title: Is it possible to boot an unified kernel image as Xen Dom0 with UEFI Secure Boot?
body: <p>I am trying to set up a Xen Host in a way that every step until booting the Dom0 Linux kernel is Secure Boot verified.</p>
  
  <p>Without Xen, this could be achieved by signing an unified kernel image containing the kernel, initrd and kernel command-line parameters in a single EFI binary.</p>
  
  <p>Signing only the Xen EFI binary is useless because the kernel, initrd and Xen configuration file could be modified without affecting Secure Boot.</p>
  
  <p>When booted via Shim, Xen verifies the Dom0 kernel and initrd using the Shim protocol, but the Xen configuration file containing the kernel command-line parameters is not verified, so an attacker could still modify these parameters.</p>
  
  <p><a href="https://github.com/tklengyel/xen-uefi" rel="nofollow noreferrer">tklengyel/xen-uefi</a> patches the Xen source code to measure the Xen configuration file into a PCR register. This would not be necessary if the signed kernel binary booted by Xen included the initrd and kernel command-line parameters and all other parameters specified in the Xen configuration file were ignored.</p>
  
  <p>Is there any way to achieve this?</p>