15 KiB
Strapping HDA_SDO or HDA_DOCK_EN requires physical access, because you have
to short a pin on the HDA chip on the motherboard, or there will be a header
for this on the board (e.g. "service mode" jumper).
On Dell Latitude laptops specifically, the EC can unlock flash by setting
the SDO/DOCK_EN signal as described, and this is in fact what
the dell-flash-unlock utility does, so you can consider IFD locking there
to be basically useless.
In addition to the above, you may also consider /dev/mem protection.
Enable CONFIG_STRICT_DEVMEM in your Linux kernel, or set securelevel above
zero on your BSD setup (but BSD cannot be booted with GRUB very easily so
it's a moot point).
Other write-protect methods
The steps above do not require recompilation of the Libreboot images. However, coreboot offers additional security at build time, which you can select if you wish.
Let's assume your board is x200_8mb, do:
./mk -m coreboot x200_8mb
Find this section: Security -> Boot media protection mechanism
In the above example, I found:
- Lock boot media using the controller
- Lock boot media using the chip
Which one to pick depends on your board. Let's pick "controller".
Now we can see: Security -> Boot media protected regions
In there, there is the option to ban writes, or to ban both reads and writes.
Banning reads may be desirable, for example if you have a salt hashed password
stored in grub.cfg! (as this guide told you to do)
You'll have to play around with this yourself. These options are not enabled by default, because Libreboot images are supposed to allow writes by default, when booted. You have to enable such security yourself, because the design of Libreboot is to be as easy to use as possible by defalut, which include updates, thus implying read-write flash permissions.
This example was for x200_8mb, but other boards may look different in config.
Anyway, when you're done, save the config and then build it from source in lbmk.
See: build from source
Install the new image
Now simply flash the new image, using the flashing instructions.
If you did all of the above steps correctly, your system should boot up just fine. Shut it down and wait a few seconds. If you screwed it up and the system is now unbootable, that's OK because you can use an external flasher; please read external flashing instructions