GELI support on /boot folder

[John-Mark Gurney]

Pedro Arthur wrote this message on Wed, Mar 18, 2015 at 15:50 -0300:
> I was discussing with Kris Moore about adding support for GELI in
> bootloader as a GSoC project,
> thus the /boot folder could be encrypted.
> However the stage 2 boot program has a limit size of  ~8 Kb which is almost
> reached in the default
> HEAD src.
> Thus I would like to know your thoughts about this project, if it is
> viable, and what can be done to
> overcome these 8 Kb limit.

One option is to not support MBR and only support GPT for this... w/
GPT we do not have the 8k limitation (and actually the limit is 7.5k
as .5k has historically been used for MBR boot code/partition table
in the dangerously dedicated mode)...

If we go thise route, I'd ask why we don't put loader into the gptboot
instead of using the existing shim to load loader...  Then the project
would be to add GELI decryption to loader which could then be used
w/ MBR in the limited sense of loading kernel and modules, though
boot/loader would still have to be on an unencrypted partition...

I hope others who know the boot process better will inform us why
this is a good or bad idea...

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."