booting gbde-encrypted filesystem
phk at phk.freebsd.dk
Fri Jul 29 11:52:44 GMT 2005
In message <20050729134548.1cc28dr8gg0k4k0g at netchild.homeip.net>, Alexander Leidinger writes:
>Pawel Jakub Dawidek <pjd at freebsd.org> wrote:
>> This is not not possible with current GBDE.
>> I've patches which allows this here:
>I fail to see how this allows an encryted root-FS, it doesn't add gbde
>support to boot0(ext) or to the loader. It needs access to an unencrypted
>kernel. I don't think this is what Ronnel had in mind (overlooking the fact
>that his suggestion to save the passphrase in the loader is insecure).
There is a difference between loading the kernel from an encrypted volume
(very hard!) and mounting the root filesystem from an encrypted volume
(possible with pawels patch.
Now of course, if your kernel has been trojaned, you're in trouble, but
then again, most people just worry about their data if the machine gets
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
More information about the freebsd-hackers