all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [bug#65002] [PATCH 0/2] Add support for unlocking root device via a key file
@ 2023-08-01 20:53 Tomas Volf
  2023-08-01 21:09 ` [bug#65002] [PATCH 1/2] mapped-devices: Allow unlocking by " Tomas Volf
                   ` (5 more replies)
  0 siblings, 6 replies; 25+ messages in thread
From: Tomas Volf @ 2023-08-01 20:53 UTC (permalink / raw)
  To: 65002; +Cc: Tomas Volf

When having an encrypted /boot, it is currently necessary to input a password
twice, once for the /boot (so that grub can find its configuration) and later
once more in order to actually unlock the / itself.  It is not very user
friendly and gets annoying quickly in more exotic setups.  For example with /
on RAID1 BTRFS, password needs to be entered 4 times.  And even without that,
for large encrypted arrays, password needs to be entered once per drive.

The obvious solution to this is to just use --key-file option of the luksOpen
command, however support for that was not implemented.  This series adds that
support.

Another problem is where to store the key file, since it needs to be both
present in the initrd, but it cannot be in the store (since that would make it
world-readable, and you do not want that for an encryption key).  Luckily for
us, grub can load multiple initrds and merge them, so option to specify
additional initrd (not from the store) is added as well.

Since extlinux does not look like supporting encrypted /boot (and this new
option should not be used for anything else), it was added only into into
grub.

Tomas Volf (2):
  mapped-devices: Allow unlocking by a key file
  gnu: bootloader: grub: Add support for loading an additional initrd

 doc/guix.texi                 | 32 +++++++++++++++++
 gnu/bootloader.scm            |  6 +++-
 gnu/bootloader/grub.scm       |  6 ++--
 gnu/system/mapped-devices.scm | 67 ++++++++++++++++++++++-------------
 4 files changed, 83 insertions(+), 28 deletions(-)


base-commit: 5a293d0830aa9369e388d37fe767d5bf98af01b7
-- 
2.41.0





^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2024-01-14 20:55 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-08-01 20:53 [bug#65002] [PATCH 0/2] Add support for unlocking root device via a key file Tomas Volf
2023-08-01 21:09 ` [bug#65002] [PATCH 1/2] mapped-devices: Allow unlocking by " Tomas Volf
2023-08-01 21:09 ` [bug#65002] [PATCH 2/2] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2023-08-02 13:02 ` [bug#65002] [PATCH v2 1/2] mapped-devices: Allow unlocking by a key file Tomas Volf
2023-08-02 13:02   ` [bug#65002] [PATCH v2 2/2] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-09 23:28     ` Ludovic Courtès
2024-01-11 13:32       ` Tomas Volf
2024-01-09 23:21   ` [bug#65002] [PATCH v2 1/2] mapped-devices: Allow unlocking by a key file Ludovic Courtès
2024-01-11 12:39     ` Tomas Volf
2024-01-11 17:39       ` Tomas Volf
2023-08-10  0:22 ` [bug#65002] [PATCH 0/2] Add support for unlocking root device via " Dominik Riva via Guix-patches via
2024-01-11 17:32 ` [bug#65002] [PATCH 1/6] mapped-devices: Allow unlocking by " Tomas Volf
2024-01-11 17:32   ` [bug#65002] [PATCH 2/6] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-11 17:32   ` [bug#65002] [PATCH 3/6] tests: Add `encrypted-home-os-key-file' installation test Tomas Volf
2024-01-11 17:32   ` [bug#65002] [PATCH 4/6] tests: install: Use the smallest possible iteration time for LUKS Tomas Volf
2024-01-11 17:32   ` [bug#65002] [PATCH 5/6] tests: install: Fix encrypted-root-os test Tomas Volf
2024-01-11 17:32   ` [bug#65002] [PATCH 6/6] tests: install: Fix encrypted-home-os, encrypted-home-os-key-file tests Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 1/6] mapped-devices: Allow unlocking by a key file Tomas Volf
2024-01-11 17:35   ` [bug#65002] [PATCH v3 2/6] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-11 17:35   ` [bug#65002] [PATCH v3 3/6] tests: Add `encrypted-home-os-key-file' installation test Tomas Volf
2024-01-11 17:35   ` [bug#65002] [PATCH v3 4/6] tests: install: Use the smallest possible iteration time for LUKS Tomas Volf
2024-01-14 20:54     ` Ludovic Courtès
2024-01-11 17:35   ` [bug#65002] [PATCH v3 5/6] tests: install: Fix encrypted-root-os test Tomas Volf
2024-01-11 17:35   ` [bug#65002] [PATCH v3 6/6] tests: install: Fix encrypted-home-os, encrypted-home-os-key-file tests Tomas Volf
2024-01-14 20:53   ` bug#65002: [PATCH v3 1/6] mapped-devices: Allow unlocking by a key file Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.