[systemd-devel] Make systemd-localed modify the kernel commandline for the initrd keymap?

[Mantas Mikulėnas]

On Fri, Sep 27, 2019 at 3:18 PM Alberto Ruiz <aruiz at redhat.com> wrote:

>
>
> On Fri, Sep 27, 2019 at 12:50 PM Lennart Poettering <mzerqung at 0pointer.de>
> wrote:
>
>> On Mi, 25.09.19 16:50, Hans de Goede (hdegoede at redhat.com) wrote:
>>
>> > Hi all,
>> >
>> > Currently, at least in Fedora, but I do not believe that this problem is
>> > unique to Fedora, there are 2 problems with keymap handling in the
>> > initrd.
>>
>> Hmm, why do you need a correct initrd in the early boot? I can see two
>> reasons:
>>
>> 1. full disk encryption with the user typing in the password on the
>>    kbd. But isn't the answer to this to link the root OS to the tpm
>>    instead, and use user-keyed crypto only for $HOME? The OS itself
>>    doesn't need to be protected after all, everbody should have the
>>    same files there anyway, it's $HOME that needs protection.
>>
>
> Some counterarguments here:
> - The TPM does not protect you from someone stealing your entire laptop
> and booting from external media,
>

It does, because one of the PCRs has the entire boot sequence embedded into
it. If you seal the key and then boot something else, the TPM will refuse
to unseal the key for you. The same can be applied to hash of the kernel
image (and initrds, if someone patched systemd-boot to include them in
PCR8), and/or to Secure Boot state as done by Windows.


> - There are plenty of systems out there without a TPM module that Fedora
> cares about
>

That's the main problem. Only two of my several still-reasonably-modern x64
machines have TPMs, and one of them is TPM 1.2 which requires the
completely unmaintained Trousers stack.

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20190927/ff2f2323/attachment-0001.html>