GELI support on /boot folder

Pedro Arthur bygrandao at gmail.com
Fri Mar 27 02:56:04 UTC 2015


I think that encrypting the boot folder will protect the boot
configurations, kernel and kernel modules from being changed.

> If we make changes to loader more often, it could be a bad idea
> because merging both parties would make it harder for those who
> develop loader changes.
>
> Additionally, it may be desirable to keep different copies of loaders
> in different "boot environment" datasets, it's more convenient for
> debugging: let's say one developer decided to make some changes to ZFS
> support of loader, and that's installed to a new boot environment,
> then they can try it out without making a usable boot disk at hand
> before hand.  Once the zfsloader is proven to be working (we still
> have zfsloader.old or a different boot environment available), we
> would have much more confident that the system will boot after a
> gptzfsboot update because they share the same code.
>
> I agree with you, but the boot2 has already reached its size limit.For
example if you try to compile the boot2 with clang < 3.5 (>=3.5 uses the
enable-gvn flag) you will get an error saying boot2 exceeded its max size by
~20 bytes. I can't see other way to do it without merging.


More information about the freebsd-hackers mailing list