Skip to content

Latest commit

 

History

93 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

SecureBin - Userspace Executable Signature Verification on Linux

Minimal and Alpine demo

(This document was 100% written by myself, the author.)

Important

Significant AI assistance

This was my first experiment on software development using an AI-integrated IDE.

The grand majority of code and documentation has been written by AI.

Significant effort was put into "mutual brainstorming and planning"; I did not let it go off on its own.

A more in-depth documentation of my experience will be available Soon(tm).

AI Environment

Cursor IDE

Claude Opus 4.5, Gemini Pro 3.0, Gemini Flash 3.0, Grok Code, Composer, etc.

What's this?

SecureBin is a project that implements signature verification for userspace binaries and scripts on Linux.

Should I use it?

No. This is a for-fun, very primitive project.

Also, would you trust something that was finished in a week to secure your system? I wouldn't.

Why?

  • There is a chain of trust on Linux from boot right up until before userspace
    • UEFI Secure Boot exists
    • Kernel can secure its modules with module signing
  • I'm not aware of anyone having extended it to userspace
    • It seems like a gaping security hole
  • I had the idea after looking through Apple's Platform Security docs
  • I thought it'd be a unique, non-trivial, non-sloppy task to have AI help me with

Note

This project anchors itself to a hash given as a kernel parameter. Securing your system up to that point is out-of-scope.

I want more details

See docs/ARCHITECTURE.md and other documents in docs/.

Demo?

Minimal

This only boots to a minimally-populated BusyBox environment using QEMU aarch64, software emulation.

The MOTD after boot should be self-explanatory.

See examples/test_minimal.sh and docs/testing_qemu_minimal.md

Tested on Fedora 43 with:

dnf install @development-tools guestfish golang glibc-static

3311dff32e746499f4df0d5df04d7eb396382d7e108bb9250e7b519b837043a4  busybox-1.37.0.tar.bz2
4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3  linux-6.18.16.tar.xz

Alpine

This on the other hand boots to a full Alpine Linux installation. Also uses QEMU aarch64, software emulation.

Login: root (no password). Won't shutdown gracefully, must <Ctrl-A> X.

See examples/test_alpine.sh and docs/testing_qemu_alpine.md

Tested on Fedora 43 with:

dnf install @development-tools guestfish golang glibc-static

3311dff32e746499f4df0d5df04d7eb396382d7e108bb9250e7b519b837043a4  busybox-1.37.0.tar.bz2
4f21c01f4d04c1d1b3ed794153f8900802c92497be620b07c4869530f2d28ee3  linux-6.18.16.tar.xz
b26811d962af02a174c1b8d11f951b3dc43a78caa6a9bbb2afddd78d8c24dcea  oci_alpine-3.23.3-aarch64-uefi-tiny-r0.qcow2

About

Userspace Executable Signature Verification on Linux

Resources

Stars

1 star

Watchers

1 watching

Forks

Releases

Packages

Contributors

Languages