Systems and methods for securing operating system applications with hardware root of trust
An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: extract from a boot manifest a list of files associated with operating system applications of the information handling system and respective signatures for each of the files; locate the files listed in the boot manifest on a partition of a storage resource accessible to the processor; attempt to verify signatures for each of the files as stored on the storage resource against their respective signatures set forth in the boot manifest; enable execution of a boot loader for the operating system and the operating system applications in response to successful verification of the signatures; and abort a boot process of the information handling system in response to unsuccessful verification of the signatures.
1. An information handling system comprising:
a processor device; and
a non-transitory computer readable medium, communicatively coupled to the processor device, including executable instruction for a basic input/output system (BIOS) wherein the instructions, when executed by the processor device, cause the processor to perform BIOS operations including:
extracting from a boot manifest a list of files associated with application programs configured to execute within an operating system of the information handling system and respective signatures for each of the files;
locating the files listed in the boot manifest on a partition of a storage resource accessible to the processor device;
attempting to verify signatures for each of the files as stored on the storage resource against the respective signatures set forth in the boot manifest;
enabling execution of a boot loader for the operating system and the application programs in response to successful verification of the signatures; and
aborting a boot process of the information handling system in response to unsuccessful verification of the signatures; wherein:
locating the files listed in the boot manifest comprises determining whether an application program file is located in a container file and, responsive to determining that the application program file is stored in the container file, locating the application program file within the container file stored within a partition of the operating system, extracting an offset attribute and a size attribute of the application program file from the boot manifest, seeking to an offset in the container file in accordance with the offset attribute, and reading bytes of the container file in accordance with the size attribute.
2. The information handling system of claim 1 , wherein:
the boot manifest is signed with a digital signature; and
the BIOS operations include verifying the digital signature prior to locating the files listed in the boot manifest on the storage resource.
3. The information handling system of claim 2 , wherein the BIOS operations include aborting the boot process of the information handling system in response to unsuccessful verification of the digital signature.
4. The information handling system of claim 2 , wherein verifying the digital signature prior to locating the files comprises using a pinned certificate of the BIOS.
5. The information handling system of claim 1 , wherein the BIOS operations comprise Unified Extensible Firmware Interface instructions.
6. A method comprising, in a basic input/output system (BIOS) of an information handling system:
extracting from a boot manifest a list of files associated with application programs configured to execute within an operating system of the information handling system and respective signatures for each of the files;
locating the files listed in the boot manifest on a partition of a storage resource of the information handling system;
attempting to verify signatures for each of the files as stored on the storage resource against the respective signatures set forth in the boot manifest;
enabling execution of a boot loader for the operating system and the application programs in response to successful verification of the signatures; and
aborting a boot process of the information handling system in response to unsuccessful verification of the signatures;
wherein:
locating the files listed in the boot manifest comprises determining whether an application program file is located in a container file and, responsive to determining that the application program file is stored in the container file, locating the application program file within the container file stored within a partition of the operating system, extracting an offset attribute and a size attribute of the application program file from the boot manifest, seeking to an offset in the container file in accordance with the offset attribute, and reading bytes of the container file in accordance with the size attribute.
7. The method of claim 6 , wherein:
the boot manifest is signed with a digital signature; and
the method further comprises verifying the digital signature prior to locating the files listed in the boot manifest on the storage resource.
8. The method of claim 7 , further comprising aborting the boot process of the information handling system in response to unsuccessful verification of the digital signature.
9. The method of claim 7 , wherein verifying the digital signature prior to locating the files comprises using a pinned certificate of the BIOS.
10. The method of claim 6 , wherein the BIOS comprises a Unified Extensible Firmware Interface.
11. An article of manufacture comprising:
a non-transitory computer readable medium including computer-executable instructions readable by a processor, the instructions, when read and executed, for causing the processor to, in a basic input/output system (BIOS) of an information handling system perform BIOS operations, wherein the BIOS operations include:
extracting from a boot manifest a list of files associated with application programs configured to execute within an operating system of the information handling system and respective signatures for each of the files;
locating the files listed in the boot manifest on a partition of a storage resource of the information handling system;
attempting to verify signatures for each of the files as stored on the storage resource against the respective signatures set forth in the boot manifest;
enabling execution of a boot loader for the operating system and the application programs in response to successful verification of the signatures; and
aborting a boot process of the information handling system in response to unsuccessful verification of the signatures;
wherein:
locating the files listed in the boot manifest comprises determining whether an application program file is located in a container file and, responsive to determining that the application program file is stored in the container file, locating the application program file within the container file stored within a partition of the operating system, extracting an offset attribute and a size attribute of the application program file from the boot manifest, seeking to an offset in the container file in accordance with the offset attribute, and reading bytes of the container file in accordance with the size attribute.
12. The article of claim 11 , wherein:
the boot manifest is signed with a digital signature; and
the BIOS operations include verifying the digital signature prior to locating the files listed in the boot manifest on the storage resource.
13. The article of claim 12 , wherein the BIOS operations include aborting the boot process of the information handling system in response to unsuccessful verification of the digital signature.
14. The article of claim 12 , wherein verifying the digital signature prior to locating the files comprises using a pinned certificate of the BIOS.
15. The article of claim 11 , wherein the BIOS comprises a Unified Extensible Firmware Interface.