From owner-freebsd-hackers@FreeBSD.ORG Sat Mar 28 01:32:34 2015 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7510C635 for ; Sat, 28 Mar 2015 01:32:34 +0000 (UTC) Received: from mail-wi0-x232.google.com (mail-wi0-x232.google.com [IPv6:2a00:1450:400c:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id F337B6C2 for ; Sat, 28 Mar 2015 01:32:33 +0000 (UTC) Received: by wibgn9 with SMTP id gn9so52771402wib.1 for ; Fri, 27 Mar 2015 18:32:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=5c35P82ZdGrfFoX3vW/cAtgYS3X2JPrFgWGaw7f+eWE=; b=XFP8n6gdpsnkE14GW8P1hb+0PP/XDkMKwASOjT7YbZ6M0sKwB5Jrs6UCXTX8ILkVgq jCLnqhUAVhxmUBOkBYpBsAcuImls30z3juThBwjtl1YIjiTjyzBn4sOaW8gOGuNQOUCW SlvIDk/4VjVl8T5i+JUJ0b6vSyDtKgy93O5h+2cyqxUd8GvImhF7yh2gdDUhp1G7H9oD BzLvefb8Ch9IsIrjJPXwd4kI9AD5nW4FYZbIiDBq5jPOySN53jOd24bfWfB4tBXPOMqI EKwvkwdcpX91XAPfwHYlqI7tClq5tn1D+RSndW9Ah2OCZ+WejyQ62hnwfCHDY2a62KpC FzhA== MIME-Version: 1.0 X-Received: by 10.194.57.170 with SMTP id j10mr43329146wjq.102.1427506352467; Fri, 27 Mar 2015 18:32:32 -0700 (PDT) Received: by 10.194.18.37 with HTTP; Fri, 27 Mar 2015 18:32:32 -0700 (PDT) In-Reply-To: <55159CF0.9060700@delphij.net> References: <20150319013231.GR51048@funkthat.com> <55149E70.30608@delphij.net> <55159CF0.9060700@delphij.net> Date: Fri, 27 Mar 2015 22:32:32 -0300 Message-ID: Subject: Re: GELI support on /boot folder From: Pedro Arthur To: Xin LI Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: "" , John-Mark Gurney X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Mar 2015 01:32:34 -0000 Disregard this boot2 comment, it has nothing to do with the gptboot 2015-03-27 15:09 GMT-03:00 Xin Li : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > On 03/26/15 19:56, Pedro Arthur wrote: > > I think that encrypting the boot folder will protect the boot > > configurations, kernel and kernel modules from being changed. > > I see... Have you considered other approaches for this goal, for > instance verifying signature? (But to make it useful, we still need > something in the BIOS/EFI to enforce the integrity of the boot code > itself). > > >> If we make changes to loader more often, it could be a bad idea > >> because merging both parties would make it harder for those who > >> develop loader changes. > >> > >> Additionally, it may be desirable to keep different copies of > >> loaders in different "boot environment" datasets, it's more > >> convenient for debugging: let's say one developer decided to make > >> some changes to ZFS support of loader, and that's installed to a > >> new boot environment, then they can try it out without making a > >> usable boot disk at hand before hand. Once the zfsloader is > >> proven to be working (we still have zfsloader.old or a different > >> boot environment available), we would have much more confident > >> that the system will boot after a gptzfsboot update because they > >> share the same code. > >> > >> I agree with you, but the boot2 has already reached its size > >> limit.For > > example if you try to compile the boot2 with clang < 3.5 (>=3.5 > > uses the enable-gvn flag) you will get an error saying boot2 > > exceeded its max size by ~20 bytes. I can't see other way to do it > > without merging. > > Hmm I don't quite follow -- we were discussing about whether to merge > gpt[zfs]boot with [zfs]loader, right? > > (I don't have strong opinion on whether we merge or not merge the two, > just would like to point out the pro/cons). > > Cheers, > - -- > Xin LI https://www.delphij.net/ > FreeBSD - The Power to Serve! Live free or die > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.1.2 (FreeBSD) > > iQIcBAEBCgAGBQJVFZztAAoJEJW2GBstM+nsBLUP/RuzlcrJ6+WW3h5vUF0gNwb+ > zEv/WAPtiH6pZIgcUmUkL2F4icKEiEknoTgPhObpgARGPx4xrm7pYHZ4Zsule/MS > KYE3Sys8eLwIONHSBl1sHJ3WV8K/Jv+buwRDWXsmwtjH8e7C5yxrmuytp4XJ4Lxp > pRIqNJmfdPJOI1bNMJCI4sPNHo/1pnxQGNTN2vxJAdjSzgh9FvIiH00CyHm+r23z > ZCQn1aAGded2Rnv4boG0EPklKQA38GG8kHdtQVaLySDZL13BvHFbF0P09b/1m0I7 > TXypho3xgHEI2vVDiLPPIgFdnFm95AJ2ibVu5UP3g+4iqiGMSwtq7XYZRnDIGVJ5 > MxZdgTgf1c7tvmf8SoQLFnfDVi8RfVzh+CpmbWr7+KotuW3BMfOgd20V2z/ItDhF > 9ptZDPUILrqEUL127HwSMENX8mwLmMDo14lPzRtan7YfoIgNMgAh0B0ZwP5Ow0yO > txsJ8/YQYgcCOP3sQinyu+OV3OD91qlK0OBIePrqX8eP5jI1paflXElikWhEYjvi > pNO2c+HenFm09OGGaW5PrHvIk4fjknkpq0ndwS2a8dSQS2zFaEvfzvKvoCr2x7Lh > KtTzdGrORXdYelHndeMg8dh9LXDWEQgNdWBNP+xKnL23xaXcVWo8qgWpLM4RIc72 > uGDJqiUysU9rDEf3oq7z > =H1bs > -----END PGP SIGNATURE----- >