<div dir="ltr">Sorry, didn't see this reply in the sea of unread emails! Thanks, I'll look into those this weekend.</div><div class="gmail_extra"> <div class="gmail_quote">On Sat, Apr 23, 2016 at 12:23 PM, Tom H <<a href="mailto:tomh0665@gmail.com" target="_blank">tomh0665@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Sat, Apr 23, 2016 at 6:13 AM, Ashish Kansara <<a href="mailto:ashishnkansara@gmail.com">ashishnkansara@gmail.com</a>> wrote: > > I was looking at doing a clean install of 16.04, this time with block device > encryption using dm_crypt and LUKS, and was wondering if Ubuntu does any > kernel integrity check on boot. > > From what I understand, secureboot will only perform an integrity check on > the bootloader; the bootloader itself does not check the kernel hash. This > seems sort of counter-intuitive since /boot is not encrypted. Of course, > this is solved if a kernel integrity check is performed on boot. For secure boot: shim-signed grub-efi-amd64-signed linux-signed-image -- ubuntu-users mailing list <a href="mailto:ubuntu-users@lists.ubuntu.com">ubuntu-users@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-users" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/ubuntu-users</a> </blockquote></div> </div>