Uefi on Le Site de François

GRUB (GNU GRand Unified Bootloader)

Mon, 01 Jan 0001 00:00:00 +0000

GRUB (GNU GRand Unified Bootloader) is the bootloader used by the majority of Linux distributions on x86 and x86-64 systems. Its role is to bridge the gap between what firmware hands control to and what the Linux kernel needs: firmware (BIOS or UEFI) loads GRUB, and GRUB locates the kernel image and initrd on disk, assembles a kernel command line, and transfers control to the kernel. Because GRUB understands a wide range of filesystem formats — ext4, XFS, Btrfs, FAT, and more — it can read its own configuration and the kernel directly from the root or boot partition without any intermediate step, which is what distinguishes it from simpler bootloaders that can only read from FAT.

Measured Boot

Mon, 01 Jan 0001 00:00:00 +0000

Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.

Secure Boot (UEFI Secure Boot)

Mon, 01 Jan 0001 00:00:00 +0000

UEFI Secure Boot is a firmware-level mechanism that ensures each binary executed during the boot process — bootloader, kernel, UEFI drivers — is cryptographically signed by a key the firmware trusts, before it is allowed to run. It is defined in the UEFI specification and implemented by the firmware on virtually all modern x86 and ARM platforms. Its threat model is bootkits and rootkits that install themselves before the OS loads and therefore survive reboots, OS reinstalls, and cannot be detected by any software running after them.