Re: [systemd-devel] systemd-cryptenroll with TPM2

2023-08-23 Thread Andrei Borzenkov
On Wed, Aug 23, 2023 at 12:50 PM Aleksandar Kostadinov wrote: > > On Wed, Aug 23, 2023 at 10:49 AM Andrei Borzenkov wrote: > <...> > > > > Sure, if you allow unencrypted systems to boot in your OS then all > > > > bets are off. You shouldn't do that of course. > > > > > > > > (in my model of mind

Re: [systemd-devel] systemd-cryptenroll with TPM2

2023-08-23 Thread Aleksandar Kostadinov
On Wed, Aug 23, 2023 at 10:49 AM Andrei Borzenkov wrote: <...> > > > Sure, if you allow unencrypted systems to boot in your OS then all > > > bets are off. You shouldn't do that of course. > > > > > > (in my model of mind, where automatic GPT image dissection is used the > > > image dissection pol

Re: [systemd-devel] systemd-cryptenroll with TPM2

2023-08-23 Thread Andrei Borzenkov
On Tue, Aug 22, 2023 at 10:45 PM Aleksandar Kostadinov wrote: > > On Tue, Aug 22, 2023 at 8:10 PM Lennart Poettering > wrote: > > On Di, 22.08.23 19:16, Aleksandar Kostadinov (akost...@redhat.com) wrote: > <...> > > > If attacker replaces volume with unencrypted one, and it boots without > > > me

Re: [systemd-devel] systemd-cryptenroll with TPM2

2023-08-23 Thread Lennart Poettering
On Di, 22.08.23 22:35, Aleksandar Kostadinov (akost...@redhat.com) wrote: > On Tue, Aug 22, 2023 at 8:10 PM Lennart Poettering > wrote: > > On Di, 22.08.23 19:16, Aleksandar Kostadinov (akost...@redhat.com) wrote: > <...> > > > If attacker replaces volume with unencrypted one, and it boots withou