are adjusted to start with `/altroot`. 
   
 This setup is not entirely safe against physical attacks. An attacker can modify the boot process to store the passphrase for later retrieval, or insert a backdoor while booting. To defend against such attacks, the bootloader, kernel and ramdisk all need to be signed and their integrity checked before booting (e.g. with [[!template id=man name="tpm" section="4"]]). Alternatively, it is possible to boot from a removable medium (e.g. USB stick), which can be protected against tampering attacks (e.g. secure storage, read-only volume...).  This setup is not entirely safe against physical attacks. An attacker can modify the boot process to store the passphrase for later retrieval, or insert a backdoor while booting. To defend against such attacks, the bootloader, kernel and ramdisk all need to be signed and their integrity checked before booting (e.g. with [[!template id=man name="tpm" section="4"]]). Alternatively, it is possible to boot from a removable medium (e.g. USB stick), which can be protected against tampering attacks (e.g. secure storage, read-only volume...).
   
Removed from v.1.17  
changed lines
  Added in v.1.18

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb