The Future of Platform Security Measurement in Linux
summary
LVFS/ fwupd’s Host Security ID (HSI) becomes the de facto Linux platform score but currently targets proprietary UEFI and leaves coreboot/edk2 vendors with edge cases. The implementation reads TPM via sysfs, UEFI vars, ACPI tables, MSRs (requires root and msr module), /dev/mtd0 to parse Intel flash descriptor, and PCI config space for PCH/ME, causing fragile parsing and false negatives when ME is disabled. Proposal: add kernel-exposed security flags, a centralized security posture API, and map HSI levels 1–3 to kernel-provided checks.
AI-written summary · about
chapters (14)
- 0:00Introduction to platform security
- 1:03Why firmware security matters
- 2:52Security measurement in Windows
- 3:36Security measurement in Linux
- 5:45Overview of HSI scoring
- 6:45Interfaces used for security checks
- 9:18Proper user space interfaces
- 10:22Hacky kernel interfaces
- 13:44PCI configuration space issues
- 15:52Centralized security posture API
- 17:19Using HSI reports for decisions
- 20:37Effectiveness of security reports
- 22:23HSI for vendor comparisons
- 23:30Database of firmware vulnerabilities
related talks
44mImpact of Platform Firmware on Linux Kernel
40mHardware Security Is Hard: How Hardware Boundaries Define Platform Security
47mLinux Virtualization Based Security
26mIntegrity
28mOverview of the Linux Kernel Security Subsystem
36mOverview and Recent Developments: Linux Integrity
27mPowerVM Platform Keystore - Securing Linux Credentials Locally
51mSecuring Embedded Linux Systems with TPM 2.0