search

AsahiLinux / docs

Hardware and software docs / wiki
Other
1.76k stars 49 forks source link

Disk Encryption #38

Open heywoodlh opened 2 years ago

heywoodlh commented 2 years ago

LUKS disk encryption would be a nice-to-have option with the installer. However, I can understand this potentially not being an option as the installer has to play nicely with the existing APFS filesystem.

Perhaps systemd-homed using LUKS as the storage mechanism could be considered as a compromise as the user's home directory (perhaps the most relevant part of the filesystem to keep private) would be LUKS encrypted. It wouldn't be full-disk encryption, but still could get some of the way there for user's hoping to have an additional layer of security. However, I could understand this being undesired as it can introduce some complexity and unforeseen complications.

P.S. thanks for all the work that's gone to Asahi. It's so well thought out and I appreciate how polished it is despite being in Alpha. I can't wait for the finished product.

EDIT:

I want to add that for users who want to convert their existing user's home directory to systemd-homed, there is a migration guide

However, there are some constraints on the partition that need to be met for systemd-homed to work with LUKS as the storage mechanism. I'm not sure if the way the partitions are setup in the installer would meet the requirements. I'm just adding this because I'm not sure if these constraints would invalidate the ability to use systemd-homed with Asahi's installer.

b-crumb commented 1 year ago

I would like to add on to this that I have for now written a relatively OK bunch of notes which should be sufficient to explain to anyone how to set up LUKS... this could be added to the wiki.

https://github.com/b-crumb/asahi-luks-notes/blob/main/ASAHILUKS.md

davidalger commented 1 year ago

For those using an Asahi Fedora remix, I posted a how-to on my blog covering the entire process of install, LUKS encryption, configure grub, rebuild initramfs, etc.

https://davidalger.com/posts/asahi-fedora-workstation-on-apple-silicon-with-luks-encrypted-root/

TL:DR; The LUKS encryption part itself is done in-place while booted from a Fedora USB drive allowing the Fedora root partition to remain unmounted:

  1. Shrink the btrfs filesystem by 32 MiB

  2. Encrypt in-place using cryptsetup

    cryptsetup reencrypt --encrypt --reduce-device-size 32M /dev/nvme0n1pX

  3. Add the volume to /etc/crypttab

  4. Update grub config adding rd.luks.uuid=LUKS_UUID to GRUB_CMDLINE_LINUX and rebuild initramfs using dracut in a chroot.