Features/Trusted Boot

= Trusted Boot =

Summary
Add install-time configuration of Trusted Boot(tboot).

Owner

 * Name: Gang Wei
 * Email: gang.wei@intel.com

Current status

 * Targeted release: Fedora 16
 * Last updated: 2011-07-14
 * Percentage of completion: 5%

Discussed with grubby owner. I may need to provide a patch to handle kernel upgrade for tboot+xen+kernel case.

In progress of discussion with anaconda community to figure out what/how to do for installation support.

Detailed Description
This would include two things to be done at install time: Below is a mock up screen shot for this
 * UI to choose TXT/tboot support



Below is a sample grub.conf file showing the change.
 * The underlying support to install the package and modify the bootloader cfg.

default=0 timeout=5 splashimage=(hd0,2)/boot/grub/splash.xpm.gz hiddenmenu title Fedora (2.6.38-0.rc5.git1.1.fc15.x86_64) root (hd0,0) kernel /boot/vmlinuz-2.6.38-0.rc5.git1.1.fc15.x86_64 ro root=UUID=2c16235d-452c-4109-b93c-7b6e93795682 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=us rhgb quiet initrd /boot/initramfs-2.6.38-0.rc5.git1.1.fc15.x86_64.img title Fedora w/ tboot (2.6.38-0.rc5.git1.1.fc15.x86_64) root (hd0,0) kernel /boot/tboot.gz logging=vga,serial,memory module /boot/vmlinuz-2.6.38-0.rc5.git1.1.fc15.x86_64 ro root=UUID=2c16235d-452c-4109-b93c-7b6e93795682 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=us rhgb quiet module /boot/initramfs-2.6.38-0.rc5.git1.1.fc15.x86_64.img

Benefit to Fedora
Fedora will be capable to do trusted launch with tboot support. It will meet the increase needs for platform security.

Scope
Required steps are:
 * 1) UI to choose TXT/tboot support during installation.
 * 2) Scripts to install the tboot package and modify the bootloader cfg.

How To Test

 * It requires platforms supporting Intel TXT.
 * If selected during system installation UI, make sure the tboot package is installed and the bootloader config is changed to boot tboot as kernel and linux as module.

User Experience
User will find the tboot packge easier to install and use.

Dependencies
None on other packages.

The tboot package is only for x86, but tboot will detect whether the systems supports TXT and will perform a normal boot if it does not (and hence can be installed on x86 systems that do not support TXT).

Intel requires all server OEMs to carry the SINIT ACM for future platforms in their flash. Current availabe models include:
 * Dell PowerEdge R810/R910 with E7 processors
 * HP ProLiant DL580 G7 with E7 processors & TPM option kit

Contingency Plan
None necessary, revert to previous release behaviour.

Documentation
tboot project web page
 * http://sourceforge.net/projects/tboot

Documentation about tboot functionality
 * http://www.bughost.org/repos.hg/tboot.hg/file/d36fb3e85062/README

The Intel® TXT Software Development Guide should be able to show you details about what tboot does.
 * http://download.intel.com/technology/security/downloads/315168.pdf

More documentation about TXT
 * http://www.intel.com/technology/malwarereduction/index.htm

Documentation about Intel® SMX instructions is included in Intel® 64 and IA-32 Architectures Software Developer's Manual, Volumes 2, chapter 6, Safer Mode Extensions Reference
 * http://www.intel.com/Assets/PDF/manual/325383.pdf

Release Notes

 * Trusted Boot (tboot) is an open source, pre- kernel/VMM module that uses Intel(R) Trusted Execution Technology (Intel(R) TXT) to perform a measured and verified launch of an OS kernel/VMM.

Comments and Discussion

 * See Talk:Features/Trusted Boot