The purpose of this blog post is to explain how Secure Boot works. In
particular, we will explain where current implementations of Secure Boot by
Linux distributors fall short compared to Microsoft Windows and Apple macOS.
Major distributors like Canonical, Debian, openSUSE, and Red Hat place a high
priority on making their operating systems work out of the box. Given the
current Linux landscape with out-of-tree drivers and incompatible licenses,
providing the end user with all the drivers possibly needed to boot the system
can be challenging.
Many Linux hardening guides focus on well-known protections: full-disk
encryption, Secure Boot, and password-protected bootloaders. While these
measures are critical, they often overlook a subtle but serious attack vector:
the ability to drop into a debug shell via the Initial RAM Filesystem
(initramfs). This oversight can enable an attacker with brief physical access to
bypass conventional boot protections and inject persistent malware into the
system.
In this post, it is demonstrated how this attack works on modern Linux
distributions, such as Ubuntu and Fedora, and explained why existing guidance
often fails to mention it.