ISO: Change to unencrypted /boot if using Full Disk Encryption

Patrick · March 18, 2024, 2:05pm

Calamares setting up encrpyted /boot (which gets decrypted with GRUB2) causes many issues.

GRUB2 needs a very long time to decrypt the root disk.
Need to enter full disk password twice, at grub boot menu and systemd during boot. This might be a missing dracut module or bug.
And the worst issue: Keyboard layout issues. There is no way to define keyboard layout during GRUB2 pre-boot full disk encryption password entry. (If there is, these are very complicated, not suitable for a Debian derivative and also break SecureBoot.)

This should be no security issue. This is what most distributions are using. The kernel image is not secret. Unencrypted /boot that Debian (CLI looking) installer (“DI”) is using that too. Encrypted /boot is simply not ready due to these upstream bugs which will very most likely not be resolved anytime soon.

TODO:

Find a distribution that uses Calamares and implemented unencrypted /boot.
- Maybe Ubuntu? Check
  - ```
  git clone https://git.launchpad.net/~ubuntu-qt-code/+git/calamares-settings-ubuntu
```
- Linux Mint?
- Elementary OS?
Copy over the Calamares config files to Kicksecure (if permissible by the license, which is probably the case).
Change Kicksecure Calamares Installer to the usual unencrypted /boot partition.

Patrick · April 1, 2024, 5:19am

Patrick · April 1, 2024, 10:48am

github.com

calamares/calamares/blob/calamares/src/modules/partition/partition.conf

# SPDX-FileCopyrightText: no
# SPDX-License-Identifier: CC0-1.0
#

# Options for EFI system partition.
#
# - *mountPoint*
#   This setting specifies the mount point of the EFI system partition. Some
#   distributions (Fedora, Debian, Manjaro, etc.) use /boot/efi, others (KaOS,
#   etc.) use just /boot.
#
#   Defaults to "/boot/efi", may be empty (but weird effects ensue)
# - *recommendedSize*
#   This optional setting specifies the size of the EFI system partition.
#   If nothing is specified, the default size of 300MiB will be used.
#   When writing quantities here, M is treated as MiB, and if you really
#   want one-million (10^6) bytes, use MB.
# - *minimumSize*
#   This optional setting specifies the absolute minimum size of the EFI
#   system partition. If nothing is specified, the *recommendedSize*

This file has been truncated. show original

Patrick · April 16, 2024, 8:15am

github.com

Kicksecure/live-config-dist/blob/master/etc/calamares/modules/partition.conf

## https://github.com/calamares/calamares/blob/calamares/src/modules/partition/partition.conf
## https://github.com/bbqlinux/calamares-bbqlinux/blob/master/src/etc/calamares/modules/partition.conf

efiSystemPartition:     "/boot/efi"

## Size? See:
## https://github.com/grml/grml-debootstrap/issues/221
efi:
    mountPoint:         "/boot/efi"
    recommendedSize:    550MiB
    minimumSize:        550MiB
    label:              "EFI"

efiSystemPartitionSize:     550MiB

userSwapChoices:
    - none      # Create no swap, use no swap
    - reuse     # Re-use existing swap, but don't create any
    - small     # Up to 4GB
    - suspend   # At least main memory size

This file has been truncated. show original

Patrick · April 16, 2024, 8:15am

Probably not possible as long as Kicksecure is based on Debian 12 / bookworm.

Requires a newer calamares version which is only installable in Debian 13 / trixie.

Very difficult to install the newer calamares version in Debian 13 due to dependency issues.