Can you elaborate on this a bit please? Or point at some manual that could help get started with th topic? While the concept sounds familiar I don't have enough experience to build a secure boot environment from scratch - and that's what needs to be done in case of Qubes.
On Wednesday, May 6, 2020 at 9:16:54 AM UTC+2, [email protected] wrote: > > On Wed, May 06, 2020 at 06:21:00AM +0000, lamboicarus via qubes-users > wrote: > > I am wondering if anyone knows how I might install grub for use with > > an encrypted boot partition, or no boot partition at all. I have > > recently decided to use btrfs, and I have grub working fine. The > > grub2-efi config from the qubes-dom0-unstable repo is working fine, > > but it's very complex. Reading about grub on the arch-wiki, it says > > boot security is a very complex topic. > > just encrypting your /boot but keeping an unencrypted grub > around that opens that /boot is not increasing your security > in any meaningful way. it just adds a pile of fragility. > > for actual cryptographic boot security, you need a "verified" > and/or "measured" boot setup. > > since you mentioned "efi", i would recommend an efi-heads hybrid. > deploy a linux kernel with _internal_ initrd (!) as efi-verified > boot payload. this way you have to do the efi-signing "just once", > and from that linux kernel you can open your encrypted /boot > in the "natural linux ways". > > if your "bios" takes measurements during boot, do tpmtotp (or similar) > from the first stage linux (before unlocking your /boot) you dont even > have to do any modifications to the payloads inside /boot ... > so no resigning/resealing on every payload-xen/kernel update either! > > this setup does not involve grub at all. this is intentional. > > > > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/8afd7aef-5470-4ab3-b83b-2dccd1246414%40googlegroups.com.
