Heads may accept unsigned files indicating a /boot update came from a package manager

There is code in Heads to accept kexec_package_trigger_pre.txt or kexec_package_trigger_post.txt on /boot, which are intended for a package manager to describe intentional updates it made to /boot. This originates from this commit: https://github.com/linuxboot/heads/commit/887c79065eb6c25dc8e0abb9acf4cfddbcd968b2

The intent appears to be that the OS can tell Heads that certain updates to /boot are intentional, and Heads will soften the message about tampering a bit telling you what the OS said.

For example it could say this instead of the usual "these files failed verification":

The following files failed the verification process AFTER package updates ran:
${CHANGED_FILES}

This is likely due to package triggers in$UPDATE_INITRAMFS_PACKAGE.

You will need to update your checksums for all files in /boot.\n\nWould you like to update your checksums now?

However, there is no authentication that these files actually came from the OS, an attacker tampering with /boot could create them too. So I think it undermines security, it's purporting to help you decide whether the changes are intentional, but it doesn't actually know itself. It still shows the correct files and says "likely due to" (it's not sure), but it's basing that on information an attacker could manipulate.

It might even undermine security for users not using this integration - the logic to check for the file is still there, although hopefully such a user would see that prompt as unexpected since they do not normally get it for OS updates.

linuxboot / heads

Heads may accept unsigned files indicating a /boot update came from a package manager #1600