Re: dm-integrity volume with TPM key?

[Lennart Poettering <lennart@xxxxxxxxxxxxxx>]

On Do, 30.09.21 21:20, Sebastian Wiesner (sebastian@xxxxxxxx) wrote:

> Hello,
>
> thanks for quick reply, I guess this explains the lack of
> instructions

btw, coincidentally this was posted on github on the day you posted
this:

https://github.com/systemd/systemd/pull/20902

so hopefully we'll have te missing tools in place soon too.

> As a workaround you'd use a regular file key for dm-integrity and put
> that on a TPM-protected partition, if I understand you correctly?

yes.

> I.e. you'd
>
> 1. enable secureboot (custom keys or shim),
> 2. bundle kernel & initrd into signed UEFI image for systemd-boot,
> 3. make / a LUKS-encrypted parition with systemd-cryptenroll, bound to
> the TPM (perhaps PCR 0 and 7) aund unlocked automatically at boot,

only pcr 7, for the reasons explained in the blog story.

> 4. make /home a dm-integrity partition, with a regular keyfile from
> e.g. /etc/integrity.key (which is on the encrypted partition), and

actually, after thinking a bit more about this I figure the ultimate
path for this would be /etc/integritysetup-keys.d/home.key – because
we already implemented in systemd-cryptsetup a scheme where we search
for the encryption key for volume xyz in
/etc/cryptsetup-keys.d/xyz.key, and we should probably do it similar
for verity keys, too.

> 5. use homed for LUKS-encrypted home areas on /home?
>
> Does this sound reasonable?  

Yes!

Lennart

--
Lennart Poettering, Berlin