safeboot.dev

What It Is

safeboot is a set of local system tools for “securely booting Linux.” Its goal is not to replace UEFI Secure Boot, but to build on top of it by linking platform keys, TPM2, LUKS, dm-verity, kernel lockdown, and remote attestation into a more complete chain of trust. It is mainly aimed at ordinary laptops and relatively standard Linux distributions, improving boot and runtime integrity without requiring a switch to Heads, LinuxBoot, or coreboot.

Core Capabilities

In terms of functionality, safeboot covers five categories of security goals: allowing only kernels and initrds authorized by the system owner to boot; sealing disk decryption keys in the TPM so they are released only when firmware, UEFI configuration, and PCR measurements match expectations; enabling kernel protections to reduce persistence after root compromise; optionally protecting the runtime system with a read-only root, dm-verity, and a signed root hash; and using TPM2 remote attestation to prove to external services that the device is in a trusted state. Its FAQ explains issues such as BootHole, PCR changes, recovery mode, and signing-key rotation in considerable detail, reflecting a strong security-engineering orientation.

Pricing and Open Source

The main page provides GitHub and source code links, and encourages users to submit issues or pull requests, so it can be considered an open-source tool. However, the captured content does not show a specific license. There is no visible information about commercial pricing, a hosted service, an enterprise edition, or paid support, so it looks more like a community security project.

Pros and Cons

The main advantage is its clear threat model. It further tightens areas where default UEFI Secure Boot setups are often weak, such as unsigned initrds, tamperable grub configuration, and disk decryption that is not strongly bound to platform state. By avoiding grub, it also reduces exposure to risks such as BootHole. The downside is a very high configuration barrier: it involves Platform Key management, TPM PCRs, monotonic counters, LUKS sealing, recovery passwords, hardware tokens, and more, making mistakes costly. The project documentation indicates that safeboot is still in its early versions, and it has mainly been tested on Intel systems with Bootguard; support for AMD and Qubes/Xen is not yet comprehensive.

Who It’s For and Access from China

safeboot is suitable for security researchers, advanced Linux users, endpoint security administrators, and high-security scenarios that need to defend against physical-access attacks and persistence after root compromise. It is not suitable for ordinary desktop users or teams without UEFI/TPM operational experience. The source text does not provide information on access from China; availability of the domain and GitHub resources needs to be tested in practice. Payment information is also not mentioned. Alternatives or comparable approaches include Heads, LinuxBoot, coreboot, and traditional distribution Secure Boot/shim/grub setups.