Um, but we want to use a lot of other sort of bits and pieces that are important there, too.
So the Effy Stab is, of course, part of the UKI.
Um, in certain cases we might want to have a menu, so we want something that maybe looks
familiar like, like the grub menu, so we're using the grub menu right now.
You need some kind of in it, RAM of FES generator, um, in order to, uh, so far, that's how we,
we're making the UKI's, and then, of course, Effy variables, and.
It's definitely one of the, one of the, one of the things that we're using, and that
all of these things together and more that I'll talk about, form nimble, and, and that's
just a really, really basic idea.
Um, for people who aren't familiar with what a unified kernel image is, um, it's, uh, this, this,
this way to sort of put the kernel, and the kernel command line, and the RAM of FES, and the
Effy Stab, and to just have one image, which can be signed, and which, uh, sort of gets, gets rid of
some of the security holes that we have currently, and, and you have a whole package, um, that
can be, yes, as I, as I said, signed for, for secure boot, and which can be measured.
Um, currently in nimble, we have two different schemes, um, so we can build the unified kernel
image, either as, like, a switch root image, which is the case that you see here. Um, so basically,
nimble would be built with the final kernel that you want to boot, and you would basically just start
from, uh, start from UEFI, as I mentioned, we're keeping secure boot, so we would still have a shin,
um, uh, and then you would just sort of, you know, you, you would just boot your kernel,
basically, you're, you're, you're, you're, you're, you're, you're, you're, you're unified kernel image,
and you would be in user space. Um, ultimately, to sort of have, um, have the, the choice to,
to, uh, to choose another kernel, if you want to, um, we have a K exec version that, also, that, that,
that this is already built into the, built into, of course, into the, into the nimble, into the, into the
UKI, is that you would have the grub, you would, you would start booting in the same way, you start
from, from Fee, you have the shin, and then you would boot, but it wouldn't be necessarily the
final, the final kernel that you want to boot into, so then you could have, like, a menu that
would look like rub, and, um, and could later, of course, then change if we, if we, if we want to,
and then you would, how, you could choose a different kernel, um, from this menu, and then the rest
would sort of proceed, um, as before. So, um, one question, of course, that we got is, like,
why are, why are you doing this? There are so many bootloaders out there, um, for those of you
that were here, uh, Daniel was talking about grub, everybody knows about grub, but they're also,
other, other bootloaders out there, so, so why are we doing this? And so, um, when you have
another bootloader, when you have, you know, it's more code that you have to maintain, and, um,
so, one thing that is always that always happens is that, you know, new functionality goes into the
kernel, for example, and then that has to be ported into grub, or it has to be ported into,
whatever, whatever bootloader. So, in this case, your bootloader is your kernel, so you deliver features
quickly, and there's much less maintenance burden, because you don't have to, you don't have to
do this again, you don't have to worry if you're introducing, you know, further, further vulnerabilities,
with, with your fixes. Um, we think that this would, will really increase security and security scrutiny.
There are a lot of people working on the Linux kernel, a lot of people, as, as you, as you all know,
I'm sure. Um, there aren't that many people working on bootloaders, and, um, so, more eyes, uh, and,
and, and, again, just, one, a single, like, set of code is going to make, is going to make things
more secure. Um, we think it might decrease boot time. It could be faster, especially in this
bit-true case. It can be a faster, it can be a faster boot. Uh, so, that's always nice.
And, yes, we would like to replace grub. Um, if for those of you who are here, uh, Daniel gave a great
talk, uh, just recently about, uh, just a few, a few talks ago about all the new features that
are going into grub. And it's, and it's, it's awesome. Um, grub is, grub is great. A lot of us use grub,
and it's, um, it is constantly getting updated and constantly getting new features, which is wonderful,
but it's also really complicated. And I, I know, I know how many, how many issues we have and,
and how, how long it sometimes takes to get, um, new features there and how many vulnerabilities
we also worry about and things like this. So, so, it's, uh, I think it's a noble, it's a noble goal.
Um, so then you might ask, uh, well, what about the command line? I mean, one thing if you have the
whole signed image, um, what if the user, for example, wants to, wants to change the command line?
So there is, there are some possibilities, um, I know, so for us in, in, in, in, in fedora in
Rale and sent us, um, or anyone who, using system D that system D, um, is implementing sort of
signed command line, uh, bits. But we would like, uh, users to be able to, um, to add, uh, their own
sort of command line if, if they, if, if it's, uh, uh, uh, to, to, to modify the command line the way they like.
So, normally, um, uh, in Fee, for example. So I'm, I'm talking about Fee, but we're actually
we're hoping to implement it, um, on other platforms as well. But on Fee, for example, um, you have
the, uh, uh, uh, the load ups and generally it's just a string and it might be shim, for example,
or grub, and, um, sometimes you can tell it what the next stage of bootloader is going to be.
Um, so we want it to sort of make sort of sort of something kind of similar, or to expand this
functionality, um, rather, um, and to do something what we call a shim hive.
So the idea of the shim hive is that, um, um, in, in, in, in Fee, uh, it's not the implementations
are better and worse, depending on, uh, well, there are many different, there are different
implementations of it, and it can be better. It can be worse. Sometimes it's not as dependable.
And we would, so, so the idea is to, um, build, sort of like the windows registry hive,
that we would have something that we call a hive, and that's going to be the magic, so we know
we know where it starts, and it will be, um, some key value pairs, and then there'll be, there'll be
terminated, and we'll have a, uh, CRC 32 of the entire entire hive, so that we know, um, what's, uh,
so the way, so we keep track of everything, we know we know the value of everything. So we,
the idea is, so you have these key value pairs in the shim hive, um, and, and we have so far,
we have, we're instituting two keys, one of which is the, um, the path to the next bootloader,
and then the other one is the, is the command line, so you're not meant to read that. It's just sort of,
kind of like a, a concept kind of slide, but, um, yeah, so, so that way, um, the user, well, I mean,
root can, can modify the command line, um, in user space. Um, of course that'd be, it'll be
altered, but we'll measure, we'll still measure, it'll be in some PCR register, I don't know,
maybe in two or something like that, and, um, so we'll measure, and we'll know that there's a change,
but since the whole thing is, you guys, is signed, we can still boot, when secure boot, and we don't,
we know that it changes taking place, but we're still able to boot securely.
Um, so another, another thing that we'd like to, we'd like to address, and which can be, um,
of course, a worry with with bootloaders is fallback, and what to do with fallback. So,
um, the idea is to, that we'll always have, um, especially since, uh, you know,
because nimble will be based on the kernel, every time you update the kernel, theoretically,
you could be updating a bootloader, which can also be scary. So, so the idea is that we would use,
in, for, in Fee, um, we would use Fee variables for this. So, we would always have, like, a fallback,
which is whatever you booted into, the last known good, um, uh, boot entry, and then we would have,
have the, have the new one with all of, with the updates in it, and we would use these Fee variables
in order to, to try the new student that we can collaborate. That's kind of the ideas that we could
work together on this if people think it's, it's a nice idea. Um, so I just want to, I've been working
a little bit on this, but of course, the people, it's very much not just my work, um,
Nicola Freyer, uh, Peter Jones, Lil Sunderval Richard Hughes, put the vanda, or all, uh, engineers
that, at Red Hat, who have worked on this, as well as some of our managers, some past people who
worked on it as well. So, thank you very much, um, and, uh, if you have any questions, please.
You mentioned it, uh, thank you for all those reasons and very useful. You mentioned your
history and collaboration. I work with the heads project, we familiar with that. Uh, it's, it's
another project that also uses a Linux current with firmware to boot your OS. Um, so there are
a lot of issues here. I think that we could adopt and I wonder if some of our, so stuff that we've
already implemented made to use the tool as well. That sounds cool. Yeah, of course. Um, and so
you're email later with some Linux and please do. And I'll, for all these like, two, it's a very
interesting. Riku, had, had, had, had, had's project, you said? Yeah, had's cool. How much of this,
so it is actually implemented, are you able to execute an OS kernel at this point? Yes, um, I can,
I mean, I don't know if you guys want to watch a VM boot, it's not very exciting. Oh, I'm sorry.
I was asked how much of this is actually implemented if we can actually boot with the kernel. Yes,
we can. Um, I have, we, so we can build it on Fedora and we have these these two cases,
this which route and the K exec versions. Um, I have a VM with that, uh, insult. I can sure,
I don't think you all want to watch VM's boot. It's kind of boring, but I can definitely show you
if you're interested. Um, I've got one, I've got one here on my, on my laptop. So, so yeah, all of
that works. Um, uh, what we're, we're doing, now, what we're doing now, more is trying to, um,
to, um, uh, to test it on hardware, because, um, VMs of VMs are nice, but hardware can be finicky,
and especially seeing people worry about things like K execs, for example, functioning.
So we are, we are, um, testing on hardware, not as much as I'd like yet, but we have been testing
of it on hardware on both x86 and aarge. And, um, we have a lot of the shim high of code written,
and we're still working on the AB booting to make it the way we like, but, um, the basics are there.
Sir, I have, I have so many questions, I'm afraid to do one more.
That's all right. But yeah, uh, I kind of want to let you do questions. Uh, ask for the pads.
Uh, yeah, it's very interesting, just that little work that it's have, uh, the manuals,
paddles for code would be a lot of help. Yeah, but I have two questions for, uh, for that
full, like, how, uh, how do you decide, uh, when to, like, Mars, like, the, uh, the, uh, the
cartilage, uh, like, the, the update conversion that is supposed to be,
Mars, as it is in the home. And, um, the second question is what about, uh, booting non-link system,
um, so one question was about how we set the, how, how we decided that the boot was, was, uh,
correct, and the other one is about non, non-lunics, but booting non, non-lunics.
So, um, for, for setting the boot, uh, with, so in, in Fee, you always, you know, uh, you know what
booted. You know what entry you booted into. So, I mean, I would say that in Fidora, we could set a boot
target, and we could say, like, once you get to some system, the boot target, you reach boot,
complete, or something like that, and you, you can set, you can then, in Fee, you can set, knowing,
knowing what booted, you can then set the reset the boot order. Um, uh, I think that we've decided that
non-lunics is something that we're not, we're going to try not to deal with, and we want Fee
variables to deal with that, instead of, like, doing any kind of chain loading or anything
along those lines. So, it would be through Fee.
Uh, can it replace the boot for embedded systems? Um, I, I don't know, maybe it could. I think
that would be nice, that would be cool, but I, I don't, I don't know.
I just, not not, I don't know. No, I, not currently, no.
How fast it is to have to leave KXX, and the second question is, I'm still motivated for my experience
about KXX, because as far as I can tell, throughout this, to come, yes, it's going to be different
in this, for who you can say, see, but if you have a much complicated environment like
servers, you can make a cart, my experience, you can make this, you go, it's tough, it's
some cases, you can make, you need a cart, you know, it's difficult to make it work, so
what do you say, or it's because it's good to talk about what's not good for destiny
reason, and so on, or really about how we got one, so what do you sell it to you in this
case?
I'm, unfortunately, I haven't done more testing recently, but I know that I've been,
I'm sorry, I'm sorry, you're, you're, you're, you're, you're, you're, you're quite,
I threw a piece of your question, Daniel was worried about K exact, mostly, unreal hardware
and, and how, how, yeah, with, with weird, weird setups, my experience as far as I remember
now, it's been, it's been not too bad, unreal hardware, like, the few, I don't even have
the list anymore, but the, the few sort of, X86 and AR, to machines that I tried, I think one
of them, I think one, one machine hung, I can't tell you what it was now, but I have, I have
successfully tested on a number of, of different, real pieces of hardware, I know that K exact
can be a problem, that's what people, I think that's one of the main issues that people
bring up about this, is that people are worried about K exact, so, even now, like, the compression
of our AR's kernel has changed, and it's not, that doesn't work in K exact now, for
Dorah, so, like, we can, that doesn't work currently, but it's going to, hopefully,
work soon, so even in a, even in a VM, we wouldn't be able to do it, but we have, I know
that we have to continue to, to, to test hardware, and we will continue to test hardware,
because, yeah, I'm sorry, so, I mean, it's, the book time is very similar, except that if you
have a menu, it's going to be a little bit, it's going to be a little bit slower, if you
have a menu, if you have things like this, but, but the, but the, but the actual boot time is
not significantly affected, so K exact is not introduced much, much time to it.
The question was about the shimhai of, and how it's going to, um, the question was about the shimhai,
and how it's going to, um, yeah, whether it's signed or whether, how it's, how we maintain
the, okay, so the question is about about shimhai of, and how we can alter the
command, how we can allow users to change the command line, and, and keep, keep it signed.
So the shimhai is going to, we're, we want to use FV variables for this, so, so it wouldn't,
it wouldn't be signed, but it would only be accessible like root, could access it, but it wouldn't
be, uh, and it would, and let us ask that, it would, it would be measured, so we would be aware of
changes, um, but it wouldn't be, uh, only using the K exact case, and, and updating nimble,
them updating the boot loader every time they got a new kernel, that would be, you know, you
couldn't possibly get anything signed fast enough, you couldn't distribute it fast enough, so
they're had, so there has to be this, this step in between. Obviously, if you would remove
those certificates, if you wanted to just do your own chain of trust from hard, you know, from
hardware to, to, to kernel, you could do that, but I think that there are a lot of people,
maybe you all can do that, but I, I think there are a lot of people who don't know how to do that,
especially things like option rooms, you'd be screwed. So, thank you so much, uh, for your attention
for your time, I'm here, I'm here, so come find me, uh, right name mail, whatever.