boot security, flows

[orangecms]

• TF-A design https://trustedfirmware-a.readthedocs.io/en/latest/design/firmware-design.html
• DRTM https://trustedcomputinggroup.org/wp-content/uploads/TCG_D-RTM_Architecture_v1-0_Published_06172013.pdf
• DICE https://trustedcomputinggroup.org/work-groups/dice-architectures/
• TPMs https://developers.tpm.dev/

[orangecms]

attestation channels

• screen (Heads)
• Bluetooth (Ultrablue)
• HTTP (agent, e.g. Immune agent / SDK, Keylime)
• USB?
• PCIe device, SPI, I2C... any other bus?

[orangecms]

https://www.redhat.com/en/blog/how-use-linux-kernels-integrity-measurement-architecture

Linux IMA enables TPM usage with the ima_policy=secure_boot cmdline option; can this be set statically?