40
Does Libreboot prevent unauthorized USB boot, aka somebody boot another OS and wipe your drive? (lemmy.world)
submitted 2 months ago by to c/linux@lemmy.ml
20 comments fedilink hide all child comments
 

I understand LUKs can be used to encrypt your data. But what would prevent somebody plug in a USB with and just wipe my drive?

On traditional BIOS like Lenovo, HP, Dell and even Framework you can set a supervisor password that locks the boot menu. So nobody can boot from the USB.

Coreboot is different though. I spoke with Starlabs whose computers run Coreboot, and apparently you can have the boot menu password. OTOH, Sys76's Coreboot doesnt allow such things.

I ask because i want to libreboot my T480, but the number 1 thing i worry is unauthorized USB boot.

This one: https://libreboot.org/docs/linux/grub_hardening.html#grub-password

seems to only lock the ability to edit the grub entry freely, aka press "e" to change stuff when grub fails to boot.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 2 months ago* (last edited 2 months ago) (2 children)

Just here for the comments, since I know of no way to disallow booting from removable media. Although I did recently come across a modern Lenovo laptop whose BIOS simply lacked the menu entry to switch boot order, boot device and anything like that...

Edit: which isn't a problem if you do full system encryption. You can even encrypt your boot partition. And even if an adversary dumped your system from to a removable media, decrypting that wouldn't be a viable option unless they were a nation state level actor.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •