On Wed, May 06, 2020 at 06:21:00AM +0000, lamboicarus via qubes-users wrote:
> I am wondering if anyone knows how I might install grub for use with
> an encrypted boot partition, or no boot partition at all. I have
> recently decided to use btrfs, and I have grub working fine. The
> grub2-efi config from the qubes-dom0-unstable repo is working fine,
> but it's very complex. Reading about grub on the arch-wiki, it says

boot security is a very complex topic.

just encrypting your /boot but keeping an unencrypted grub
around that opens that /boot is not increasing your security
in any meaningful way. it just adds a pile of fragility.

for actual cryptographic boot security, you need a "verified" 
and/or "measured" boot setup. 

since you mentioned "efi", i would recommend an efi-heads hybrid.
deploy a linux kernel with _internal_ initrd (!) as efi-verified
boot payload. this way you have to do the efi-signing "just once",
and from that linux kernel you can open your encrypted /boot
in the "natural linux ways".

if your "bios" takes measurements during boot, do tpmtotp (or similar) 
from the first stage linux (before unlocking your /boot) you dont even 
have to do any modifications to the payloads inside /boot ...
so no resigning/resealing on every payload-xen/kernel update either!

this setup does not involve grub at all. this is intentional.



-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20200506071648.GK987%40priv-mua.

Reply via email to