From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ellen Papsch Subject: Re: Unencrypted boot with encrypted root Date: Wed, 08 Apr 2020 14:37:39 +0200 Message-ID: <94dc6c0586bea6772a345b4d5f10138a576f541f.camel@wine-logistix.de> References: <87ftdmi7pp.fsf@ambrevar.xyz> <17c316adc8485d1f09f70d291cfaad50258c6c1f.camel@wine-logistix.de> <20200403194423.m3pvz654qslug7g3@pelzflorian.localdomain> <20200404101832.cmegsybfyrseazjq@pelzflorian.localdomain> <4610a9147fa041ebb47f184a2d3f7878a8a2539c.camel@wine-logistix.de> <87d08jbpcc.fsf@gnu.org> <87369f82x7.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:37194) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jM9xf-0007Uw-Jf for guix-devel@gnu.org; Wed, 08 Apr 2020 08:37:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jM9xd-0008C0-HU for guix-devel@gnu.org; Wed, 08 Apr 2020 08:37:42 -0400 In-Reply-To: <87369f82x7.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane-mx.org@gnu.org Sender: "Guix-devel" To: Ludovic =?ISO-8859-1?Q?Court=E8s?= Cc: guix-devel@gnu.org Am Dienstag, den 07.04.2020, 22:19 +0200 schrieb Ludovic Courtès: > Ellen Papsch skribis: > > > Sure, but what happens when you reconfigure? You still need to have > that file around so it can be added to the initrd. > Does it really have to be added to initrd? From my other reply: > These may be dangerous waters. The key file in initrd is like a house > key under the mattress. A malicious process could look in the well > defined place and exfiltrate the key. Think state trojan horses. A > random name would not suffice, because other characteristics may help > identifying the file (i.e. size). > I think* Guix would burden itself too much with secrets. It's > something for the user and the installer should just make it more > convenient, with a nudge to a more secure setup. The key file should > be stored in a user specified location, preferably a pen drive (which > is otherwise not used). It can be removed, so no read can occur by > arbitrary processes. A passphrase should be added as backup. > > (*) as non-guru reconfigure would not have to touch the file at all, if it were a user supplied file name. I'm aware other files are often put in the store by references in operating-system (or inlined). The secrets file on the other hand should just be assumed to be there. Initrd should try to mount the drive. Best regards