From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alex Griffin" Subject: Re: Unencrypted boot with encrypted root Date: Tue, 07 Apr 2020 15:05:05 +0000 Message-ID: <135d8491-53e8-46b6-b77a-fe6a4539b15d@www.fastmail.com> References: <87ftdmi7pp.fsf@ambrevar.xyz> <17c316adc8485d1f09f70d291cfaad50258c6c1f.camel@wine-logistix.de> <20200403194423.m3pvz654qslug7g3@pelzflorian.localdomain> <20200404101832.cmegsybfyrseazjq@pelzflorian.localdomain> <4610a9147fa041ebb47f184a2d3f7878a8a2539c.camel@wine-logistix.de> <87d08jbpcc.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:35330) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jLpn8-0001wp-FJ for guix-devel@gnu.org; Tue, 07 Apr 2020 11:05:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jLpn5-00074i-Dl for guix-devel@gnu.org; Tue, 07 Apr 2020 11:05:30 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:55257) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jLpn5-00073o-5D for guix-devel@gnu.org; Tue, 07 Apr 2020 11:05:27 -0400 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 8BB835C026C for ; Tue, 7 Apr 2020 11:05:25 -0400 (EDT) In-Reply-To: <87d08jbpcc.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane-mx.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org On Tue, Apr 7, 2020, at 9:46 AM, Ludovic Court=C3=A8s wrote: > The difficulty is that any file traveling through the store is > world-readable. It=E2=80=99s hard to avoid. If we can create the key file outside of the store, then GRUB is capable= of being passed multiple initrds. So we can put the key in its own init= rd (outside of the store), continue to generate the normal initrd in /gn= u/store, and pass both of them to GRUB. The key never enters the store i= n any way. The result is that the user only needs to enter a password into GRUB, be= cause GRUB then passes the key file to the kernel. --=20 Alex Griffin