also some distro _please_ enable kernel module signing why is this not enabled anywhere
Follow
fuchsiaaaaaaaaaaaaaaaaa
@haskal i think fedora does this?
"The Fedora distribution includes signed boot loaders, signed kernels, and signed kernel modules."
https://docs.fedoraproject.org/en-US/Fedora/23/html/System_Administrators_Guide/sect-signing-kernel-modules-for-secure-boot.html
@haskal @f0x with libre/coreboot computers, one is able to decrypt the LUKS volume at boot, then check the kernel and initramfs against a keysig. The LUKS decryption key can be supplied on a USB key, best practice is to use a dump file of /dev/{u}random.
That's the best answer that I've got with my use case.
@f0x ah, this is good at least