Trusted boot

The chain, in the order it actually runs.

1. GRUB loads the kernel and the modules

   BIOS or UEFI. The kernel carries a SHA-256 manifest of the boot modules. A module that fails it cannot be read. That check does not depend on a TPM.

2. The kernel image is pinned into what the firmware measures

   On a measured boot the pin is in the image the firmware extends into PCR 4, and the volume key is sealed to that measurement together with PCR 8 and PCR 9. A different kernel changes the pin. A volume sealed under the old image will not open until it is resealed. There is no signed-kernel scheme yet, because that would make PCR 4 the same for every kernel the signature accepts.

3. Without a TPM, the default build says so and continues

   Nothing is measured and the volume key is not sealed. The boot log says so, and so does init at every login. A machine with a TPM halts if the measurement fails, and a format that cannot seal the volume is refused. MEASURED_BOOT_REQUIRED=1 also halts when no TPM is present, and refuses a persistent volume that was never sealed. CI runs the TPM gates with SWTPM_REQUIRED=1, so those gates cannot pass by measuring nothing.

4. init is the only delegation root

   Every capability in the system starts with init. It starts the servers and the shell and lends each the capabilities that session's policy allows. A login does not inherit the administrator's set unless the policy says so.

Rollback of a whole volume is refused when a TPM counter was bound in at format time. A rollback inside the current boot is not refused: the counter advances once per unlock. A volume moved to another machine is refused, and there is no export path. Those are open, and they are on the session queue.